CVE-2018-15355

Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118...

Code execution vulnerability in HongCMS v3.0 la***.php page

HongCMS is an open source lightweight content management system CMS. HongCMS v3.0 la.php page code execution vulnerability, the vulnerability stems from the background failed to strictly filter the login management file, an attacker can exploit the vulnerability, resulting in arbitrary file writi...

PHP Scripts Mall PHP Template Store Script Cross-Site Scripting Vulnerability

PHP Scripts Mall PHP Template Store Script is a set of scripts for selling website templates online by PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall PHP Template Store Script version 3.0.6. The vulnerability can be exploited by a remote attacker to inject...

CVE-2018-14976

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS...

CVE-2018-14972

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS...

XYHCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-13984)

XYHCMS is an open source content management system CMS. A cross-site request forgery vulnerability exists in xyhai.php?s=/Auth/addUser URL in XYHCMS version 3.5. A remote attacker can exploit this vulnerability to add a backend administrator account...

CVE-2018-14583

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account...

UBUNTU-CVE-2018-14395

libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service application crash caused by a divide-by-zero error with a user crafted audio file when converting to the MOV audio format...

Command Execution Vulnerability in OTCMS v3.53

Net Titanium Article Management System OTCMS is a simple and good asp article management system. A command execution vulnerability exists in OTCMS v3.53. An attacker can use the vulnerability to obtain website path information and write PHP code to gain server privileges...

PT-2018-3718

Name of the Vulnerable Software and Affected Versions Info-ZIP Zip version 3.0 Description The issue is related to the use of memory after it has been freed, which can allow a remote attacker to access confidential information or cause a denial of service. The vulnerability is associated with the...

CVE-2018-13223

The sell function of a smart contract implementation for R Time Token v3 RS Contract Name: RTokenMain, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

Dialogic PowerMedia XMS Hardcoded Credentials Vulnerability

Dialogic PowerMedia XMS is a suite of software multimedia servers for real-time communications from Dialogic, Inc. that provide real-time multimedia communication solutions for IMS, MRF, enterprise and WebRTC applications. A hard-coded credentials vulnerability in the...

CVE-2018-13021

An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI...

Apache Pluto Information Disclosure Vulnerability

Apache Pluto is the United States Apache Apache Software Foundation set of Portlet container runtime environment. An information disclosure vulnerability exists in the PortletV3AnnotatedDemo Multipart Portlet war file code in Apache Pluto version 3.0.0, which stems from the program's failure to...

ASUS WRT-AC66U Cross-Site Scripting Vulnerability

The WRT-AC66U is a router product from ASUS. A cross-site scripting vulnerability exists in the ASUS WRT-AC66U version 3.x, which allows remote attackers to inject malicious script code into the application side of a vulnerable feature or service module...

CVE-2018-1000513

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting XSS vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x...

Zuul Information Disclosure Vulnerability

Zuul is a gateway service that provides dynamic routing, monitoring and security. A security vulnerability exists in version 3.x of Zuul prior to 3.1.0. An attacker could exploit the vulnerability to disclose credentials or other sensitive information...

Free Lossless Image Format Denial of Service Vulnerability (CNVD-2018-11452)

Free Lossless Image Format FLIF is a lossless image format based on MANIAC compression. A security vulnerability exists in the 'TransformPaletteC::process' function in the transform/paletteC.hpp file in FLIF version 0.3. A remote attacker can exploit this vulnerability to cause a denial of servic...

CVE-2017-7906

In ABB IP GATEWAY 3.39 and prior, the web server does not sufficiently verify that a request was performed by the authenticated user, which may allow an attacker to launch a request impersonating that user...

ABB IP Gateway Unauthorized Access Vulnerability (CNVD-2018-11991)

ABB IP GATEWAY is a building management system from ABB Switzerland. A security vulnerability exists in ABB IP GATEWAY version 3.39 and earlier, which originates from some configuration files containing passwords in clear text. An attacker could use this vulnerability to gain unauthorized access...