CVE-2018-8643

CVE-2018-8643 relates to a memory corruption vulnerability in the Internet Explorer scripting engine. Affected products include IE9, IE10, and IE11, with remote code execution potential due to how memory objects are handled. The issue is documented across several feeds (CVE and related records); ...

CVE-2018-20062

CVE-2018-20062 affects ThinkPHP/NoneCMS with remote code execution via crafted filter parameter in s=index/\think\Request/input&filter=phpinfo&data=1. Public sources in connected docs identify vulnerable versions as ThinkPHP <= 5.0.23 (and 5.1.x

CVE-2018-17480

CVE-2018-17480 is a Chrome/Chromium vulnerability in the V8 JavaScript engine: an out-of-bounds write that could enable remote code execution inside the sandbox via a crafted HTML page. Connected advisories confirm the impact across Chromium-based browsers and list the fixed-upstream version as 7...

CVE-2018-20057

CVE-2018-20057 affects D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1. The vulnerability exists in /bin/boa via the goform/formSysCmd endpoint, where remote authenticated users can execute arbitrary OS commands through the sysCmd POST parameter. Exploitation relies on unauthenticated acce...

ThinkPHP5 Remote Code Execution Vulnerability

ThinkPHP is developed and maintained by the Shanghai Top Thinking Information Technology Co., Ltd. development and maintenance of the MVC structure of the open-source PHP framework. A remote code execution vulnerability exists in thinkphp5. The vulnerability is due to the framework fails to perfo...

CVE-2018-1000861

CVE-2018-1000861 affects Jenkins via the Stapler web framework (MetaClass && deserialization), enabling remote code execution. Affected: Jenkins 2.153 and earlier, LTS 2.138.3 and earlier. Root cause: deserialization/IMPACTful method invocation through crafted URLs in stapler/core MetaClass.java ...

CVE-2018-3949

CVE-2018-3949 (TP-Link TL-R600VPN) is a directory-traversal vulnerability in the device’s HTTP server that can disclose sensitive files. Talos documentation states the issue exists in the TL-R600VPN web server and can be triggered by a crafted URL, with exploitation possible in both unauthenticat...

CVE-2018-3948

The CVE-2018-3948 issue affects the TP-Link TL-R600VPN HTTP server. It is a denial-of-service vulnerability in the URI-parsing functionality where a specially crafted URL can cause the device to stop responding to requests, leading to downtime for the management portal. The vulnerability can be t...

CVE-2018-13350

CVE-2018-13350 —TerraMaster TOS 3.1.03 is affected by an SQL injection in the logtable.php file, exploitable via the Event parameter. This vulnerability allows execution of SQL queries and is described in multiple sources, including the NVD entry. The connected documents provide the vulnerable co...

CVE-2018-13315

CVE-2018-13315 affects TOTOLINK A3002RU (firmware 1.0.8). The Root Cause is incorrect access control in formPasswordSetup, enabling an unauthenticated POST to change the administrator password. As per NVD, the CVSS‑3 base score is 9.8 (CRITICAL; NETWORK, no user interaction, high confidentiality/...

CVE-2018-13317

TOTOLINK A3002RU firmware 1.0.8 contains an information disclosure: an unauthenticated GET request to password.htm returns the plaintext admin password, enabling remote admin access. This affects the device's authentication flow and is documented across CVE-2018-13317 references (NVD entry and nu...

CVE-2018-19410

CVE-2018-19410 affects Paessler PRTG Network Monitor prior to 18.2.40.1683. An unauthenticated remote attacker can craft HTTP requests to override the include directive in /public/login.htm, trigger a Local File Inclusion by including /api/addusers, and create users with read-write privileges (in...

CVE-2018-6065

CVE-2018-6065 is an integer overflow in Google Chrome/Chromium’s V8 engine that could allow remote heap corruption via a crafted HTML page. Documents confirm the affected component as the V8 JavaScript engine and indicate potential remote code execution/heap corruption in versions prior to 65.0.3...

CVE-2018-17463

CVE-2018-17463 is a remote code execution vulnerability in the V8 JavaScript engine used by Google Chrome/Chromium. The issue allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page, stemming from an incorrect side-effect annotation in V8. Public disc...

CVE-2018-8581

CVE-2018-8581 is described as a Microsoft Exchange Server elevation of privilege vulnerability (PrivExchange). Connected documents include exploit/testing content showing a Maryland-style mailbox-Delegation approach to impersonate other users by manipulating inbox delegation, effectively enabling...

CVE-2018-8589

CVE-2018-8589 is an elevation-of-privilege vulnerability in Win32k.sys. Public details indicate it affects Windows 7 and Windows Server 2008/2008 R2, with exploitation requiring local logon and specially crafted calls to Win32k.sys. Public sources note that updated Windows patches from Microsoft ...

CVE-2018-14667

CVE-2018-14667 affects Red Hat JBoss RichFaces Framework 3.X up to 3.3.4, introducing an EL injection via UserResource$UriData that enables remote, unauthenticated code execution. The issue arises from EL expression handling in the UserResource resource, allowing a chain of Java serialized object...

CVE-2018-11759

CVE-2018-11759 affects the Apache Tomcat JK Connector (mod_jk) when used with Apache httpd: connector versions 1.2.0 through 1.2.44, due to edge-case handling in httpd path normalization, could allow exposure of application functionality via the reverse proxy and may bypass httpd access controls....

CVE-2018-14558

CVE-2018-14558 affects Tenda AC7/AC9/AC10 routers (firmware: AC7 ≤ V15.03.06.44_CN, AC9 ≤ V15.03.05.19(6318)_CN, AC10 ≤ V15.03.06.23_CN). The flaw arises in the formsetUsbUnload function, which calls dosystemCmd with untrusted input via a crafted goform/setUsbUnload request, leading to arbitrary ...

CVE-2017-18349

The CVE-2017-18349 entry describes Fastjson before 1.2.25 enabling remote code execution when used by Pippo 1.11.0 via a crafted JSON payload. The Nuclei template confirms the vulnerability is an insecure deserialization in FastjsonEngine where a crafted rmi:// URI in dataSourceName of an HTTP PO...