CVE-2018-9276

CVE-2018-9276 affects Paessler PRTG Network Monitor (pre-18.2.39). An OS command injection can be triggered by an attacker who has administrative access to the PRTG System Administrator web console, via malformed parameters in sensor or notification management scenarios. This vulnerability could ...

CVE-2018-3760

CVE-2018-3760 is a Local File Inclusion/path-traversal vulnerability in Ruby on Rails’ Sprockets, caused by a flaw in the server-side routine forbidden_request?() that allowed access to files outside the application root when the Sprockets server is used in production. Affected versions include S...

CVE-2018-10661

Axis IP Cameras across multiple models are affected by CVE-2018-10661, which enables an authentication bypass of access control. The connected sources describe an exploit path where an unauthenticated request bypasses the .srv functionality, enabling unauthenticated access to the device bus via D...

CVE-2018-10662

CVE-2018-10662 affects Axis IP Cameras, described as an Exposed Insecure Interface. Connected sources document a multi-stage exploit path: an unauthenticated bypass of .srv functionality enabling a Parhand DBus command flow, leading to potential root command execution (Metasploit module and Explo...

CVE-2018-12613

phpMyAdmin 4.8.x before 4.8.2 is affected. The issue arises from a flow where pages are redirected/loaded within phpMyAdmin and an improper test for whitelisted pages enables including (and potentially executing) server files. An attacker must be authenticated, except when cfg.AllowArbitraryServe...

CVE-2018-11222

Pandora FMS

CVE-2018-6961

CVE-2018-6961 affects VMware NSX SD-WAN Edge by VeloCloud, with a command injection in the local web UI component. Affected versions include SD-WAN Edge prior to 3.1.0; exploitation could lead to remote code execution. Public materials cite in-the-wild exploit tooling and a later fixed release (e...

CVE-2016-9079

CVE-2016-9079 is a use-after-free vulnerability in Mozilla Firefox/Thunderbird SVG Animation. Affected: Firefox < 50.0.2, Firefox ESR < 45.5.1, Thunderbird

CVE-2018-4237

CVE-2018-4237 refers to a libxpc logic/memory issue in multiple Apple platforms (iOS ≤11.4, macOS ≤10.13.5, tvOS ≤11.4, watchOS ≤4.3.1). The Apple entries describe a privileged-elevation and potential arbitrary-code-execution impact via a crafted app, caused by a logic error in libxpc with a corr...

CVE-2018-10088

CVE-2018-10088 affects XiongMai uc-httpd 1.0.0. A buffer overflow in the login handling (POST /login.htm) can be triggered by a crafted username field (e.g., a long input like 85 'A's) to overflow a stack buffer. PoC Exploit code and public exploit entries demonstrate sending this crafted request...

CVE-2018-11409

Splunk information disclosure vulnerability CVE-2018-11409 affects Splunk and is disclosed in Splunk versions up to 7.0.1. The issue arises when an attacker appends __raw/services/server/info/server-info?output_mode=json to a query, which can disclose sensitive information such as license keys. P...

CVE-2018-12031

CVE-2018-12031 affects Eaton Intelligent Power Manager v1.6 with a Local File Inclusion through directory traversal in the downloadFirmware action (server/node_upgrade_srv.js). The root cause is improper handling of the firmware parameter, enabling an attacker to traverse directories and potentia...

CVE-2018-0296

CVE-2018-0296 affects Cisco ASA and related FTD/FTD-based offerings, where an improper input validation of HTTP URLs in the web interface allows unauthenticated remote access to trigger DoS (device reload) or, on some releases, expose sensitive information via directory traversal. Public referenc...

CVE-2018-11714

CVE-2018-11714 affects TP-Link TL-WR840N v5 and TL-WR841N v13 devices. The issue arises from improper session handling in the /cgi/ folder or a /cgi file, which allows an attacker to bypass authentication if a Referer header like Referer: http://192.168.0.1/mainFrame.htm is sent. This leads to co...

CVE-2018-11138

CVE-2018-11138 affects Quest KACE System Management Appliance 8.0.318 where the unauthenticated /common/download_agent_installer.php endpoint can be abused to execute arbitrary commands as the web server user. The Core Security advisory and multiple sources confirm remote code execution via unaut...

CVE-2018-3639

CVE-2018-3639 is a speculative execution side‑channel vulnerability (SSB) that can leak memory via speculative stores. The Connected ALMA doc notes a mitigation: SSB is disabled by the new alt-java launcher, reducing impact at the cost of performance, and it references OpenJDK 8u282 as part of th...

CVE-2018-4939

Adobe ColdFusion is affected by CVE-2018-4939 due to a Deserialization of Untrusted Data vulnerability in Update 5 and earlier (and ColdFusion 11 Update 13 and earlier). The issue arises from insecure deserialization in the DataServicesCFProxy/integration flow, enabling arbitrary code execution u...

CVE-2018-10737

CVE-2018-10737 describes a SQL injection in Nagios XI (pre-5.4.13) exploitable via the admin/logbook.php txtSearch parameter. Multiple sources in the connected documents corroborate an authenticated-admins vulnerability that can access/modify database contents. Affected versions include Nagios XI...

CVE-2018-10942

CVE-2018-10942 affects the PrestaShop Attribute Wizard addon 1.6.9 (modules/attributewizardpro/file_upload.php) and PrestaShop 1.4.0.1–1.6.1.18. The vulnerability allows remote attackers to execute arbitrary code by uploading a .phtml file. Data from connected documents confirms the attack vector...

CVE-2018-10957

CVE-2018-10957 affects the D-Link DIR-868L router. The vulnerability is a CSRF in the affected components hedwig.cgi and pigwidgeon.cgi that can allow a remote attacker to perform actions such as changing the Admin password. Impact is described across multiple sources; no official patch/version i...