CVE-2018-6530

The CVE-2018-6530 entry describes an OS command injection in the D‑Link DIR series through soap.cgi (soapcgi_main in cgibin), allowing remote execution of arbitrary OS commands via the service parameter. Affected devices include DIR-880L (REVA firmware patches 1.08B04 and earlier), DIR-868L (DIR8...

CVE-2018-2380

CVE-2018-2380 affects SAP CRM running on SAP NetWeaver (CRM versions 7.01, 7.02, 7.30, 7.31, 7.33, 7.54). The issue is a directory traversal vulnerability caused by insufficient validation of user-supplied path information, allowing traversal sequences to be passed to file APIs. Remediation is av...

CVE-2014-3206

CVE-2014-3206 affects Seagate BlackArmor NAS. It allows remote attackers to execute arbitrary code by sending the session parameter to /backupmgt/localJob.php or the auth_name parameter to /backupmgmt/pre_connect_check.php, enabling remote code execution on the device. Root cause: improper input ...

CVE-2017-8961

The CVE-2017-8961 issue affects HPE Intelligent Management Center (IMC) PLAT versions around 7.3 (E0504P02 and related builds), where a directory traversal flaw in the flexFileUpload/FileUploadServlet path handling can enable remote code execution. The root cause is lack of proper validation of u...

CVE-2017-12542

CVE-2017-12542 affects HPE Integrated Lights-Out 4 (iLO 4). The advisory/entries describe an authentication bypass and remote code execution vulnerability in iLO 4 versions prior to 2.53. Exploitation can grant unauthorized administrative access and potential execution of arbitrary code via the i...

CVE-2018-6789

CVE-2018-6789 is an Exim SMTP base64d buffer overflow vulnerability. The issue resides in the base64d function of Exim’s SMTP listener prior to version 4.90.1, where a handcrafted EHLO/message can cause a heap/buffer overflow and enable remote code execution. Multiple sources confirm the vulnerab...

CVE-2018-0125

CVE-2018-0125 affects Cisco RV132W/RV134W routers. The web interface suffers from incomplete input validation in HTTP requests, allowing an unauthenticated attacker to execute arbitrary code with root privileges or trigger a device reload (DoS). Affected products: RV132W ADSL2+ Wireless-N VPN Rou...

CVE-2018-0127

Cisco RV132W/RV134W routers suffer an unauthenticated information-disclosure via the web interface due to missing authentication on confidential pages. An attacker can send crafted HTTP requests to view configuration data, including the administrator password. Affected devices: Cisco RV132W ADSL2...

CVE-2018-4878

Adobe Flash Player vulnerability CVE-2018-4878 is a use-after-free in the DRM/Primetime-related code (DRMManager initialize) that could allow remote arbitrary code execution. Affected products are Flash Player before 28.0.0.161; exploitation in the wild was reported in early 2018. Exploitation of...

CVE-2018-6605

The CVE-2018-6605 entry corresponds to a SQL Injection in the Joomla! Zh BaiduMap 3.0.0.1 component. The vulnerability is exploitable via the id parameter in several requests (getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, getPathDetails) and affects Zh BaiduMap 3.0.0.1 and earlier...

CVE-2018-1000001

CVE-2018-1000001 affects glibc up to version 2.26; realpath() can underflow a destination buffer when getcwd() returns a relative path, enabling local privilege escalation. Connected advisories confirm the issue and list affected packages (glibc and related). Remediation in documented advisories ...

CVE-2017-1000353

Summary (CVE-2017-1000353, Jenkins) : An unauthenticated remote code execution vulnerability affects Jenkins up to version 2.56 and the 2.46.1 LTS line. The issue arises when a serialized Java SignedObject is sent to the Jenkins CLI, which is deserialized via a new ObjectInputStream, bypassing a ...

CVE-2018-5999

Affected software: AsusWRT on Asus routers (firmware prior to 3.0.0.4.384_10007). Vulnerability: In handle_request() of router/httpd/httpd.c, processing of POST requests can continue after authentication fails, enabling unauthenticated access. Impact: Unauthenticated LAN remote code execution wit...

CVE-2018-6000

CVE-2018-6000 affects AsusWRT prior to version 3.0.0.4.384_10007. The vulnerability resides in the do_vpnupload_post function (vpnupload.cgi) in router/httpd/web.c, enabling an unauthenticated attacker to modify NVRAM configuration values, including the admin password, and to start SSH or enable ...

CVE-2017-18046

CVE-2017-18046 affects Dasan GPON ONT WiFi Router H640X — versions 12.02-01121 2.77p1-1124 and 3.03p2-1146. A buffer overflow in the login_action.cgi CGI endpoint (/cgi-bin/login_action.cgi) can be triggered by a long POST request, enabling remote arbitrary code execution. The provided connected ...

CVE-2018-0798

The CVE-2018-0798 entry concerns a memory corruption vulnerability in Microsoft Office (Word/Equation Editor) across Office 2007–2016. The root cause is how certain objects are handled in memory, enabling remote code execution when a specially crafted file is opened. Connected documents indicate ...

CVE-2018-0797

CVE-2018-0797 affects Microsoft Word components in Office 2010/2013/2016 where remote code execution can occur through specially crafted RTF content due to memory handling. Public details show Word memory corruption vulnerability enabling code execution when opening malicious files. Microsoft rel...

CVE-2018-0802

CVE-2018-0802 is a Microsoft Office memory corruption/remote code execution vulnerability in the Equation Editor, triggered by crafted OLE/embedded objects in Office documents. Affected products include Office 2007, 2010, 2013, and 2016; the issue arises from the way Office handles in-memory obje...

CVE-2018-0812

The CVE-2018-0812 entry describes a remote code execution vulnerability in Equation Editor across Office products (Word/Office 2003, 2007, 2010, 2013, 2016) due to how objects are handled in memory. The issue affects Word/Office components when processing crafted files, enabling code execution on...

CVE-2017-4946

CVE-2017-4946 affects VMware vRealize Operations for Published Applications/Desktop Agent (V4PA/V4H) 6.x prior to 6.5.1. A privilege escalation vulnerability exists that could allow a local, low-privilege user to escalate to SYSTEM on Windows. The issue is documented in VMware’s VMSA-2018-0003 an...