Search
Total
49350 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-11988 | 1 Google | 1 Android | 2019-01-09 | 4.6 MEDIUM | 7.8 HIGH |
| In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Un-trusted pointer de-reference issue by accessing a variable which is already freed. | |||||
| CVE-2018-11986 | 1 Google | 1 Android | 2019-01-09 | 4.6 MEDIUM | 7.8 HIGH |
| In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possible buffer overflow in TX and RX FIFOs of microcontroller in camera subsystem used to exchange commands and messages between Micro FW and CPP driver. | |||||
| CVE-2018-11984 | 1 Google | 1 Android | 2019-01-09 | 4.6 MEDIUM | 7.8 HIGH |
| In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition and an out-of-bounds access can occur in the DIAG driver. | |||||
| CVE-2018-11963 | 1 Google | 1 Android | 2019-01-09 | 7.2 HIGH | 7.8 HIGH |
| In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Buffer overread may occur due to non-null terminated strings while processing vsprintf in camera jpeg driver. | |||||
| CVE-2018-20463 | 1 Jsmol2wp Project | 1 Jsmol2wp | 2019-01-09 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF. | |||||
| CVE-2018-19994 | 1 Dolibarr | 1 Dolibarr | 2019-01-09 | 6.5 MEDIUM | 8.8 HIGH |
| An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the desiredstock parameter. | |||||
| CVE-2018-18485 | 1 Phpshe | 1 Phpshe | 2019-01-08 | 6.4 MEDIUM | 7.5 HIGH |
| An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock. | |||||
| CVE-2018-1000809 | 1 Privacyidea | 1 Privacyidea | 2019-01-08 | 5.0 MEDIUM | 7.5 HIGH |
| privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2. | |||||
| CVE-2018-19233 | 1 Comparex | 1 Miss Marple | 2019-01-08 | 2.1 LOW | 7.8 HIGH |
| COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in an Inventory Agent configuration file. | |||||
| CVE-2018-1000846 | 1 Freshdns Project | 1 Freshdns | 2019-01-08 | 6.8 MEDIUM | 8.8 HIGH |
| FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website containing attacker's javascript. This vulnerability appears to have been fixed in 1.0.5 and later. | |||||
| CVE-2018-17827 | 1 Hisiphp | 1 Hisiphp | 2019-01-08 | 6.5 MEDIUM | 7.2 HIGH |
| HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php. | |||||
| CVE-2017-14767 | 1 Ffmpeg | 1 Ffmpeg | 2019-01-08 | 6.8 MEDIUM | 8.8 HIGH |
| The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file. | |||||
| CVE-2017-17130 | 1 Libav | 1 Libav | 2019-01-08 | 6.8 MEDIUM | 8.8 HIGH |
| The ff_free_picture_tables function in libavcodec/mpegpicture.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to vc1_decode_i_blocks_adv. | |||||
| CVE-2018-1000867 | 1 Webidsupport | 1 Webid | 2019-01-07 | 6.5 MEDIUM | 8.8 HIGH |
| WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f. | |||||
| CVE-2018-1000882 | 1 Webidsupport | 1 Webid | 2019-01-07 | 5.0 MEDIUM | 7.5 HIGH |
| WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f. | |||||
| CVE-2018-1239 | 1 Dell | 2 Emc Unity Operating Environment, Emc Unityvsa Operating Environment | 2019-01-07 | 9.0 HIGH | 7.2 HIGH |
| Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed. | |||||
| CVE-2018-9082 | 1 Lenovo | 40 Ez Media \& Backup Center, Ez Media \& Backup Center Firmware, Ix2 and 37 more | 2019-01-07 | 4.0 MEDIUM | 8.8 HIGH |
| For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account | |||||
| CVE-2018-1000811 | 1 Bludit | 1 Bludit | 2019-01-07 | 6.5 MEDIUM | 8.8 HIGH |
| bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code. | |||||
| CVE-2018-20188 | 1 Thedaylightstudio | 1 Fuel Cms | 2019-01-07 | 6.8 MEDIUM | 8.8 HIGH |
| FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account. | |||||
| CVE-2018-20156 | 1 Designmodo | 1 Wp Maintenance Mode | 2019-01-07 | 6.5 MEDIUM | 7.2 HIGH |
| The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network. | |||||
| CVE-2018-20329 | 1 Chamilo | 1 Chamilo Lms | 2019-01-07 | 5.5 MEDIUM | 8.1 HIGH |
| Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information. | |||||
| CVE-2018-20227 | 1 Eclipse | 1 Rdf4j | 2019-01-07 | 6.4 MEDIUM | 7.5 HIGH |
| RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive. | |||||
| CVE-2018-20159 | 1 I-doit | 1 I-doit | 2019-01-07 | 6.5 MEDIUM | 7.2 HIGH |
| i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin, and extracted to the main directory. In order for the ".zip" file to be accepted, it must also contain a package.json file. | |||||
| CVE-2018-20552 | 1 Appneta | 1 Tcpreplay | 2019-01-06 | 6.8 MEDIUM | 7.8 HIGH |
| Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c. | |||||
| CVE-2018-20553 | 1 Appneta | 1 Tcpreplay | 2019-01-06 | 6.8 MEDIUM | 7.8 HIGH |
| Tcpreplay before 4.3.1 has a heap-based buffer over-read in get_l2len in common/get.c. | |||||
| CVE-2018-20427 | 1 Libming | 1 Libming | 2019-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file, a different vulnerability than CVE-2018-9132. | |||||
| CVE-2018-20429 | 1 Libming | 1 Libming | 2019-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability than CVE-2018-7872 and CVE-2018-9165. | |||||
| CVE-2018-20426 | 1 Libming | 1 Libming | 2019-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| libming 0.4.8 has a NULL pointer dereference in the newVar3 function of the decompile.c file, a different vulnerability than CVE-2018-7866. | |||||
| CVE-2018-20425 | 1 Libming | 1 Libming | 2019-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| libming 0.4.8 has a NULL pointer dereference in the pushdup function of the decompile.c file. | |||||
| CVE-2018-20428 | 1 Libming | 1 Libming | 2019-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| libming 0.4.8 has a NULL pointer dereference in the strlenext function of the decompile.c file, a different vulnerability than CVE-2018-7874. | |||||
| CVE-2018-20598 | 1 Ucms Project | 1 Ucms | 2019-01-04 | 6.8 MEDIUM | 8.8 HIGH |
| UCMS 1.4.7 has ?do=user_addpost CSRF. | |||||
| CVE-2018-20599 | 1 Ucms Project | 1 Ucms | 2019-01-04 | 6.5 MEDIUM | 8.8 HIGH |
| UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action. | |||||
| CVE-2018-19666 | 3 Microsoft, Ossec, Wazuh | 3 Windows, Ossec, Wazuh | 2019-01-04 | 7.2 HIGH | 7.8 HIGH |
| The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server. | |||||
| CVE-2017-18354 | 1 Google | 1 Rendertron | 2019-01-04 | 5.0 MEDIUM | 7.5 HIGH |
| Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote attacker. | |||||
| CVE-2018-20094 | 1 Xuxueli | 1 Xxl-conf | 2019-01-04 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java. | |||||
| CVE-2018-20128 | 1 Usualtool | 1 Usualtoolcms | 2019-01-04 | 6.4 MEDIUM | 7.5 HIGH |
| An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pathname followed by a crafted substring. | |||||
| CVE-2016-2779 | 1 Kernel | 1 Util-linux | 2019-01-04 | 7.2 HIGH | 7.8 HIGH |
| runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. | |||||
| CVE-2018-16523 | 1 Amazon | 2 Amazon Web Services Freertos, Freertos | 2019-01-04 | 5.8 MEDIUM | 7.4 HIGH |
| Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component allow division by zero in prvCheckOptions. | |||||
| CVE-2018-16601 | 1 Amazon | 2 Amazon Web Services Freertos, Freertos | 2019-01-03 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. A crafted IP header triggers a full memory space copy in prvProcessIPPacket, leading to denial of service and possibly remote code execution. | |||||
| CVE-2018-20157 | 1 Openrefine | 1 Openrefine | 2019-01-03 | 5.0 MEDIUM | 7.5 HIGH |
| The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files. | |||||
| CVE-2018-19980 | 1 Anker | 2 Nebula Capsule Projector, Nebula Capsule Projector Firmware | 2019-01-03 | 7.8 HIGH | 7.5 HIGH |
| Anker Nebula Capsule Pro NBUI_M1_V2.1.9 devices allow attackers to cause a denial of service (reboot of the underlying Android 7.1.2 operating system) via a crafted application that sends data to WifiService. | |||||
| CVE-2018-20015 | 1 Yzmcms | 1 Yzmcms | 2019-01-03 | 6.8 MEDIUM | 8.8 HIGH |
| YzmCMS v5.2 has admin/role/add.html CSRF. | |||||
| CVE-2017-14888 | 1 Google | 1 Android | 2019-01-02 | 4.6 MEDIUM | 7.8 HIGH |
| In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Userspace can pass IEs to the host driver and if multiple append commands are received, then the integer variable that stores the length can overflow and the subsequent copy of the IE data may potentially lead to a heap buffer overflow. | |||||
| CVE-2018-9518 | 2 Canonical, Google | 2 Ubuntu Linux, Android | 2019-01-02 | 7.2 HIGH | 7.8 HIGH |
| In nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-73083945. | |||||
| CVE-2018-20061 | 1 Frappe | 1 Erpnext | 2019-01-02 | 5.0 MEDIUM | 7.5 HIGH |
| A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call. | |||||
| CVE-2018-0468 | 1 Cisco | 1 Energy Management Suite | 2019-01-02 | 4.6 MEDIUM | 7.8 HIGH |
| A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database. The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations. Users are required to manually change the password, as documented in the Workarounds section of this advisory. There are workarounds that address this vulnerability. | |||||
| CVE-2018-9559 | 1 Google | 1 Android | 2019-01-02 | 4.6 MEDIUM | 7.8 HIGH |
| In persist_set_key and other functions of cryptfs.cpp, there is a possible out-of-bounds write due to an uncaught error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112731440. | |||||
| CVE-2018-19560 | 1 Bagesoft | 1 Bagecms | 2018-12-31 | 9.3 HIGH | 8.8 HIGH |
| BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account. | |||||
| CVE-2018-18756 | 1 Kangujang | 1 Local Server | 2018-12-31 | 5.0 MEDIUM | 7.5 HIGH |
| Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008. | |||||
| CVE-2018-20064 | 1 Doorgets | 1 Doorgets | 2018-12-31 | 5.0 MEDIUM | 7.5 HIGH |
| doorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as demonstrated by a dg-user/?controller=theme&action=edit&name=doorgets&file=../../1.txt%00 URI with content in the theme_content_nofi parameter. | |||||