2018

An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scrip

An issue was discovered in Reprise License Manager (RLM) through 12.2BL2. Attackers can use the web interface to read an

The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not alway

In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.

my little forum 2.4.12 allows CSRF for deletion of users.

tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html.

CMSUno before 1.5.3 has XSS via the title field.

tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter.

An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication

An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any

PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and

The editor in Xiuno BBS 4.0.4 allows stored XSS.

fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters i

An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially

An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP reque

The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker

In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a craf

/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url para

In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.

A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes U

A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9.

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati

An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an ob

An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1,

An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of eval

An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor o

An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtu

Pimcore before 5.3.0 allows SQL Injection via the REST web service API.

Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validati

IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization token

An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware ver

An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-

An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in E

An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firmw

An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0.

Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118.

A Buffer Overflow exploited through web interface by remote attacker can cause denial of service in Kraftway 24F2XG Rout

A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG

An attacker with low privileges can cause denial of service in Kraftway 24F2XG Router firmware version 3.5.30.1118.

Denial of service via crafting malicious link and sending it to a privileged user can cause Denial of Service in Kraftwa

Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileg

A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.

A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserial

A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in

Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy lo

The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages l