2018

CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter.

CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter.

A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with network access to the TeleContr

The WStr::_alloc_iostr_data() function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 allows remote attac

Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page.

vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.

w3m through 0.5.3 does not properly handle temporary files when the ~/.w3m directory is unwritable, which allows a local

A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. An attacker has read

A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. WebAccess/SCADA does

The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulne

A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.Se

A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=graph

In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c allows remote attackers to cause a denial of s

The js_strtod function in jsdtoa.c in Artifex MuJS through 1.0.2 has an integer overflow because of incorrect exponent v

Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows re

Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to t

In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the

The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds re

The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause

Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitr

Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnerab

Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnerab

The vulnerability allows attacker to extract binaries into protected file system locations in HP Support Assistant befor

HP has identified a potential security vulnerability with HP Enterprise LaserJet Printers and MFPs, HP OfficeJet Enterpr

A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wi

An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up t

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6

On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Bui

Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authen

In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems E

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems E

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems E

This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Ente

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Syst

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Syst

This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Ente

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Ente

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Syst

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Syst

Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrie

Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the dire

MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in Ex

axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted

The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\temp

The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\template