2018

Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileg

A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.

A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserial

A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in

The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability

ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applicat

A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side r

A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could al

Citrix XenServer 7.1 and newer allows Directory Traversal.

The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote a

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o

A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote

A Cross-site scripting (XSS) vulnerability was discovered on Intelbras Win 240 V1.1.0 devices. An attacker can change th

An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPEL

An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series

AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnera

A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability

A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability

Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthentic

Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows rem

Multiple SQL injection vulnerabilities in portal/add_edit_event_user.php in versions of OpenEMR before 5.0.1.4 allow a r

Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a

In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External E

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External En

A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially cr

A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an affe

Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 buil

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open

A vulnerability was discovered in the Java VM component of Oracle Database Server. Supported versions that are affected

active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containin

For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped wi

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unaut

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids

CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml)

A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07. The v

A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.2

Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacke

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6

HPE has identified a remote privilege escalation vulnerability in HPE CentralView Fraud Risk Management earlier than ver

A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Service Manager

A security vulnerability in HPE IceWall SSO Dfw 10.0 and 11.0 on RHEL, HP-UX, and Windows could be exploited remotely to

A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software E

A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability

A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability

A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability

A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector pri

An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.address.php has SQL Injection via the numPerPage para

dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not ha