2018

Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for

The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in

An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the fun

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir par

OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be e

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particul

Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegi

A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management S

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API r

upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.

In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML Extern

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware versi

An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP s

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implem

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implem

PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or po

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or pot

An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticate

A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attack

Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracke

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any

Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior do not perform authentication of

Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and pri

Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.

In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag c

Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary comman

An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A use-after-free can occur in _pbcM_sp_query in m

The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitr

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-mi

All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the

ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution.

AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthentic

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.

Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection

Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web i

Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly san

A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700