2018

A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attac

A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attac

Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before

Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before

Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allow

IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dang

IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficien

Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenti

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote auth

A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disa

A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to

tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h.

Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE

Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.ph

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absol

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.p

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes

Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.

Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.

A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.c

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi

xfind/search in Ximdex 4.0 has XSS via the filter[n][value] parameters for non-negative values of n, as demonstrated by

DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmd

An issue was discovered on the MediaTek AWUS036NH wireless USB adapter through 5.1.25.0. Attackers can remotely deny ser

Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthe

Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthe

Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hostin

A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-s

A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-s

A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remot

A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduc

A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could al

A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an au

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthentic

A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allo

A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated

A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauth

A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConne

A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, r

A vulnerability in the Session Initiation Protocol (SIP) ingress packet processing of Cisco Unified IP Phone software co

A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area

A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and

A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows auth

content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.

An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.