2018

FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the

Ubilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclos

FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that

MegaMek version < v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosu

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can res

codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser th

MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files t

neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in

D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass paramete

Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm

An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firm

LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside stru

LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities

LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server c

LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code

An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the defaul

ymlref allows code injection.

An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could pote

A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execu

A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to adm

The yaml_parse.load method in Pylearn2 allows code injection.

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted meta

In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration pa

Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any exte

AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category_id and

add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POS

Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank passwo

A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication

A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK

A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK

A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly hand

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".N

The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote a

Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows re

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e.,

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-

Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE) vulnerability, allowing an att

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea

While generating trusted application id, An integer overflow can occur giving the trusted application an invalid identit

VeryNginx 0.3.3 allows remote attackers to bypass the Web Application Firewall feature because there is no error handler

In ixheaacd_adts_crc_start_reg of ixheaacd_adts_crc_check.c, there is a possible out of bounds write due to a missing bo

An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass On

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid

XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0