2018

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration v

Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.

There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.

In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.

ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that ha

A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to injec

In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=a

Bludit 2.3.4 allows XSS via a user name.

The libesedb_key_append_data function in libesedb_key.c in libesedb through 2018-04-01 allows remote attackers to cause

The libesedb_catalog_definition_read function in libesedb_catalog_definition.c in libesedb through 2018-04-01 allows rem

The libesedb_page_read_tags function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause

The libesedb_page_read_values function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to caus

The libfsclfs_block_read function in libfsclfs_block.c in libfsclfs before 2018-07-25 allows remote attackers to cause a

An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=

NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability during GameStream installation

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Tim

RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is

MorningStar WhatWeb 0.4.9 has XSS via JSON report files.

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.

A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, W

On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection

Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous us

Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and b

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing da

An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than s

PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f f

ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileControl

Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.

Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.

A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) pr

The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded

An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices, allowing att

The Alcatel A30 device with a build fingerprint of TCL/5046G/MICKEY6US:7.0/NRD90M/J63:user/release-keys contains a hidde

Technicolor (formerly RCA) TC8305C devices allow remote attackers to cause a denial of service (networking outage) via a

qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishand

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.

Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to a

When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. T

There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache

Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead t

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have an input validation bypass vulnerability. Successful

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Succe

dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial

An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a s