2018

System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands vi

System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands vi

System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via th

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via t

PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin use

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via t

Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1

CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter.

An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because

An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/

index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm

HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function us

HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function us

TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafted

Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $

HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the X-Forwarded-For HTTP header to the u

An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT

PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privile

An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device

In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon

Loadbalancer.org Enterprise VA MAX before 8.3.3 has XSS because Apache HTTP Server logs are displayed.

Buffer overflow in PCMan FTP Server 2.0.7 allows for remote code execution via the APPE command.

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x bef

DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traf

Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamera_preferences.xml in the QBee Cam application th

Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already crea

Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2

Arbitrary file upload in jQuery Upload File <= 4.0.2

In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then r

Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which

Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials

modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows

pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in proces

LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal.

School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb.

Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.

Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.

Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb

The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=[SQL] or index.php?q=single-item&id=

Library Management System 1.0 has SQL Injection via the "Search for Books" screen.

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.

SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.

SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.

K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/up

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x b

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may a

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by heap-based buffer overflow vulnerability, which