2018

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_rea

interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restr

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of ta

On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DC

Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attack

A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level pri

A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile

A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile

A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to

A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.

The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 lacks certain checks against width and height, which allo

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w

A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an una

An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'read' par

The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure

The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows doe

TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of

Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating syst

An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'get' para

An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as an 'unset' p

An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'show' par

An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'commit' p

An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'staticGet

WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length stack buffer where a value larger than th

WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the

WPLSoft in Delta Electronics versions 2.45.0 and prior writes data from a file outside the bounds of the intended buffer

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450,

Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized

A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI)

In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker on an adjacent network could perform command injection.

CSRF exists on D-Link DIR-868L devices, leading to (for example) a change to the Admin password. hedwig.cgi and pigwidge

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program sp

Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft spec

An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization b

Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act

Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote attackers to conduct cross-site request forgery (CSRF) attack

An issue was discovered in SDcms v1.5. Cross-site request forgery (CSRF) vulnerability in /WWW//app/admin/controller/adm

The newVar_N function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size gr

An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/sys

Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated us

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Mo

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 buil

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031