2018

An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users w

SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which coul

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote att

In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device

In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.c, there is a possible out of bounds read due to a missing bounds check. Th

In avrc_pars_vendor_rsp of avcr_pars_ct.cc, there is a possible out-of-bounds read due to a missing bounds check. This c

In avrc_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This c

Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote

An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-

Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in the

YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting w

Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which ma

Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008.

Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow.

RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series)

Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd.

An issue was discovered in S-CMS v1.5. There is a SQL injection vulnerability in search.php via the keyword parameter.

IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not

ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dere

ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application cra

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI UR

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh c

Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensi

A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE L

In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insuffi

In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable t

An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under we

The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operat

Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to ar

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session token

There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection f

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is buil

NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829,

Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QT

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use uns

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By