2018

SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.

SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.

SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.

SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed acti

SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under

SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.

SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.

SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.

SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a l

SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.

SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.

SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or fi

SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.

SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter.

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.

SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.

Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers

An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize

An issue was discovered in vcSetXCutTextProc() in VNConsole.c in LinuxVNC and VNCommand from the LibVNC/vncterm distribu

A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attack

An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line Distance

A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 a

An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) c

A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform unauthorized

An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. An unprotected

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request en

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port v

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contain

The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://insta

Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.

Datto ALTO and SIRIS devices have a default VNC password.

Remote Disclosure of Information in Micro Focus Universal CMDB Foundation Software, version numbers 10.10, 10.11, 10.20,

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial

This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P

SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote at

A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller

A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Softw

SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.

SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize

In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user a

In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.

Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers

Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic C

eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sendin

SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.

SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabil

SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, cast