2018

LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.

TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by sk

HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter.

An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_d

e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter.

An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible

FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.

The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerabl

The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulner

The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated a

The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before

The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vuln

An issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the application without permission

Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HT

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (/include/logs) using predictab

An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect d

An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to auto

An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable

An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsal

An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=sig

The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is

An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_pr

VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via even

VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the

VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.

Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows

Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.

Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.

The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an

Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve a

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl

In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter cou

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checkin

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header pars

Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of retu

An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Applicat

A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limite

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.

A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be po

A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be po

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the

An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with ad

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to

An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an e

An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attacker