CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
6301 CVE-2018-21135 787 Overflow 2020-04-23 2020-05-01
6.5
None Remote Low ??? Partial Partial Partial
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6700 before 1.0.1.48, R7500 before 1.0.0.124, R7800 before 1.0.2.58, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WNDR3700v4 before 1.0.2.102, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.56, WNDR4500v3 before 1.0.0.56, and WNR2000v5-R2000 before 1.0.0.68.
6302 CVE-2018-21131 2020-04-23 2020-04-24
6.4
None Remote Low Not required None Partial Partial
Certain NETGEAR devices are affected by unauthenticated firmware downgrade. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
6303 CVE-2018-21120 352 CSRF 2020-04-22 2020-04-24
6.0
None Remote Medium ??? Partial Partial Partial
Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4, WNAP210v2 before 3.7.11.4, WNDAP350 before 3.7.11.4, WNDAP360 before 3.7.11.4, WNDAP660 before 3.7.11.4, WNDAP620 before 2.1.7, WND930 before 2.1.5, and WN604 before 3.3.10.
6304 CVE-2018-21102 352 CSRF 2020-04-23 2020-05-07
6.8
None Remote Medium Not required Partial Partial Partial
NETGEAR ReadyNAS devices before 6.9.3 are affected by CSRF.
6305 CVE-2018-21086 362 2020-04-08 2020-04-09
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered on Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software. There is a race condition with a resultant double free in vnswap_init_backing_storage. The Samsung ID is SVE-2017-11177 (February 2018).
6306 CVE-2018-21085 362 2020-04-08 2020-04-10
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered on Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software. There is a race condition with a resultant use-after-free in vnswap_deinit_backing_storage. The Samsung ID is SVE-2017-11176 (February 2018).
6307 CVE-2018-21084 362 2020-04-08 2020-04-10
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered on Samsung mobile devices with L(5.1), M(6.0), and N(7.x) software. There is a race condition with a resultant read-after-free issue in get_kek. The Samsung ID is SVE-2017-11174 (February 2018).
6308 CVE-2018-21081 732 2020-04-08 2020-04-10
6.4
None Remote Low Not required Partial Partial None
An issue was discovered on Samsung mobile devices with N(7.x) software. In Dual Messenger, the second app can use the runtime permissions of the first app without a user's consent. The Samsung ID is SVE-2017-11018 (March 2018).
6309 CVE-2018-21040 362 2020-04-08 2020-04-09
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 9810 chipsets) software. There is a race condition with a resultant use-after-free in the g2d driver. The Samsung ID is SVE-2018-12959 (December 2018).
6310 CVE-2018-21037 352 CSRF 2020-03-17 2020-03-20
6.8
None Remote Medium Not required Partial Partial Partial
Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.
6311 CVE-2018-21023 94 Exec Code 2019-10-08 2019-10-15
6.5
None Remote Low ??? Partial Partial Partial
getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.
6312 CVE-2018-21022 89 Sql 2019-10-08 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.
6313 CVE-2018-21021 89 Sql 2019-10-08 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.
6314 CVE-2018-21010 787 Overflow 2019-09-05 2021-01-28
6.8
None Remote Medium Not required Partial Partial Partial
OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
6315 CVE-2018-21009 190 Overflow 2019-09-05 2020-07-23
6.8
None Remote Medium Not required Partial Partial Partial
Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.
6316 CVE-2018-21006 352 CSRF 2019-08-27 2019-08-28
6.8
None Remote Medium Not required Partial Partial Partial
The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.
6317 CVE-2018-21002 352 CSRF 2019-08-27 2019-08-28
6.8
None Remote Medium Not required Partial Partial Partial
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
6318 CVE-2018-20990 59 2019-08-26 2019-08-28
6.4
None Remote Low Not required None Partial Partial
An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.
6319 CVE-2018-20981 20 2019-08-22 2019-08-26
6.4
None Remote Low Not required Partial Partial None
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
6320 CVE-2018-20974 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The js-jobs plugin before 1.0.7 for WordPress has CSRF.
6321 CVE-2018-20972 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.
6322 CVE-2018-20971 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
6323 CVE-2018-20968 352 CSRF 2019-08-14 2019-08-19
6.8
None Remote Medium Not required Partial Partial Partial
The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
6324 CVE-2018-20967 352 CSRF 2019-08-14 2019-08-19
6.8
None Remote Medium Not required Partial Partial Partial
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
6325 CVE-2018-20964 352 CSRF 2019-08-13 2019-08-15
6.8
None Remote Medium Not required Partial Partial Partial
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
6326 CVE-2018-20934 358 2019-08-01 2019-08-12
6.4
None Remote Low Not required None Partial Partial
cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).
6327 CVE-2018-20931 94 Exec Code 2019-08-01 2019-08-12
6.5
None Remote Low ??? Partial Partial Partial
cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).
6328 CVE-2018-20930 284 Bypass 2019-08-01 2019-08-12
6.4
None Remote Low Not required Partial Partial None
cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).
6329 CVE-2018-20912 20 Exec Code 2019-08-01 2019-08-02
6.5
None Remote Low ??? Partial Partial Partial
cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).
6330 CVE-2018-20911 79 Exec Code XSS 2019-08-01 2019-08-02
6.5
None Remote Low ??? Partial Partial Partial
cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359).
6331 CVE-2018-20895 20 2019-08-01 2019-08-07
6.5
None Remote Low ??? Partial Partial Partial
In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393).
6332 CVE-2018-20882 20 2019-08-01 2019-08-08
6.6
None Local Medium Not required Partial Complete Complete
cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447).
6333 CVE-2018-20879 20 Exec Code 2019-08-01 2019-08-01
6.5
None Remote Low ??? Partial Partial Partial
cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).
6334 CVE-2018-20871 732 2019-07-30 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permissions ("other" write access) occur in certain cases (GE-6890).
6335 CVE-2018-20864 20 2019-07-30 2019-07-31
6.4
None Remote Low Not required Partial Partial None
cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).
6336 CVE-2018-20851 2019-07-10 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
Helpy before 2.2.0 allows agents to edit admins.
6337 CVE-2018-20848 352 XSS CSRF 2019-06-30 2021-02-22
6.8
None Remote Medium Not required Partial Partial Partial
Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] parameter to the latter.
6338 CVE-2018-20847 190 Overflow 2019-06-26 2020-09-09
6.8
None Remote Medium Not required Partial Partial Partial
An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.
6339 CVE-2018-20835 20 2019-04-30 2019-05-03
6.4
None Remote Low Not required None Partial Partial
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
6340 CVE-2018-20834 59 2019-04-30 2019-09-04
6.4
None Remote Low Not required None Partial Partial
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
6341 CVE-2018-20819 787 DoS Overflow 2019-04-23 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
io/ZlibCompression.cc in the decompression component in Dropbox Lepton 1.2.1 allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact by crafting a jpg image file. The root cause is a missing check of header payloads that may be (incorrectly) larger than the maximum file size.
6342 CVE-2018-20790 22 Dir. Trav. Bypass 2019-02-25 2019-02-25
6.4
None Remote Low Not required None Partial Partial
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass through the delete_file action in execute.php.
6343 CVE-2018-20789 22 Dir. Trav. Bypass 2019-02-25 2019-02-25
6.4
None Remote Low Not required None Partial Partial
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass through the delete_folder action in execute.php.
6344 CVE-2018-20780 352 CSRF 2019-02-11 2019-02-11
6.8
None Remote Medium Not required Partial Partial Partial
Traq 3.7.1 allows admin/users/new CSRF to create an admin account (aka group_id=1).
6345 CVE-2018-20775 94 Exec Code 2019-02-11 2019-02-11
6.5
None Remote Low ??? Partial Partial Partial
admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI.
6346 CVE-2018-20773 94 Exec Code 2019-02-11 2019-02-11
6.5
None Remote Low ??? Partial Partial Partial
Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.
6347 CVE-2018-20772 94 Exec Code 2019-02-11 2019-02-11
6.5
None Remote Low ??? Partial Partial Partial
Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.
6348 CVE-2018-20767 20 Exec Code 2019-02-10 2019-02-13
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is authenticated remote command execution.
6349 CVE-2018-20763 787 2019-02-06 2019-04-15
6.8
None Remote Medium Not required Partial Partial Partial
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
6350 CVE-2018-20762 119 Overflow 2019-02-06 2019-04-15
6.8
None Remote Medium Not required Partial Partial Partial
GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.