CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1501 CVE-2018-6960 287 Bypass 2018-04-20 2018-05-22
6.5
None Remote Low Single system Partial Partial Partial
VMware Horizon DaaS (7.x before 8.0.0) contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS.
1502 CVE-2018-6941 352 Exec Code XSS CSRF 2018-02-20 2018-03-13
6.8
None Remote Medium Not required Partial Partial Partial
A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS.
1503 CVE-2018-6934 352 CSRF 2018-04-12 2018-05-11
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.
1504 CVE-2018-6889 94 2018-02-11 2018-03-06
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache or perform advanced password reset attacks or even trigger arbitrary user re-direction.
1505 CVE-2018-6888 352 CSRF 2018-02-11 2018-03-06
6.0
None Remote Medium Single system Partial Partial Partial
An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged HTTP request, a malicious user can lead a user to unknowingly create / delete or modify a user account due to the lack of an anti-CSRF token.
1506 CVE-2018-6874 352 CSRF 2018-04-04 2018-05-15
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
1507 CVE-2018-6860 434 Exec Code 2018-02-11 2018-02-26
6.5
None Remote Low Single system Partial Partial Partial
Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture.
1508 CVE-2018-6843 89 Sql 2018-03-19 2018-04-12
6.5
None Remote Low Single system Partial Partial Partial
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.
1509 CVE-2018-6830 22 Dir. Trav. 2018-07-09 2018-09-10
6.4
None Remote Low Not required None Partial Partial
Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and C1 Lite V2 2.52.2.47 and earlier, FI9800P, FI9800P V2, FI9803P V2, FI9803P V3, and FI9851P V2 2.54.2.47 and earlier, FI9815P, FI9815P V2, FI9816P, and FI9816P V2, 2.51.2.47 and earlier, R2 and R4 2.71.1.59 and earlier, C2 and FI9961EP 2.72.1.59 and earlier, FI9900EP, FI9900P, and FI9901EP 2.74.1.59 and earlier, FI9928P 2.74.1.58 and earlier, FI9803EP and FI9853EP 2.22.2.31 and earlier, FI9803P and FI9851P 2.24.2.31 and earlier, FI9821P V2, FI9826P V2, FI9831P V2, and FI9821EP 2.21.2.31 and earlier, FI9821W V2, FI9831W, FI9826W, FI9821P, FI9831P, and FI9826P 2.11.1.120 and earlier, FI9818W V2 2.13.2.120 and earlier, FI9805W, FI9804W, FI9804P, FI9805E, and FI9805P 2.14.1.120 and earlier, FI9828P, and FI9828W 2.13.1.120 and earlier, and FI9828P V2 2.11.1.133 and earlier allows remote attackers to delete arbitrary files via a .. (dot dot) in the URI path component.
1510 CVE-2018-6827 295 Exec Code +Info 2018-02-09 2018-03-08
6.8
None Remote Medium Not required Partial Partial Partial
VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information, and consequently execute arbitrary code, via a crafted certificate, as demonstrated by leveraging a hardcoded --no-check-certificate Wget option.
1511 CVE-2018-6799 119 DoS Overflow 2018-02-07 2018-10-18
6.8
None Remote Medium Not required Partial Partial Partial
The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used.
1512 CVE-2018-6792 89 Exec Code Sql 2018-02-06 2018-03-01
6.5
None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.3.1 allow an authenticated user to execute arbitrary SQL commands via multiple parameters to the /cvms-hub/privado/seccionesmib/secciones.xhtml resource. The POST parameters are j_idt118, j_idt120, j_idt122, j_idt124, j_idt126, j_idt128, and j_idt130 under formularioGestionarSecciones:tablaSeccionesMib:*:filter. The GET parameter is nombreAgente.
1513 CVE-2018-6788 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x2208C0.
1514 CVE-2018-6787 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x221808.
1515 CVE-2018-6786 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220840.
1516 CVE-2018-6785 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008254.
1517 CVE-2018-6784 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A00824C.
1518 CVE-2018-6783 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A00825C.
1519 CVE-2018-6782 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A0081DC.
1520 CVE-2018-6781 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008264.
1521 CVE-2018-6780 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A0081E4.
1522 CVE-2018-6779 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008240.
1523 CVE-2018-6778 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008268.
1524 CVE-2018-6777 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220400.
1525 CVE-2018-6776 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A00813C.
1526 CVE-2018-6775 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x990081C8.
1527 CVE-2018-6774 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008088.
1528 CVE-2018-6773 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008084.
1529 CVE-2018-6772 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x99008208.
1530 CVE-2018-6771 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x99008224.
1531 CVE-2018-6770 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x99008210.
1532 CVE-2018-6769 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x99008020.
1533 CVE-2018-6768 20 DoS 2018-02-06 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008090.
1534 CVE-2018-6767 119 Overflow 2018-02-06 2018-03-15
6.8
None Remote Medium Not required Partial Partial Partial
A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
1535 CVE-2018-6700 426 Exec Code 2018-09-24 2018-11-20
6.8
None Remote Medium Not required Partial Partial Partial
DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via specially crafted malware.
1536 CVE-2018-6678 77 Exec Code 2018-07-23 2018-09-19
6.5
None Remote Low Single system Partial Partial Partial
Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors.
1537 CVE-2018-6664 284 Bypass 2018-05-25 2018-06-27
6.5
None Remote Low Single system Partial Partial Partial
Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility.
1538 CVE-2018-6661 426 +Priv 2018-04-02 2018-05-15
6.8
None Remote Medium Not required Partial Partial Partial
DLL Side-Loading vulnerability in Microsoft Windows Client in McAfee True Key before 4.20.110 allows local users to gain privilege elevation via not verifying a particular DLL file signature.
1539 CVE-2018-6654 284 2018-02-05 2018-03-13
6.8
None Remote Medium Not required Partial Partial Partial
The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr_-ifr, because the exposure of these tokens is not restricted to any specific web site.
1540 CVE-2018-6635 310 Bypass 2018-02-05 2018-03-13
6.0
None Remote Medium Single system Partial Partial Partial
System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.
1541 CVE-2018-6633 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000038.
1542 CVE-2018-6632 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000110.
1543 CVE-2018-6631 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110009.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000170.
1544 CVE-2018-6630 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8000014c.
1545 CVE-2018-6629 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000118.
1546 CVE-2018-6628 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8000010c.
1547 CVE-2018-6627 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054.
1548 CVE-2018-6626 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000035.
1549 CVE-2018-6625 20 DoS 2018-02-05 2018-02-22
6.1
None Local Low Not required Partial Partial Complete
In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002010.
1550 CVE-2018-6623 264 Exec Code 2018-03-12 2018-04-11
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in Hola 1.79.859. An unprivileged user could modify or overwrite the executable with arbitrary code, which would be executed the next time the service is started. Depending on the user that the service runs as, this could result in privilege escalation. The issue exists because of the SERVICE_ALL_ACCESS access right for the hola_svc and hola_updater services.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.