CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
401 CVE-2018-19791 2018-12-03 2018-12-03
0.0
None ??? ??? ??? ??? ??? ???
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.
402 CVE-2018-19788 Exec Code 2018-12-03 2019-01-17
0.0
None ??? ??? ??? ??? ??? ???
A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.
403 CVE-2018-19720 Exec Code 2019-01-18 2019-01-19
0.0
None ??? ??? ??? ??? ??? ???
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution.
404 CVE-2018-19660 2018-12-06 2018-12-06
0.0
None ??? ??? ??? ??? ??? ???
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user.
405 CVE-2018-19659 2018-12-06 2018-12-06
0.0
None ??? ??? ??? ??? ??? ???
An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build_18082311. A specially crafted HTTP POST request to /goform/net_WebPingGetValue can result in running OS commands as the root user. This is similar to CVE-2017-12120.
406 CVE-2018-19655 Overflow 2018-11-29 2018-11-29
0.0
None ??? ??? ??? ??? ??? ???
A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file.
407 CVE-2018-19654 2018-11-29 2018-11-29
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a duplicate username, as demonstrated by use of the test%c2 string when a test account already exists.
408 CVE-2018-19653 2018-12-09 2018-12-09
0.0
None ??? ??? ??? ??? ??? ???
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.
409 CVE-2018-19646 Exec Code 2018-11-28 2018-11-28
0.0
None ??? ??? ??? ??? ??? ???
The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled.
410 CVE-2018-19635 2019-01-22 2019-01-24
0.0
None ??? ??? ??? ??? ??? ???
CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.
411 CVE-2018-19634 2019-01-22 2019-01-24
0.0
None ??? ??? ??? ??? ??? ???
CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.
412 CVE-2018-19629 DoS 2019-07-16 2019-07-16
0.0
None ??? ??? ??? ??? ??? ???
A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to crash the service via a TCP connection.
413 CVE-2018-19608 2018-12-05 2018-12-05
0.0
None ??? ??? ??? ??? ??? ???
Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.
414 CVE-2018-19588 2019-07-11 2019-07-11
0.0
None ??? ??? ??? ??? ??? ???
Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control.
415 CVE-2018-19587 2018-11-27 2018-11-27
0.0
None ??? ??? ??? ??? ??? ???
In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.
416 CVE-2018-19548 2018-11-26 2018-11-26
0.0
None ??? ??? ??? ??? ??? ???
index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make it easier for remote attackers to obtain access via a brute-force approach.
417 CVE-2018-19523 2019-01-03 2019-01-03
0.0
None ??? ??? ??? ??? ??? ???
DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL (0x80002068) with a user defined buffer size. If the size of the buffer is less than 512 bytes, then the driver will overwrite the next pool header if there is one next to the user buffer's pool.
418 CVE-2018-19522 2018-12-18 2018-12-18
0.0
None ??? ??? ??? ??? ??? ???
DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL (0x800020F4) with a buffer containing user defined content. The driver's subroutine will execute a wrmsr instruction with the user's buffer for partial input.
419 CVE-2018-19520 Exec Code 2018-11-25 2018-11-25
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad function in an attempt to block certain PHP functions such as eval, but does not prevent use of preg_replace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.
420 CVE-2018-19518 Exec Code 2018-11-25 2018-12-22
0.0
None ??? ??? ??? ??? ??? ???
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
421 CVE-2018-19505 2019-01-03 2019-01-03
0.0
None ??? ??? ??? ??? ??? ???
Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user, because userdata.js in the WOI:WorkOrderConsole component allows a username substitution involving a UserData_Init call.
422 CVE-2018-19417 Exec Code 2018-11-21 2018-11-21
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages with a variable length header uses memcpy to input data into a fixed size buffer. The allocated buffer can fit only MQTT_MAX_TOPIC_LENGTH (default 64) bytes, and a length check is missing. This could lead to Remote Code Execution via a stack-smashing attack (overwriting the function return address). Contiki-NG does not separate the MQTT server from other servers and the OS modules, so access to all memory regions is possible.
423 CVE-2018-19411 2018-11-21 2018-11-21
0.0
None ??? ??? ??? ??? ??? ???
PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account (including administrator) via an HTTP request because /api/addusers doesn't check, or doesn't properly check, user rights.
424 CVE-2018-19410 File Inclusion 2018-11-21 2018-11-21
0.0
None ??? ??? ??? ??? ??? ???
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
425 CVE-2018-19387 DoS 2018-11-20 2018-11-20
0.0
None ??? ??? ??? ??? ??? ???
format_cb_pane_tabs in format.c in tmux 2.7 through 2.8 might allow attackers to cause a denial of service (NULL Pointer Dereference and application crash) by arranging for a malloc failure.
426 CVE-2018-19370 Exec Code 2018-11-28 2018-11-28
0.0
None ??? ??? ??? ??? ??? ???
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
427 CVE-2018-19358 2018-11-18 2018-11-18
0.0
None ??? ??? ??? ??? ??? ???
GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used.
428 CVE-2018-19335 +Info CSRF 2018-11-20 2018-11-20
0.0
None ??? ??? ??? ??? ??? ???
Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.
429 CVE-2018-19323 2018-12-21 2018-12-21
0.0
None ??? ??? ??? ??? ??? ???
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE v1.33 and earlier, XTREME GAMING ENGINE v1.25 and earlier, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
430 CVE-2018-19249 Bypass 2019-01-03 2019-01-03
0.0
None ??? ??? ??? ??? ??? ???
The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the response under the object card{}, and reading the cvc_check information if the creation is successful without charging the actual card used in the transaction.
431 CVE-2018-19244 +Info 2018-11-13 2018-11-13
0.0
None ??? ??? ??? ??? ??? ???
An XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked.
432 CVE-2018-19234 Exec Code 2018-12-20 2018-12-20
0.0
None ??? ??? ??? ??? ??? ???
The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related to missing update validation.
433 CVE-2018-19207 Exec Code 2018-11-12 2018-11-15
0.0
None ??? ??? ??? ??? ??? ???
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.
434 CVE-2018-19204 Exec Code 2018-11-12 2018-11-12
0.0
None ??? ??? ??? ??? ??? ???
PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport_' is mishandled. The attacker can craft an HTTP request and override the 'writeresult' command-line parameter for HttpAdvancedSensor.exe to store arbitrary data in an arbitrary place on the file system. For example, the attacker can create an executable file in the \Custom Sensors\EXE directory and execute it by creating EXE/Script Sensor.
435 CVE-2018-19203 2018-11-12 2018-11-12
0.0
None ??? ??? ??? ??? ??? ???
PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request.
436 CVE-2018-19148 2018-11-10 2018-11-10
0.0
None ??? ??? ??? ??? ??? ???
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Host header) permit full enumeration of all certificates on the server. This generally permits an attacker to easily and accurately discover the existence of and relationships among hostnames that weren't meant to be public, though this information could likely have been discovered via other methods with additional effort.
437 CVE-2018-19135 CSRF 2018-11-10 2018-11-15
0.0
None ??? ??? ??? ??? ??? ???
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the "/assets/files" directory.
438 CVE-2018-19127 Exec Code 2018-11-09 2018-11-09
0.0
None ??? ??? ??? ??? ??? ???
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring.
439 CVE-2018-19120 2018-11-29 2018-11-29
0.0
None ??? ??? ??? ??? ??? ???
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.
440 CVE-2018-19114 +Priv 2018-11-08 2018-11-08
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindoc_id value containing the relative pathname of this uploaded file. For example, the mindoc_id (aka session ID) could be of the form aa/../../uploads/blog/201811/attach_#.jpg where '#' is a hex value displayed in the upload field of a manage/blogs/edit/ screen.
441 CVE-2018-19111 2018-11-08 2018-11-08
0.0
None ??? ??? ??? ??? ??? ???
The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the Unity 3D Stats web site, as demonstrated by device make, model, and OS.
442 CVE-2018-19110 Bypass 2018-11-08 2018-11-08
0.0
None ??? ??? ??? ??? ??? ???
The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization check.
443 CVE-2018-19052 Dir. Trav. 2018-11-07 2018-11-07
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
444 CVE-2018-19047 2018-11-07 2018-11-07
0.0
None ??? ??? ??? ??? ??? ???
** DISPUTED ** mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HTML without sanitising it, you're asking for trouble."
445 CVE-2018-19036 Exec Code 2018-12-17 2018-12-17
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface.
446 CVE-2018-19019 Exec Code 2019-01-22 2019-01-23
0.0
None ??? ??? ??? ??? ??? ???
A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
447 CVE-2018-19017 Exec Code 2019-01-22 2019-01-23
0.0
None ??? ??? ??? ??? ??? ???
Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). When processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
448 CVE-2018-19013 2019-01-22 2019-01-23
0.0
None ??? ??? ??? ??? ??? ???
An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file.
449 CVE-2018-19011 Exec Code 2019-01-22 2019-01-23
0.0
None ??? ??? ??? ??? ??? ???
CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application.
450 CVE-2018-19007 2018-12-14 2018-12-15
0.0
None ??? ??? ??? ??? ??? ???
In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable to an OS system command injection as root.
Total number of vulnerabilities : 1065   Page : 1 2 3 4 5 6 7 8 9 (This Page)10 11 12 13 14 15 16 17 18 19 20 21 22
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.