CVEs published in May 2018
1,213 vulnerabilities, 158 critical, 7 exploited.
- moxa, moxa edr-810 firmware +1 moreAn exploitable Weak Cryptography for Passwords vulnerability exists in the web server...3.5 Low
- moxa, moxa edr-810 firmware +1 moreAn exploitable information disclosure vulnerability exists in the Server Agent functionality of...5.3 Medium
- moxa, moxa edr-810 firmware +1 moreA password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4...4.4 Medium
- moxa, moxa edr-810 firmware +1 moreAn exploitable cross-site request forgery vulnerability exists in the web server functionality of...8.8 High
- moxa, moxa edr-810 firmware +1 moreAn exploitable command injection vulnerability exists in the web server functionality of Moxa EDR...8.8 High
- moxa, moxa edr-810 firmware +1 moreAn exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR...7.5 High
- moxa, moxa edr-810 firmware +1 moreAn exploitable clear text transmission of password vulnerability exists in the web server and...5.7 Medium
- moxa, moxa edr-810 firmware +1 moreAn exploitable command injection vulnerability exists in the web server functionality of Moxa EDR...8.8 High
- moxa, moxa edr-810 firmware +1 moreAn exploitable command injection vulnerability exists in the web server functionality of Moxa EDR...8.8 High
- ics-cert rockwell automation arena, rockwellautomation arena +1 moreRockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability...5.5 Medium
- commscope arris tg1682g firmwareOn Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not...8.0 High
- commscope arris tg1682g firmwareArris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a...6.6 Medium
- actiontec wcb6200q firmwareAn issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session...8.1 High
- aveva clearscadaIn Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and...7.5 High
- atlassian jira, jira server +1 moreThe issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7...6.1 Medium
- t-joy kinepass, t-joy co.,ltd. kinepass app +1 moreThe KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not...5.9 Medium
- ultimate member member, ultimatemember user profile \& membership +1 moreUltimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers...4.3 Medium
- ultimate member member, ultimatemember user profile \& membership +1 moreUltimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers...4.3 Medium
- ultimate member member, ultimatemember user profile \& membership +1 moreDirectory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version...7.5 High
- ultimate member member, ultimatemember user profile \& membership +1 moreUnrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for...4.3 Medium
- ultimate member member, ultimatemember user profile \& membership +1 moreDirectory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to...4.3 Medium
- ultimate member member, ultimatemember ultimate member +1 moreCross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress...5.4 Medium
- asus rt-ac1200hp firmware, asus japan inc. rt-ac1200hp +1 moreCross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180...6.1 Medium
- asus rt-ac68u, rt-ac68u firmware +1 moreCross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031...6.1 Medium
- asus rt-ac87u firmware, asus japan inc. rt-ac87u +1 moreCross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383...6.1 Medium
- celsys clip studio action, clip studio modeler, clip studio paint +1 more +3 moreUntrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for...7.8 High
- webdados open graph for facebook, google+ and twitter card tags, open graph for facebook\, google\+ and twitter card tags +1 moreCross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags...6.1 Medium
- minimal work srl pixelyoursiteCross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress...5.4 Medium
- akbrohi wp google map plugin, flippercode wp google map +1 moreCross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress...5.4 Medium
- netweblogic events managerCross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress...5.4 Medium
- sitebridge joruri gwUnrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows...8.8 High
- atlassian application linksThe invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version...6.1 Medium
- exiv2In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote...6.5 Medium
- 2345.cc security guardIn 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users...7.8 High
- 2345.cc security guardIn 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users...7.8 High
- rasputinonline rasputin online coinThe request_dividend function of a smart contract implementation for ROC (aka Rasputin Online...5.9 Medium
- xpdfreader xpdfThe DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows...7.8 High
- gouguoyin phprapPHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php...9.8 Critical
- gouguoyin phprapapplication/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI,...9.8 Critical
- pbootcmsAn issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in...8.8 High
- libmingThe newVar_N function in decompile.c in libming through 0.4.8 mishandles cases where the header...8.8 High
- mybbMyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A...6.1 Medium
- d-link dir-816 a2 firmwareStack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN)...9.8 Critical
- adobe flash player, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreAdobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion...9.8 Critical
- haloruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login...6.1 Medium
- haloruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.6.1 Medium
- sdcmsAn issue was discovered in SDcms v1.5. Cross-site request forgery (CSRF) vulnerability in /WWW/...8.8 High
- yxcmsAn issue was discovered in YXcms 1.4.7. Cross-site request forgery (CSRF) vulnerability in...6.5 Medium
- d-link dir-629-b firmwareThe weblogin_log function in /htdocs/cgibin on D-Link DIR-629-B1 devices allows attackers to...9.8 Critical
- exiv2, canonical ubuntu linux, debian linux +2 moreAn issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has...6.5 Medium
- Show moreLoading…