CVEs published in September 2018
1,223 vulnerabilities, 177 critical, 3 exploited.
- opsviewThe test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4...9.8 Critical
- jorani project joraniAn issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the...5.4 Medium
- jorani project joraniPersistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject...5.4 Medium
- btiteam xbtitAn issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (...5.3 Medium
- btiteam xbtitAn issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is...6.1 Medium
- btiteam xbtitAn issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection,...8.8 High
- btiteam xbtitAn issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is...9.8 Critical
- btiteam xbtitAn issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users...9.8 Critical
- btiteam xbtitAn issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function...6.1 Medium
- btiteam xbtitAn issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available...6.1 Medium
- btiteam xbtitThe newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title...6.1 Medium
- btiteam xbtitAn issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to...5.3 Medium
- vivotek cameraVIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code ...8.8 High
- vivotek cameraVIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code ...8.8 High
- vivotek cameraVIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.8.8 High
- ubnt airos 4 xs2, airos 4 xs5, edgeswitch xp firmware +9 more +11 moreUbiquiti airOS HTTP(S) unauthenticated arbitrary file upload9.8 Critical
- amcrest ipc-hx1x3x-lexus eng n amcrestAmcrest networked devices use the same hardcoded SSL private key across different customers'...5.9 Medium
- gxlcmsGxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.4.9 Medium
- gxlcmsGxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.7.2 High
- kzsoftware asset manager, training manager +1 moreKaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a...7.8 High
drupal/fractionPackagistThis module enables you to create fields for storing decimal values as two integers (numerator and denominator) for maximum precision. The module doesn't sufficiently filter XSS strings out of field l…No score- salesforce tough-cookie, ibm api connect, redhat openshift container platform +2 moreReDoS via long string of semicolons in tough-cookie5.3 Medium
- pidgin, suse linux enterprise server +1 morePidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to...9.8 Critical
- openmrs html form entry, reference application +1 moreAn XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in...9.8 Critical
- primx zed\!, zed\! free +1 moreA directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0...9.8 Critical
- flask-admin project flask-adminFlask-Admin Cross-site Scripting vulnerability6.1 Medium
- fortinet fortiosA plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1...5.9 Medium
- fortinet fortiosA plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1...5.9 Medium
- fortinet fortimanagerAn information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows...4.3 Medium
- artifex ghostscript, canonical ubuntu linux, debian linux +2 moreIn Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have...7.8 High
- artifex ghostscript, canonical ubuntu linux, debian linux +5 more +7 moreIn Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use...5.5 Medium
- artifex ghostscript, canonical ubuntu linux, debian linux +6 more +8 moreIn Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use...5.5 Medium
- artifex ghostscript, canonical ubuntu linux, debian linux +8 more +10 moreIn Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the...7.8 High
- artifex ghostscript, canonical ubuntu linux, debian linux +6 more +8 moreIn Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use...5.5 Medium
- artifex ghostscript, gpl ghostscript, canonical ubuntu linux +2 more +4 moreIn Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a...7.8 High
- artifex ghostscript, canonical ubuntu linux, debian linux +6 more +8 moreAn issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be...7.8 High
- artifex ghostscript, gpl ghostscript, canonical ubuntu linux +2 moreAn issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the ...7.8 High
- artifex ghostscript, gpl ghostscript, canonical ubuntu linux +5 more +7 moreAn issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege"...7.8 High
- [unknown] curl, canonical ubuntu linux, debian linux +2 more +4 morecurl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The...7.5 High
- zsh, canonical ubuntu linux +1 moreAn issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated,...9.8 Critical
- zsh, canonical ubuntu linux +1 moreAn issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled,...9.8 Critical
- freebsdIn FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is...7.5 High
- huawei technologies co., ltd. mate10 pro, huawei mate 10 pro firmware +1 moreMate10 Pro Huawei smart phones with the versions before 8.1.0.326(C00) have a FRP bypass...4.6 Medium
- huawei technologies co., ltd. p10, huawei p10 firmware +1 moreP10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak...3.3 Low
- huawei hirouter-cd20 firmware, ws5200-10 firmware, huawei technologies co., ltd. hirouter-cd20, ws5200-10 +2 moreIn Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before...7.8 High
- huawei technologies co., ltd. mate 10 pro, huawei mate 10 pro firmware +1 moreMate 10 Pro Huawei smart phones with the versions before BLA-L29 8.0.0.148(C432) have a Factory...4.6 Medium
- google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 moreIn Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using...7.8 High
- gluster glusterfs, debian linux, opensuse leap +4 more +6 moreA flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated...6.5 Medium
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreA flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated...8.8 High
- debian linux, linux kernel, canonical ubuntu linux +2 moreThe irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda...7.8 High
- Show moreLoading…