CVEs published in September 2018
1,223 vulnerabilities, 177 critical, 3 exploited.
- redhat cloudforms, red hat cfme, redhat cloudforms management engine +2 moreIt was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions...8.8 High
- ibm openpages grc platformIBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive...6.2 Medium
- kubernetes, red hat openshift +1 moreIt was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509...7.5 High
- monstraIn Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the...8.8 High
- monstraMonstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the...7.2 High
- kakaocorp potplayerA heap-based buffer overflow in PotPlayerMini.exe in PotPlayer 1.7.8556 allows remote attackers...7.8 High
- mongodb libbson_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and...8.1 High
- entropymine imageworsenerlibimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmpr_read_rle_internal...8.8 High
- rockcarry ffjpegffjpeg.dll in ffjpeg before 2018-08-22 allows remote attackers to cause a denial of service (FPE...6.5 Medium
- complete responsive cms blog project responsive cms blogComplete Responsive CMS Blog through 2018-05-20 has XSS via a comment.5.4 Medium
- blogcms project blogcmsBlogCMS through 2016-10-25 has XSS via a comment.6.1 Medium
- creatiwity witycmswityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page.4.8 Medium
- victor cms project cmsAn issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the ...4.8 Medium
- hongcms project hongcmsHongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php...7.5 High
- easycmsEasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType...4.8 Medium
- hooskHoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.4.8 Medium
- hooskHoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and...9.8 Critical
- webassembly virtual machine project virtual machineIn WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a...8.8 High
- webassembly virtual machine project virtual machineIn WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a...8.8 High
- webassembly virtual machine project virtual machineIn WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a...8.8 High
- webassembly virtual machine project virtual machineIn WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a...8.8 High
- webassembly virtual machine project virtual machineIn WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a...8.8 High
- webassembly virtual machine project virtual machineIn WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a...8.8 High
- webassembly virtual machine project virtual machineIn WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a...8.8 High
- google android, canonical ubuntu linux +1 moreIn nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a...7.8 High
- artifex ghostscript, canonical ubuntu linux, debian linux +6 more +8 moreAn issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege"...7.8 High
- [unknown] kernel, debian linux, canonical ubuntu linux +2 moreA flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read...5.3 Medium
- thedaylightstudio fuel cmsFUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/...9.8 Critical
- thedaylightstudio fuel cmsFUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages...9.8 Critical
- eventum project eventumEventum before 3.4.0 has an open redirect vulnerability.6.1 Medium
- easycmsThe removeXSS function in App/Common/common.php (called from App/Modules/Index/Action...6.1 Medium
- rcfilters project rcfiltersIn the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages...5.4 Medium
- imagemagick, canonical ubuntu linux +1 moreIn ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders...6.5 Medium
- imagemagick, canonical ubuntu linux, debian linux +2 moreIn ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c...6.5 Medium
- ethereum go ethereumGo Ethereum Improper Input Validation7.5 High
- chshcms cscms\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.8.8 High
- chshcms cscmsCScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default...9.8 Critical
- chshcms cscms\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.6.1 Medium
- baijiacms project baijiacmsAn issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip...6.1 Medium
- baijiacms project baijiacmsAn issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an...9.8 Critical
- absolute ctes windows agentAn issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security...8.8 High
- cremecrmAn XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting ...5.4 Medium
- currency converter script project converter scriptPHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of...7.5 High
- filemanagerpro file managerThe mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp...5.4 Medium
- endress wirelesshart fieldgate swg70 firmwareEndress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi...5.3 Medium
- theethereumlottery the ethereum lotteryThe "PayWinner" function of a simplelottery smart contract implementation for The Ethereum...7.5 High
- kone group controller firmwareAn issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated...9.1 Critical
- kone group controller firmwareAn issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require...9.1 Critical
- kone group controller firmwareAn issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated...9.8 Critical
- kone group controller firmwareAn issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Denial of Service...7.5 High
- Show moreLoading…