Export limit exceeded: 43034 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (43034 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-9151 | 1 Kingsoft | 1 Internet Security 9 Plus | 2024-11-21 | N/A |
| A NULL pointer dereference bug in the function ObReferenceObjectByHandle in the Kingsoft Internet Security 9+ kernel driver KWatch3.sys allows local non-privileged users to crash the system via IOCTL 0x80030030. | ||||
| CVE-2018-9149 | 1 Zyxel | 2 Ac3000, Ac3000 Firmware | 2024-11-21 | N/A |
| The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor. | ||||
| CVE-2018-9148 | 1 Westerndigital | 2 My Cloud, My Cloud Firmware | 2024-11-21 | N/A |
| Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a product that uses My Cloud. | ||||
| CVE-2018-9145 | 1 Exiv2 | 1 Exiv2 | 2024-11-21 | N/A |
| In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the 4-DataBuf-abort-1 PoC file. | ||||
| CVE-2018-9144 | 1 Exiv2 | 1 Exiv2 | 2024-11-21 | N/A |
| In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure. | ||||
| CVE-2018-9138 | 1 Gnu | 1 Binutils | 2024-11-21 | N/A |
| An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_nested_args, demangle_args, do_arg, and do_type. | ||||
| CVE-2018-9136 | 1 Jungo | 1 Windriver | 2024-11-21 | N/A |
| windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file, a different vulnerability than CVE-2018-8821. | ||||
| CVE-2018-9135 | 1 Imagemagick | 1 Imagemagick | 2024-11-21 | N/A |
| In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c. | ||||
| CVE-2018-9134 | 1 Dedecms | 1 Dedecms | 2024-11-21 | N/A |
| file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters. | ||||
| CVE-2018-9133 | 3 Canonical, Imagemagick, Redhat | 3 Ubuntu Linux, Imagemagick, Enterprise Linux | 2024-11-21 | N/A |
| ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file. | ||||
| CVE-2018-9130 | 1 Ibos | 1 Ibos | 2024-11-21 | N/A |
| IBOS 4.4.3 has XSS via a company full name. | ||||
| CVE-2018-9128 | 1 Dvd-x-player | 1 Dvd X Player | 2024-11-21 | N/A |
| DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068. | ||||
| CVE-2018-9127 | 1 Botan Project | 1 Botan | 2024-11-21 | N/A |
| Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character. | ||||
| CVE-2018-9123 | 1 Crea8social | 1 Crea8social | 2024-11-21 | N/A |
| In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile. | ||||
| CVE-2018-9122 | 1 Crea8social | 1 Crea8social | 2024-11-21 | N/A |
| In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI. | ||||
| CVE-2018-9121 | 1 Crea8social | 1 Crea8social | 2024-11-21 | N/A |
| In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment. | ||||
| CVE-2018-9120 | 1 Crea8social | 1 Crea8social | 2024-11-21 | N/A |
| In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post. | ||||
| CVE-2018-9108 | 1 Quickappscms | 1 Quickapps Cms | 2024-11-21 | N/A |
| CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges. | ||||
| CVE-2018-9107 | 1 Acyba | 1 Acymailing | 2024-11-21 | N/A |
| CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export. | ||||
| CVE-2018-9106 | 1 Acyba | 1 Acysms | 2024-11-21 | N/A |
| CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export. | ||||