Filtered by vendor Subscriptions
Total 322276 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-18021 4 Canonical, Debian, Linux and 1 more 4 Ubuntu Linux, Debian Linux, Linux Kernel and 1 more 2024-11-21 N/A
arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes.
CVE-2018-18020 1 Qpdf Project 1 Qpdf 2024-11-21 N/A
In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attackers to cause a denial of service via a crafted PDF file.
CVE-2018-18019 1 Tribulant 1 Slideshow Gallery 2024-11-21 N/A
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
CVE-2018-18018 1 Tribulant 1 Slideshow Gallery 2024-11-21 N/A
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2018-18017 1 Tribulant 1 Slideshow Gallery 2024-11-21 N/A
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2018-18016 2 Imagemagick, Redhat 2 Imagemagick, Enterprise Linux 2024-11-21 N/A
ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.
CVE-2018-18014 1 Citrix 1 Xenmobile Server 2024-11-21 4.8 Medium
* Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.
CVE-2018-18013 1 Citrix 1 Xenmobile Server 2024-11-21 N/A
* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.
CVE-2018-18009 1 Dlink 4 Dir-140l, Dir-140l Firmware, Dir-640l and 1 more 2024-11-21 9.8 Critical
dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials.
CVE-2018-18008 1 Dlink 14 Dir-140l, Dir-140l Firmware, Dir-640l and 11 more 2024-11-21 N/A
spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials.
CVE-2018-18007 1 Dlink 2 Dsl-2770l, Dsl-2770l Firmware 2024-11-21 9.8 Critical
atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials.
CVE-2018-18006 1 Ricoh 1 Myprint 2024-11-21 N/A
Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files.
CVE-2018-18005 1 Vivotek 1 Camera 2024-11-21 N/A
Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter.
CVE-2018-18004 1 Vivotek 1 Camera 2024-11-21 N/A
Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter.
CVE-2018-17997 1 Layerbb 1 Layerbb 2024-11-21 N/A
LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).
CVE-2018-17996 1 Layerbb 1 Layerbb 2024-11-21 N/A
LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.
CVE-2018-17990 1 Dlink 2 Dsl-3782, Dsl-3782 Firmware 2024-11-21 N/A
An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter.
CVE-2018-17989 1 Dlink 2 Dsl-3782, Dsl-3782 Firmware 2024-11-21 N/A
A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/New_GUI/Acl.asp" is requested.
CVE-2018-17988 1 Layerbb 1 Layerbb 2024-11-21 9.8 Critical
LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.
CVE-2018-17987 1 Hashheroes 1 Hashheroes 2024-11-21 N/A
The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUM_TILES equals the number of people who purchased a tile, which allows an attacker to control the awarding of the prize by being the last person to purchase a tile.