Filtered by vendor Subscriptions
Total 322227 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-15542 1 Telegram 1 Telegram 2024-11-21 N/A
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
CVE-2018-15540 1 Agentejo 1 Cockpit 2024-11-21 N/A
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal.
CVE-2018-15539 1 Agentejo 1 Cockpit 2024-11-21 N/A
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.
CVE-2018-15538 1 Agentejo 1 Cockpit 2024-11-21 N/A
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.
CVE-2018-15537 1 Ocsinventory-ng 1 Ocsinventory Ng 2024-11-21 N/A
Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests.
CVE-2018-15536 1 Tecrail 1 Responsive Filemanager 2024-11-21 N/A
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal.
CVE-2018-15535 1 Tecrail 1 Responsive Filemanager 2024-11-21 N/A
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.
CVE-2018-15534 1 Geutebrueck 2 Re Porter 16, Re Porter 16 Firmware 2024-11-21 N/A
Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct request for /statistics/gscsetup.xml on TCP port 12003.
CVE-2018-15533 1 Geutebrueck 2 Re Porter 16, Re Porter 16 Firmware 2024-11-21 N/A
A reflected cross-site scripting vulnerability exists in Geutebrueck re_porter 16 before 7.8.974.20 by appending a query string to /modifychannel/exec or /images/*.png on TCP port 12005.
CVE-2018-15532 1 Hp 1 Synaptics Touchpad Driver 2024-11-21 N/A
SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses.
CVE-2018-15531 1 Javamelody Project 1 Javamelody 2024-11-21 N/A
JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
CVE-2018-15530 1 Xerox 2 Colorqube 8580, Colorqube 8580 Firmware 2024-11-21 N/A
Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code.
CVE-2018-15529 1 Mutiny 1 Mutiny 2024-11-21 N/A
A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authenticated users, with access to the admin interface, to inject arbitrary commands within the filename of a system upgrade upload.
CVE-2018-15528 1 Javasystemsolutions 1 Sso Plugin 2024-11-21 N/A
Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "select_sso()" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?[XSS] link and then clicks the "Login" button.
CVE-2018-15520 1 Lexmark 68 Cx421, Cx421 Firmware, Cx522 and 65 more 2024-11-21 N/A
Various Lexmark devices have a Buffer Overflow (issue 2 of 2).
CVE-2018-15519 1 Lexmark 64 6500, 6500 Firmware, Cx310 and 61 more 2024-11-21 N/A
Various Lexmark devices have a Buffer Overflow (issue 1 of 2).
CVE-2018-15518 4 Debian, Opensuse, Qt and 1 more 4 Debian Linux, Leap, Qt and 1 more 2024-11-21 N/A
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.
CVE-2018-15517 1 Dlink 1 Central Wifimanager 2024-11-21 N/A
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
CVE-2018-15516 1 Dlink 1 Central Wifimanager 2024-11-21 N/A
The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in SSRF.
CVE-2018-15515 1 Dlink 1 Central Wifimanager 2024-11-21 N/A
The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the CaptivelPortal.exe subdirectory under the D-Link directory, which allows unprivileged local users to gain SYSTEM privileges.