Total
324454 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-11251 | 1 Imagemagick | 1 Imagemagick | 2024-11-21 | N/A |
| In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file. | ||||
| CVE-2018-11248 | 1 Liulishuo | 1 Filedownloader | 2024-11-21 | N/A |
| util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored in an unintended directory because of Directory Traversal. | ||||
| CVE-2018-11247 | 1 Nasdaq | 1 Bwise | 2024-11-21 | N/A |
| The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute arbitrary code via a session on port 81. | ||||
| CVE-2018-11246 | 1 K7computing | 4 Antivrius, Enterprise Security, Total Security and 1 more | 2024-11-21 | 7.5 High |
| K7TSMngr.exe in K7Computing K7AntiVirus Premium 15.1.0.53 has a Memory Leak. | ||||
| CVE-2018-11245 | 1 Misp-project | 1 Misp | 2024-11-21 | N/A |
| app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes. | ||||
| CVE-2018-11244 | 1 Dopewp | 1 Bbe Theme | 2024-11-21 | N/A |
| The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor. | ||||
| CVE-2018-11242 | 1 Makemytrip | 1 Makemytrip | 2024-11-21 | N/A |
| An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files. | ||||
| CVE-2018-11241 | 1 Softcase | 2 T-router, T-router Firmware | 2024-11-21 | N/A |
| An issue was discovered on SoftCase T-Router build 20112017 devices. A remote attacker can read and write to arbitrary files on the system as root, as demonstrated by code execution after writing to a crontab file. This is fixed in production builds as of Spring 2018. | ||||
| CVE-2018-11240 | 1 Softcase | 2 T-router, T-router Firmware | 2024-11-21 | N/A |
| An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' feature of the T-Router protocol. If the command syntax is correct, there is code execution both on the other modem and on the main servers. This is fixed in production builds as of Spring 2018. | ||||
| CVE-2018-11239 | 1 Hexagontoken | 1 Hexagon | 2024-11-21 | N/A |
| An integer overflow in the _transfer function of a smart contract implementation for Hexagon (HXG), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a _to argument in conjunction with a large _value argument, as exploited in the wild in May 2018, aka the "burnOverflow" issue. | ||||
| CVE-2018-11237 | 5 Canonical, Gnu, Netapp and 2 more | 11 Ubuntu Linux, Glibc, Data Ontap Edge and 8 more | 2024-11-21 | 7.8 High |
| An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper. | ||||
| CVE-2018-11236 | 4 Gnu, Netapp, Oracle and 1 more | 10 Glibc, Data Ontap Edge, Element Software Management and 7 more | 2024-11-21 | N/A |
| stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution. | ||||
| CVE-2018-11235 | 5 Canonical, Debian, Git-scm and 2 more | 10 Ubuntu Linux, Debian Linux, Git and 7 more | 2024-11-21 | N/A |
| In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. | ||||
| CVE-2018-11233 | 3 Canonical, Git-scm, Redhat | 3 Ubuntu Linux, Git, Rhel Software Collections | 2024-11-21 | N/A |
| In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory. | ||||
| CVE-2018-11232 | 1 Linux | 1 Linux Kernel | 2024-11-21 | N/A |
| The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable. | ||||
| CVE-2018-11231 | 1 Divido | 1 Divido | 2024-11-21 | N/A |
| In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential information. | ||||
| CVE-2018-11230 | 1 Jbig2enc Project | 1 Jbig2enc | 2024-11-21 | N/A |
| jbig2_add_page in jbig2enc.cc in libjbig2enc.a in jbig2enc 0.29 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted file. | ||||
| CVE-2018-11229 | 1 Crestron | 8 Crestron Toolbox Protocol Firmware, Dmc-str, Tsw-1060 and 5 more | 2024-11-21 | N/A |
| Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in Crestron Toolbox Protocol (CTP). | ||||
| CVE-2018-11228 | 1 Crestron | 8 Crestron Toolbox Protocol Firmware, Dmc-str, Tsw-1060 and 5 more | 2024-11-21 | N/A |
| Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP). | ||||
| CVE-2018-11227 | 1 Monstra | 1 Monstra Cms | 2024-11-21 | N/A |
| Monstra CMS 3.0.4 and earlier has XSS via index.php. | ||||