Export limit exceeded: 26155 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421811 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-7188 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2024-11-21 | N/A |
| An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php. | ||||
| CVE-2018-7187 | 2 Debian, Golang | 2 Debian Linux, Go | 2024-11-21 | 8.8 High |
| The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site. | ||||
| CVE-2018-7186 | 2 Debian, Leptonica | 2 Debian Linux, Leptonica | 2024-11-21 | N/A |
| Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions. | ||||
| CVE-2018-7183 | 4 Canonical, Freebsd, Netapp and 1 more | 4 Ubuntu Linux, Freebsd, Element Software and 1 more | 2024-11-21 | N/A |
| Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array. | ||||
| CVE-2018-7182 | 3 Canonical, Netapp, Ntp | 3 Ubuntu Linux, Element Software, Ntp | 2024-11-21 | N/A |
| The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10. | ||||
| CVE-2018-7180 | 1 Saxum2003 | 1 Astro | 2024-11-21 | N/A |
| SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter. | ||||
| CVE-2018-7179 | 1 Squadmanagement Project | 1 Squadmanagement | 2024-11-21 | N/A |
| SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter. | ||||
| CVE-2018-7178 | 1 Saxum2003 | 1 Saxum Picker | 2024-11-21 | N/A |
| SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter. | ||||
| CVE-2018-7177 | 1 Saxum2003 | 1 Numerology | 2024-11-21 | N/A |
| SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter. | ||||
| CVE-2018-7176 | 1 Frontaccounting | 1 Frontaccounting | 2024-11-21 | N/A |
| FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page). | ||||
| CVE-2018-7175 | 1 Xpdfreader | 1 Xpdf | 2024-11-21 | N/A |
| An issue was discovered in xpdf 4.00. A NULL pointer dereference in readCodestream allows an attacker to cause denial of service via a JPX image with zero components. | ||||
| CVE-2018-7174 | 1 Xpdfreader | 1 Xpdf | 2024-11-21 | N/A |
| An issue was discovered in xpdf 4.00. An infinite loop in XRef::Xref allows an attacker to cause denial of service because loop detection exists only for tables, not streams. | ||||
| CVE-2018-7173 | 1 Xpdfreader | 1 Xpdf | 2024-11-21 | N/A |
| A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappropriate decoding. | ||||
| CVE-2018-7172 | 1 Wondercms | 1 Wondercms | 2024-11-21 | N/A |
| In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal. | ||||
| CVE-2018-7171 | 1 Lynxtechnology | 1 Twonky Server | 2024-11-21 | N/A |
| Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. (dot dot) in the contentbase parameter to rpc/set_all. | ||||
| CVE-2018-7169 | 1 Shadow Project | 1 Shadow | 2024-11-21 | N/A |
| An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. | ||||
| CVE-2018-7125 | 1 Hp | 1 Intelligent Management Center | 2024-11-21 | N/A |
| A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||||
| CVE-2018-7124 | 1 Hp | 1 Intelligent Management Center | 2024-11-21 | N/A |
| A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||||
| CVE-2018-7123 | 1 Hp | 1 Intelligent Management Center | 2024-11-21 | N/A |
| A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||||
| CVE-2018-7122 | 1 Hp | 1 Intelligent Management Center | 2024-11-21 | N/A |
| A remote disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | ||||