Export limit exceeded: 40040 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (40040 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-18651 | 1 Xpdfreader | 1 Xpdf | 2024-11-21 | N/A |
| An issue was discovered in Xpdf 4.00. catalog->getNumPages() in AcroForm.cc allows attackers to launch a denial of service (hang caused by large loop) via a specific pdf file, as demonstrated by pdftohtml. This is mainly caused by a large number after the /Count field in the file. | ||||
| CVE-2018-18647 | 1 Gitlab | 1 Gitlab | 2024-11-21 | N/A |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization. | ||||
| CVE-2018-18619 | 1 Advanced Comment System Project | 1 Advanced Comment System | 2024-11-21 | N/A |
| internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter. NOTE: The product is discontinued. | ||||
| CVE-2018-18550 | 1 Serverscheck | 1 Serverscheck | 2024-11-21 | N/A |
| ServersCheck Monitoring Software before 14.3.4 allows SQL Injection by an authenticated user. | ||||
| CVE-2018-18546 | 1 Thinkphp | 1 Thinkphp | 2024-11-21 | N/A |
| ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable. | ||||
| CVE-2018-18530 | 1 Thinkphp | 1 Thinkphp | 2024-11-21 | N/A |
| ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI. | ||||
| CVE-2018-18529 | 1 Thinkphp | 1 Thinkphp | 2024-11-21 | N/A |
| ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI. | ||||
| CVE-2018-18527 | 1 Owndms | 1 Ownticket | 2024-11-21 | N/A |
| OwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter. | ||||
| CVE-2018-18499 | 2 Mozilla, Redhat | 4 Firefox, Firefox Esr, Thunderbird and 1 more | 2024-11-21 | N/A |
| A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. | ||||
| CVE-2018-18488 | 1 Gxlcms | 1 Gxlcms | 2024-11-21 | N/A |
| In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter. | ||||
| CVE-2018-18486 | 1 Phpshe | 1 Phpshe | 2024-11-21 | N/A |
| An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del user_id[] parameter. | ||||
| CVE-2018-18476 | 1 Nedap | 1 Mysql-binuuid-rails | 2024-11-21 | N/A |
| mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes default string escaping for affected database columns. | ||||
| CVE-2018-18450 | 1 Pbootcms | 1 Pbootcms | 2024-11-21 | N/A |
| apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI. | ||||
| CVE-2018-18427 | 1 S-cms | 1 S-cms | 2024-11-21 | N/A |
| s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php. | ||||
| CVE-2018-18399 | 1 Jco | 1 Karma | 2024-11-21 | N/A |
| SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter. | ||||
| CVE-2018-18397 | 3 Canonical, Linux, Redhat | 12 Ubuntu Linux, Linux Kernel, Enterprise Linux and 9 more | 2024-11-21 | N/A |
| The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c. | ||||
| CVE-2018-18387 | 1 Playsms Project | 1 Playsms | 2024-11-21 | N/A |
| playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse. | ||||
| CVE-2018-18386 | 3 Canonical, Linux, Redhat | 3 Ubuntu Linux, Linux Kernel, Enterprise Linux | 2024-11-21 | N/A |
| drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ. | ||||
| CVE-2018-18385 | 1 Asciidoctor | 1 Asciidoctor | 2024-11-21 | N/A |
| Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop. | ||||
| CVE-2018-18377 | 1 Orange | 2 Airbox, Airbox Firmware | 2024-11-21 | N/A |
| goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials. | ||||