CVE-2018-1000000 to CVE-2018-1000999

91 CVEs with public proof-of-concept exploits.

• CVE-2018-10000016 PoCsIn glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination…
• CVE-2018-10000066 PoCsGitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler,…
• CVE-2018-10000301 PoCPython 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be…
• CVE-2018-10000494 PoCsNanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API. The flaw can…
• CVE-2018-10000691 PoCFreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in…
• CVE-2018-10000801 PoCAjenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins…
• CVE-2018-10000811 PoCAjenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server…
• CVE-2018-10000821 PoCAjenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to…
• CVE-2018-10000831 PoCAjenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a…
• CVE-2018-10000861 PoCNPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js…
• CVE-2018-10000871 PoCWolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory"…
• CVE-2018-10000911 PoCKadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that can result in Control…
• CVE-2018-10000932 PoCsCryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the…
• CVE-2018-10000943 PoCsCMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated…
• CVE-2018-10000961 PoCbrianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL…
• CVE-2018-10001153 PoCsMemcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the…
• CVE-2018-10001171 PoCPython Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink()…
• CVE-2018-10001241 PoCI Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of…
• CVE-2018-10001261 PoCAjenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system…
• CVE-2018-10001292 PoCsAn XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript…
• CVE-2018-10001301 PoCA JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java…
• CVE-2018-10001371 PoCI, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the…
• CVE-2018-10001381 PoCI, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in…
• CVE-2018-10001391 PoCI, Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in "id" parameter in stable.php that can result…
• CVE-2018-10001401 PoCrsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that…
• CVE-2018-10001601 PoCRisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js…
• CVE-2018-10001671 PoCOISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the…
• CVE-2018-10001991 PoCThe Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and…
• CVE-2018-10002061 PoCJFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in…
• CVE-2018-10002181 PoCOpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of…
• CVE-2018-10002191 PoCOpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of…
• CVE-2018-10002231 PoCsoundtouch version up to and including 2.0.0 contains a Buffer Overflow vulnerability in…
• CVE-2018-10002261 PoCCobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older…
• CVE-2018-10005041 PoCRedirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute…
• CVE-2018-10005051 PoCTooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in could…
• CVE-2018-10005061 PoCMetronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page…
• CVE-2018-10005071 PoCWP User Groups version 2.0.0 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in allows anybody…
• CVE-2018-10005081 PoCWP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised…
• CVE-2018-10005091 PoCRedirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result…
• CVE-2018-10005101 PoCWP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause…
• CVE-2018-10005111 PoCWP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row…
• CVE-2018-10005121 PoCTooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in…
• CVE-2018-10005191 PoCaio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see:…
• CVE-2018-10005241 PoCminiSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result…
• CVE-2018-10005291 PoCGrails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS .…
• CVE-2018-10005337 PoCsklaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree`…
• CVE-2018-10005341 PoCJoplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular…
• CVE-2018-10005361 PoCMedis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer…
• CVE-2018-10005401 PoCLoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when…
• CVE-2018-10005422 PoCsnetbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible…
• CVE-2018-10005441 PoCrubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write…
• CVE-2018-10005461 PoCTriplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible…
• CVE-2018-10005482 PoCsUmlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential…
• CVE-2018-10005561 PoCWordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can…
• CVE-2018-10006003 PoCsA exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java…
• CVE-2018-10006201 PoCEran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can…
• CVE-2018-10006211 PoCMycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can…
• CVE-2018-10006381 PoCMiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can…
• CVE-2018-10006531 PoCzzcms version 8.3 and earlier contains a SQL Injection vulnerability in zt/top.php line 5 that can result in could be attacked by sql…
• CVE-2018-10006541 PoCGNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running…
• CVE-2018-10006671 PoCNASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption (crashed) of nasm when handling a crafted file…
• CVE-2018-10006691 PoCKOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF)…
• CVE-2018-10006701 PoCKOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS)…
• CVE-2018-10006711 PoCsympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer"…
• CVE-2018-10007731 PoCWordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote…
• CVE-2018-10008011 PoCokular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in…
• CVE-2018-10008021 PoCPython Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command…
• CVE-2018-10008101 PoCThe Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680:…
• CVE-2018-10008112 PoCsbludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can…
• CVE-2018-10008121 PoCArtica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for…
• CVE-2018-10008141 PoCaio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage…
• CVE-2018-10008161 PoCGrafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor…
• CVE-2018-10008261 PoCMicroweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution…
• CVE-2018-10008321 PoCZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of…
• CVE-2018-10008392 PoCsLH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code…
• CVE-2018-10008401 PoCProcessing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can…
• CVE-2018-10008501 PoCSquare Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder…
• CVE-2018-10008511 PoCCopay Bitcoin Wallet version 5.01 to 5.1.0 included. contains a Other/Unknown vulnerability in wallet private key storage that can result…
• CVE-2018-10008562 PoCsDomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in…
• CVE-2018-10008571 PoClog-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session…
• CVE-2018-10008619 PoCsKEVA code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in…
• CVE-2018-10008631 PoCA data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows…
• CVE-2018-10008691 PoCphpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack…
• CVE-2018-10008711 PoCHotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id_utente_mod" parameter in…
• CVE-2018-10008741 PoCPHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing…
• CVE-2018-10008811 PoCTraccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability…
• CVE-2018-10008851 PoCPHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a…
• CVE-2018-10008861 PoCnasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vulnerability in asm/stdscan.c:130 that can result in Stack-overflow caused by…
• CVE-2018-10008871 PoCPeel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user…
• CVE-2018-10008882 PoCsPEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file…
• CVE-2018-10008902 PoCsFrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can…