Total
3573 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-8540 | 1 Microsoft | 9 .net Framework, Windows 10, Windows 7 and 6 more | 2024-02-04 | 10.0 HIGH | 9.8 CRITICAL |
| A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This affects Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2, Microsoft .NET Framework 4.6.2. | |||||
| CVE-2019-4038 | 1 Ibm | 1 Security Identity Manager | 2024-02-04 | 4.6 MEDIUM | 6.2 MEDIUM |
| IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection. IBM X-Force ID: 156162. | |||||
| CVE-2018-20027 | 1 Lisa-lab | 1 Pylearn2 | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| The yaml_parse.load method in Pylearn2 allows code injection. | |||||
| CVE-2018-14630 | 1 Moodle | 1 Moodle | 2024-02-04 | 6.5 MEDIUM | 8.8 HIGH |
| moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source. | |||||
| CVE-2019-9002 | 2 Pixeline, Tiny Issue Project | 2 Bugs, Tiny Issue | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code via the database_host parameter if the installer remains present in its original directory after installation is completed. | |||||
| CVE-2018-19180 | 1 Yunucms | 1 Yunucms | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| statics/app/index/controller/Install.php in YUNUCMS 1.1.5 (if install.lock is not present) allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DB_PREFIX field, which is written to database.php. | |||||
| CVE-2018-20773 | 1 Frog Cms Project | 1 Frog Cms | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines. | |||||
| CVE-2018-15886 | 1 Monstra | 1 Monstra | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=edit_snippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a <?php substring. | |||||
| CVE-2018-7633 | 1 Adbglobal | 1 Epicentro | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript code by making a user issue a manipulated POST request. | |||||
| CVE-2018-1999022 | 2 Civicrm, Html Quickform Project | 2 Civicrm, Html Quickform | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15. | |||||
| CVE-2018-20772 | 1 Frog Cms Project | 1 Frog Cms | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI. | |||||
| CVE-2018-17173 | 1 Lg | 1 Supersign Cms | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail. | |||||
| CVE-2018-17827 | 1 Hisiphp | 1 Hisiphp | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php. | |||||
| CVE-2019-3575 | 1 Sqla Yaml Fixtures Project | 1 Sqla Yaml Fixtures | 2024-02-04 | 4.6 MEDIUM | 7.8 HIGH |
| Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load. | |||||
| CVE-2018-17132 | 1 Phpmywind | 1 Phpmywind | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter. | |||||
| CVE-2018-18258 | 1 Bagesoft | 1 Bagecms | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI. | |||||
| CVE-2018-3686 | 1 Intel | 1 Sa-00086 Detection Tool | 2024-02-04 | 4.6 MEDIUM | 6.7 MEDIUM |
| Code injection vulnerability in INTEL-SA-00086 Detection Tool before version 1.2.7.0 may allow a privileged user to potentially execute arbitrary code via local access. | |||||
| CVE-2018-20129 | 1 Dedecms | 1 Dedecms | 2024-02-04 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the filename=1.jpg.p*hp value. | |||||
| CVE-2018-18083 | 1 Comsenz | 1 Duomicms | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in DuomiCMS 3.0. Remote PHP code execution is possible via the search.php searchword parameter because "eval" is used during "if" processing. | |||||
| CVE-2019-9082 | 3 Opensourcebms, Thinkphp, Zzzcms | 3 Open Source Background Management System, Thinkphp, Zzzphp | 2024-02-04 | 9.3 HIGH | 8.8 HIGH |
| ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command. | |||||