CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter.

Source: CVE-2018-14389

CVE-2018-12429

JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie.

Source: CVE-2018-12429

CVE-2018-7546

wpsmain.dll in Kingsoft WPS Office 2016 and Jinshan PDF 10.1.0.6621 allows remote attackers to cause a denial of service via a crafted pdf file.

Source: CVE-2018-7546

CVE-2018-14082

PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.

Source: CVE-2018-14082

CVE-2018-14380

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.

Source: CVE-2018-14380

CVE-2018-14382

InstantCMS 2.10.1 has /redirect?url= XSS.

Source: CVE-2018-14382

CVE-2018-8042

Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie.

Source: CVE-2018-8042

CVE-2018-10877

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.

Source: CVE-2018-10877

CVE-2018-14381

Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.

Source: CVE-2018-14381

CVE-2018-10616

ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used.

Source: CVE-2018-10616