CVE-2018-25355

Audiograbber 1.83 Local Buffer Overflow via SEH

Audiograbber 1.83 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious input in the Interpret or Album fields that triggers a buffer overflow, overwriting SEH pointers and executing injected shellcode with application privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Audiograbber

Products

Audiograbber

CVE-2018-25327

Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery

Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validation. Attackers can craft malicious HTML forms targeting administrative endpoints like job.jobenforcedelete to delete job entries or modify component settings when administrators visit attacker-controlled pages.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomsky

Products

Js Jobs

CVE-2018-25324

Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wp_abspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wp_abspath values to simple_fields.php to include files like /etc/passwd or inject PHP code into Apache logs for remote code execution when allow_url_include is enabled.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Simple Fields Project Wordpress

Products

Simple Fields Wordpress

CVE-2018-25317

Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change

Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

A302 A302 Firmware W3002r and 3 more

CVE-2018-25316

Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change

Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

W308r W308r Firmware

CVE-2018-25307

SysGauge Pro 4.6.12 Local Buffer Overflow SEH

SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Flexense Sysgauge

Products

Sysgauge Sysgauge Pro

CVE-2018-25296

P10 Central Management Software 1.4.13 Denial of Service

P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Fireeye P10

Products

Central Management Central Management Software

CVE-2018-25264

TransMac 12.2 Denial of Service via License Key Field

TransMac 12.2 contains a buffer overflow vulnerability in the license key input field that allows local attackers to crash the application by submitting an oversized string. Attackers can generate a payload file containing 4000 bytes of data, paste it into the License Key field, and trigger a denial of service condition.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Acutesystems

Products

Transmac

CVE-2018-25243

FastTube 1.0.1.0 Denial of Service via Search

FastTube 1.0.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 1900 characters into the search bar and trigger a crash when the search operation is executed.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Caspie Fasttube

Products

Fast Tube Fasttube

CVE-2018-25236

Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Belden

Products

Hirschmann Hios Hirschmann Hisecos

CVE-2018-25212

Boxoft wav-wma Converter 1.0 Local Buffer Overflow SEH

Boxoft wav-wma Converter 1.0 contains a local buffer overflow vulnerability in structured exception handling that allows attackers to execute arbitrary code by crafting malicious WAV files. Attackers can create a specially crafted WAV file with excessive data and ROP gadgets to overwrite the SEH chain and achieve code execution on Windows systems.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Boxoft Vmware

Products

Wav To Wma Converter Converter Enterprise Client

CVE-2018-25207

Online Quiz Maker 1.0 SQL Injection via catid Parameter

Online Quiz Maker 1.0 contains SQL injection vulnerabilities in the catid and usern parameters that allow authenticated attackers to execute arbitrary SQL commands. Attackers can submit malicious POST requests to quiz-system.php or add-category.php with crafted SQL payloads in POST parameters to extract sensitive database information or bypass authentication.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ays-pro Hscripts

Products

Quiz Maker Online Quiz Maker

CVE-2018-25203

Online Store System CMS 1.0 SQL Injection via clientaccess

Online Store System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to index.php with the action=clientaccess parameter using boolean-based blind or time-based blind SQL injection payloads in the email field to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Online Store System Project Wecodex

Products

Online Store System Online Store System Cms

CVE-2018-25193

Mongoose Web Server 6.9 Denial of Service via Socket Connection

Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections. Attackers can repeatedly create connections to the default port and send malformed data to exhaust server resources and cause service unavailability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cesanta

Products

Mongoose Mongoose Web Server

CVE-2017-20229

MAWK 1.3.3-17 Stack-Based Buffer Overflow

MAWK 1.3.3-17 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting inadequate boundary checks on user-supplied input. Attackers can craft malicious input that overflows the stack buffer and execute a return-oriented programming chain to spawn a shell with application privileges.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Invisible-island Mawk

Products

Mawk Mawk

CVE-2016-20094

AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege

AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root path that execute with elevated privileges during application startup or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Anydesk

Products

Anydesk

CVE-2016-20093

Wise Care 365 4.27 and Wise Disk Cleaner 9.29 Unquoted Service Path Privilege Escalation

Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the WiseBootAssistant and SpyHunter 4 Service respectively, allowing local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that execute during service startup or system reboot with elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wise Wisecleaner

Products

Wisecleaner Wise Care 365

CVE-2016-20091

Windows Firewall Control 4.8.6.0 Unquoted Service Path Privilege Escalation

Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by inserting malicious executables in the service path. Attackers can place executable files in unquoted path directories that the wfcs.exe service will execute with LocalSystem privileges upon service restart or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Malwarebytes Microsoft

Products

Binisoft Windows Firewall Control Windows Firewall

CVE-2016-20085

Realtek High Definition Audio Driver 6.0.1.6730 Privilege Escalation

Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable file in the unquoted path and restart the service to execute code with LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Dell Realtek

Products

Realtek High Definition Audio Driver Realtek High Definition Audio Driver

CVE-2016-20075

WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE

WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Etoilewebdesign Wordpress

Products

Ultimate Product Catalog Wordpress