CVEs published September 1, 2018
20 CVEs were published on September 1, 2018: 0 critical, 0 high.
- Published
- 20
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- intelliants/subrion
- 1
Medium, low and unrated 20
- CVE-2018-16325There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.
- CVE-2018-16327There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.intelliants/subrion
- CVE-2018-16328In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c.
- CVE-2018-16329In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c.
- CVE-2018-16308The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
- CVE-2018-16313Bludit 2.3.4 allows XSS via a user name.
- CVE-2018-16314An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11.
- CVE-2018-16315In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.
- CVE-2018-16316A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScri
- CVE-2018-16320idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.
- CVE-2018-16323ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel v
- CVE-2018-16324In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
- CVE-2018-16302MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file.
- CVE-2018-16303PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta str
- CVE-2018-15157The libfsclfs_block_read function in libfsclfs_block.c in libfsclfs before 2018-07-25 allows remote attackers to cause a heap-based buffer o
- CVE-2018-15158The libesedb_page_read_values function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffe
- CVE-2018-15159The libesedb_page_read_tags function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer
- CVE-2018-15160The libesedb_catalog_definition_read function in libesedb_catalog_definition.c in libesedb through 2018-04-01 allows remote attackers to cau
- CVE-2018-15161The libesedb_key_append_data function in libesedb_key.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer
- CVE-2018-15514HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over