CVEs published September 2, 2018
28 CVEs were published on September 2, 2018: 0 critical, 0 high.
- Published
- 28
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- editor.md
- 1
- gleez/cms
- 1
- showdoc/showdoc
- 1
Medium, low and unrated 28
- CVE-2018-16352There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the im
- CVE-2018-16353An issue was discovered in FHCRM through 2018-02-11.
- CVE-2018-16354An issue was discovered in FHCRM through 2018-02-11.
- CVE-2018-16358A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authe
- CVE-2018-16359Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows attackers to rename fi
- CVE-2018-16362An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT.
- CVE-2018-16365An issue was discovered in idreamsoft iCMS V7.0.10.
- CVE-2018-16366An issue was discovered in idreamsoft iCMS V7.0.10.
- CVE-2018-16367In OnlineJudge 2.0, the sandbox has an incorrect access control vulnerability that can write a file anywhere.
- CVE-2018-16337An issue was discovered in Cscms V4.1.8.
- CVE-2018-16338An issue was discovered in AuraCMS 2.3.
- CVE-2018-16339An issue was discovered in EmpireCMS 7.0.
- CVE-2018-16342ShowDoc v1.8.0 has XSS via a new page.showdoc/showdoc
- CVE-2018-16343SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.
- CVE-2018-16344An issue was discovered in zzcms 8.3.
- CVE-2018-16345An issue was discovered in EasyCMS 1.5.
- CVE-2018-16346ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
- CVE-2018-16347An issue was discovered in Gleez CMS v1.2.0.gleez/cms
- CVE-2018-16348SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
- CVE-2018-16349WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter.
- CVE-2018-16350WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.
- CVE-2018-16330Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.editor.md
- CVE-2018-16331admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.
- CVE-2018-16332An issue was discovered in iCMS 7.0.9.
- CVE-2018-16333An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03
- CVE-2018-16334An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices.
- CVE-2018-16335newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service
- CVE-2018-16336Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) v