# CVEs published 2018-09-02

28 CVEs were published on September 2, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-16352](https://cve.now/CVE-2018-16352.md): There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the im (no CVSS)
- [CVE-2018-16353](https://cve.now/CVE-2018-16353.md): An issue was discovered in FHCRM through 2018-02-11. (no CVSS)
- [CVE-2018-16354](https://cve.now/CVE-2018-16354.md): An issue was discovered in FHCRM through 2018-02-11. (no CVSS)
- [CVE-2018-16358](https://cve.now/CVE-2018-16358.md): A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authe (no CVSS)
- [CVE-2018-16359](https://cve.now/CVE-2018-16359.md): Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows attackers to rename fi (no CVSS)
- [CVE-2018-16362](https://cve.now/CVE-2018-16362.md): An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. (no CVSS)
- [CVE-2018-16365](https://cve.now/CVE-2018-16365.md): An issue was discovered in idreamsoft iCMS V7.0.10. (no CVSS)
- [CVE-2018-16366](https://cve.now/CVE-2018-16366.md): An issue was discovered in idreamsoft iCMS V7.0.10. (no CVSS)
- [CVE-2018-16367](https://cve.now/CVE-2018-16367.md): In OnlineJudge 2.0, the sandbox has an incorrect access control vulnerability that can write a file anywhere. (no CVSS)
- [CVE-2018-16337](https://cve.now/CVE-2018-16337.md): An issue was discovered in Cscms V4.1.8. (no CVSS)
- [CVE-2018-16338](https://cve.now/CVE-2018-16338.md): An issue was discovered in AuraCMS 2.3. (no CVSS)
- [CVE-2018-16339](https://cve.now/CVE-2018-16339.md): An issue was discovered in EmpireCMS 7.0. (no CVSS)
- [CVE-2018-16342](https://cve.now/CVE-2018-16342.md): ShowDoc v1.8.0 has XSS via a new page. (no CVSS, showdoc/showdoc)
- [CVE-2018-16343](https://cve.now/CVE-2018-16343.md): SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS. (no CVSS)
- [CVE-2018-16344](https://cve.now/CVE-2018-16344.md): An issue was discovered in zzcms 8.3. (no CVSS)
- [CVE-2018-16345](https://cve.now/CVE-2018-16345.md): An issue was discovered in EasyCMS 1.5. (no CVSS)
- [CVE-2018-16346](https://cve.now/CVE-2018-16346.md): ChemCMS 1.0.6 has XSS via the "setting -\> website information" field. (no CVSS)
- [CVE-2018-16347](https://cve.now/CVE-2018-16347.md): An issue was discovered in Gleez CMS v1.2.0. (no CVSS, gleez/cms)
- [CVE-2018-16348](https://cve.now/CVE-2018-16348.md): SeaCMS V6.61 has XSS via the admin\_video.php v\_content parameter, related to the site name. (no CVSS)
- [CVE-2018-16349](https://cve.now/CVE-2018-16349.md): WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form\[remark\] parameter. (no CVSS)
- [CVE-2018-16350](https://cve.now/CVE-2018-16350.md): WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form\[statcode\] parameter. (no CVSS)
- [CVE-2018-16330](https://cve.now/CVE-2018-16330.md): Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element. (no CVSS, editor.md)
- [CVE-2018-16331](https://cve.now/CVE-2018-16331.md): admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password. (no CVSS)
- [CVE-2018-16332](https://cve.now/CVE-2018-16332.md): An issue was discovered in iCMS 7.0.9. (no CVSS)
- [CVE-2018-16333](https://cve.now/CVE-2018-16333.md): An issue was discovered on Tenda AC7 V15.03.06.44\_CN, AC9 V15.03.05.19(6318)\_CN, AC10 V15.03.06.23\_CN, AC15 V15.03.05.19\_CN, and AC18 V15.03 (no CVSS)
- [CVE-2018-16334](https://cve.now/CVE-2018-16334.md): An issue was discovered on Tenda AC9 V15.03.05.19(6318)\_CN and AC10 V15.03.06.23\_CN devices. (no CVSS)
- [CVE-2018-16335](https://cve.now/CVE-2018-16335.md): newoffsets handling in ChopUpSingleUncompressedStrip in tif\_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2018-16336](https://cve.now/CVE-2018-16336.md): Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.