# CVEs published 2018-09-09

7 CVEs were published on September 9, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-16759](https://cve.now/CVE-2018-16759.md): The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via (no CVSS)
- [CVE-2018-16761](https://cve.now/CVE-2018-16761.md): Eventum before 3.4.0 has an open redirect vulnerability. (no CVSS)
- [CVE-2018-16762](https://cve.now/CVE-2018-16762.md): FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search\_term parameter to pages/items. (no CVSS)
- [CVE-2018-16763](https://cve.now/CVE-2018-16763.md): FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. (no CVSS)
- [CVE-2018-16749](https://cve.now/CVE-2018-16749.md): In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (no CVSS)
- [CVE-2018-16750](https://cve.now/CVE-2018-16750.md): In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found. (no CVSS)
- [CVE-2018-16736](https://cve.now/CVE-2018-16736.md): In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the \_whatfilter and \_messages parameters (in the Filters section of the settings (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.