CVEs published November 22, 2018
12 CVEs were published on November 22, 2018: 0 critical, 0 high.
- Published
- 12
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- athlon1600/php-proxy-app
- 1
- tryton
- 1
Medium, low and unrated 12
- CVE-2018-19463zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg c
- CVE-2018-19464Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field f
- CVE-2018-19457Logicspice FAQ Script 2.9.7 allows uploading arbitrary files, which leads to remote command execution via admin/faqs/faqimages with a .php f
- CVE-2018-19458In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulneathlon1600/php-proxy-app
- CVE-2018-19459Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
- CVE-2018-19443The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances intryton
- CVE-2018-19432An issue was discovered in libsndfile 1.0.28.
- CVE-2018-19433ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value.
- CVE-2018-19434An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15.
- CVE-2018-19435An issue was discovered in the Sales component in webERP 4.15.
- CVE-2018-19436An issue was discovered in the Manufacturing component in webERP 4.15.
- CVE-2018-19437UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrar