# CVEs published 2018-11-22

12 CVEs were published on November 22, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-19463](https://cve.now/CVE-2018-19463.md): zb\_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg c (no CVSS)
- [CVE-2018-19464](https://cve.now/CVE-2018-19464.md): Discuz! X3.4 allows XSS via admin.php because admincp/admincp\_setting.php and template\\default\\common\\footer.htm mishandles statcode field f (no CVSS)
- [CVE-2018-19457](https://cve.now/CVE-2018-19457.md): Logicspice FAQ Script 2.9.7 allows uploading arbitrary files, which leads to remote command execution via admin/faqs/faqimages with a .php f (no CVSS)
- [CVE-2018-19458](https://cve.now/CVE-2018-19458.md): In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulne (no CVSS, athlon1600/php-proxy-app)
- [CVE-2018-19459](https://cve.now/CVE-2018-19459.md): Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file. (no CVSS)
- [CVE-2018-19443](https://cve.now/CVE-2018-19443.md): The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in (no CVSS, tryton)
- [CVE-2018-19432](https://cve.now/CVE-2018-19432.md): An issue was discovered in libsndfile 1.0.28. (no CVSS)
- [CVE-2018-19433](https://cve.now/CVE-2018-19433.md): ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur\_lang value. (no CVSS)
- [CVE-2018-19434](https://cve.now/CVE-2018-19434.md): An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. (no CVSS)
- [CVE-2018-19435](https://cve.now/CVE-2018-19435.md): An issue was discovered in the Sales component in webERP 4.15. (no CVSS)
- [CVE-2018-19436](https://cve.now/CVE-2018-19436.md): An issue was discovered in the Manufacturing component in webERP 4.15. (no CVSS)
- [CVE-2018-19437](https://cve.now/CVE-2018-19437.md): UCMS 1.4.7 allows remote authenticated users to change the administrator password because $\_COOKIE\['admin\_'.cookiehash\] is used for arbitrar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-11-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.