CVEs published December 27, 2018
11 CVEs were published on December 27, 2018: 0 critical, 0 high.
- Published
- 11
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- pear/archive_tar
- 1
Medium, low and unrated 11
- CVE-2018-1000887Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injec
- CVE-2018-1000888PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class.pear/archive_tar
- CVE-2018-1000889Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (load
- CVE-2018-1000890FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can all
- CVE-2018-20528JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter.
- CVE-2018-20530PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.
- CVE-2018-20524The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message, because a danmuWrapper DIV element in chatbox-
- CVE-2018-20519An issue was discovered in 74cms v4.2.111.
- CVE-2018-20520MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.
- CVE-2018-20511An issue was discovered in the Linux kernel before 4.18.11.
- CVE-2018-20508CrashFix 1.0.4 has SQL Injection via the User[status] parameter.