CVEs published December 30, 2018
29 CVEs were published on December 30, 2018: 0 critical, 0 high.
- Published
- 29
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- org.hswebframework.web:hsweb-commons
- 2
- league/commonmark
- 1
Medium, low and unrated 29
- CVE-2018-20597UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.
- CVE-2018-20598UCMS 1.4.7 has ?do=user_addpost CSRF.
- CVE-2018-20599UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action.
- CVE-2018-20600sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.
- CVE-2018-20601UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.
- CVE-2018-20602Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI.
- CVE-2018-20603Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.
- CVE-2018-20604Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs, as demonstrated by the admin
- CVE-2018-20605imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.
- CVE-2018-20606imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI.
- CVE-2018-20607imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI.
- CVE-2018-20608imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.
- CVE-2018-20609imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI.
- CVE-2018-20610imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.
- CVE-2018-20611imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.
- CVE-2018-20612UWA 2.3.11 allows index.php?g=admin&c=admin&a=add_admin_do CSRF.
- CVE-2018-20613TEMMOKU T1.09 Beta allows admin/user/add CSRF.
- CVE-2018-20614public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install/#/step3 URI.
- CVE-2018-20589Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/add_pictures.php article ID.
- CVE-2018-20590Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/users.php user ID.
- CVE-2018-20591A heap-based buffer over-read was discovered in decompileJUMP function in util/decompile.c of libming v0.4.8.
- CVE-2018-20592In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file.
- CVE-2018-20593In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan_file function in mxmldoc.c.
- CVE-2018-20594An issue was discovered in hsweb 3.0.4.org.hswebframework.web:hsweb-commons
- CVE-2018-20595A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter inorg.hswebframework.web:hsweb-commons
- CVE-2018-20596Jspxcms v9.0.0 allows SSRF.
- CVE-2018-20588lib/support/unicodeconv/unicodeconv.c in libotfcc.a in otfcc v0.10.3-alpha has a buffer over-read.
- CVE-2018-20583Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attleague/commonmark
- CVE-2018-20584JasPer 2.0.14 allows remote attackers to cause a denial of service (application hang) via an attempted conversion to the jp2 format.