# CVEs published 2018-12-30 29 CVEs were published on December 30, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-20597](https://cve.now/CVE-2018-20597.md): UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin\_fileedit action. (no CVSS) - [CVE-2018-20598](https://cve.now/CVE-2018-20598.md): UCMS 1.4.7 has ?do=user\_addpost CSRF. (no CVSS) - [CVE-2018-20599](https://cve.now/CVE-2018-20599.md): UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin\_fileedit action. (no CVSS) - [CVE-2018-20600](https://cve.now/CVE-2018-20600.md): sadmin\\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin\_cedit action. (no CVSS) - [CVE-2018-20601](https://cve.now/CVE-2018-20601.md): UCMS 1.4.7 has XSS via the description parameter in an index.php list\_editpost action. (no CVSS) - [CVE-2018-20602](https://cve.now/CVE-2018-20602.md): Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI. (no CVSS) - [CVE-2018-20603](https://cve.now/CVE-2018-20603.md): Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF. (no CVSS) - [CVE-2018-20604](https://cve.now/CVE-2018-20604.md): Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..\* in Template/edit/path URIs, as demonstrated by the admin (no CVSS) - [CVE-2018-20605](https://cve.now/CVE-2018-20605.md): imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file. (no CVSS) - [CVE-2018-20606](https://cve.now/CVE-2018-20606.md): imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI. (no CVSS) - [CVE-2018-20607](https://cve.now/CVE-2018-20607.md): imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI. (no CVSS) - [CVE-2018-20608](https://cve.now/CVE-2018-20608.md): imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI. (no CVSS) - [CVE-2018-20609](https://cve.now/CVE-2018-20609.md): imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI. (no CVSS) - [CVE-2018-20610](https://cve.now/CVE-2018-20610.md): imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter. (no CVSS) - [CVE-2018-20611](https://cve.now/CVE-2018-20611.md): imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI. (no CVSS) - [CVE-2018-20612](https://cve.now/CVE-2018-20612.md): UWA 2.3.11 allows index.php?g=admin&c=admin&a=add\_admin\_do CSRF. (no CVSS) - [CVE-2018-20613](https://cve.now/CVE-2018-20613.md): TEMMOKU T1.09 Beta allows admin/user/add CSRF. (no CVSS) - [CVE-2018-20614](https://cve.now/CVE-2018-20614.md): public\\install\\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install/#/step3 URI. (no CVSS) - [CVE-2018-20589](https://cve.now/CVE-2018-20589.md): Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/add\_pictures.php article ID. (no CVSS) - [CVE-2018-20590](https://cve.now/CVE-2018-20590.md): Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/users.php user ID. (no CVSS) - [CVE-2018-20591](https://cve.now/CVE-2018-20591.md): A heap-based buffer over-read was discovered in decompileJUMP function in util/decompile.c of libming v0.4.8. (no CVSS) - [CVE-2018-20592](https://cve.now/CVE-2018-20592.md): In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file. (no CVSS) - [CVE-2018-20593](https://cve.now/CVE-2018-20593.md): In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan\_file function in mxmldoc.c. (no CVSS) - [CVE-2018-20594](https://cve.now/CVE-2018-20594.md): An issue was discovered in hsweb 3.0.4. (no CVSS, org.hswebframework.web:hsweb-commons) - [CVE-2018-20595](https://cve.now/CVE-2018-20595.md): A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in (no CVSS, org.hswebframework.web:hsweb-commons) - [CVE-2018-20596](https://cve.now/CVE-2018-20596.md): Jspxcms v9.0.0 allows SSRF. (no CVSS) - [CVE-2018-20588](https://cve.now/CVE-2018-20588.md): lib/support/unicodeconv/unicodeconv.c in libotfcc.a in otfcc v0.10.3-alpha has a buffer over-read. (no CVSS) - [CVE-2018-20583](https://cve.now/CVE-2018-20583.md): Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote att (no CVSS, league/commonmark) - [CVE-2018-20584](https://cve.now/CVE-2018-20584.md): JasPer 2.0.14 allows remote attackers to cause a denial of service (application hang) via an attempted conversion to the jp2 format. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-12-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.