Skip to content
OpenAdvisories
Critical ICSA-18-284-02 7 CVEs

NUUO CMS (Update A)

Published Oct 11, 2018 · Updated Nov 20, 2018 · Revision 2

Vendor: NUUO Product: CMS

Summary

Successful exploitation of theses vulnerabilities could result in arbitrary remote code execution.

Vulnerabilities 7

  • Unscored —
    CVE-2018-17888 Public exploit EPSS 30%

    NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers…

    NUUO NUUO CMS
  • Unscored —
    CVE-2018-17890

    NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, …

    NUUO NUUO CMS
  • Unscored —
    CVE-2018-17892

    NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard a…

    NUUO NUUO CMS
  • Unscored —
    CVE-2018-17894

    NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which cou…

    NUUO NUUO CMS
  • Unscored —
    CVE-2018-17934 Public exploit EPSS 20%

    NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be re…

  • Unscored —
    CVE-2018-17936 Public exploit EPSS 15%

    NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite c…

  • Unscored —
    CVE-2018-18982 Public exploit EPSS 63%

    NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can …

Revision history

  1. #2

    ICSA-18-284-02 NUUO CMS (Update A)

  2. #1

    ICSA-18-284-02 NUUO CMS

References