Archive
2 September 2018
Vulnerabilities first published on this day (UTC), newest first.
28 results · Feed
-
Unscored —
There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a …
-
Unscored —
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF.
-
Unscored —
An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site s…
-
Unscored —
An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit paramet…
-
Unscored —
Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows a…
-
Unscored —
In OnlineJudge 2.0, the sandbox has an incorrect access control vulnerability that can write a file anywhere. A user ca…
-
Unscored —
A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.…
-
Unscored —
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF.
-
Unscored —
An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit pa…
-
Unscored —
WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter.
-
Unscored —
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via …
-
Unscored —
An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration …
-
Unscored —
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?…
-
Unscored —
ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
-
Unscored —
SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not bloc…
-
Unscored —
SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
-
Unscored —
An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/…
-
Medium 6.1
Gleez CMS Vulnerable to Cross-site Scripting in media/imagecache/resize
An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize.
-
Unscored —
An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequ…
-
Medium 5.4
Showdoc XSS Vulnerability
ShowDoc v1.8.0 has XSS via a new page.
-
Unscored —
WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.
-
Medium 6.1
Pandao editor.md vulnerable to XSS in IMG attributes
Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
-
Unscored —
An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability.
-
Unscored —
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.
-
Unscored —
Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-base…
-
Unscored —
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.1…
-
Unscored —
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause…
-
Unscored —
An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POS…