3 September 2018

31 results · Feed

• Unscored —
  CVE-2018-16412

  ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function.

  imagemagick imagemagick imagemagick6 Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16416

  Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to c…

  Sep 3, 2018
• Unscored —
  CVE-2018-16408

  D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a SetNetworkTo…

  Sep 3, 2018
• Medium 6.1
  CVE-2018-16406

  Moderate severity vulnerability that affects mayan-edms

  An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.

  mayan-edms PyPI
  Sep 3, 2018
• Unscored —
  CVE-2018-16402

  libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application cr…

  elfutils elfutils elfutils Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16410

  Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applicatio…

  Sep 3, 2018
• Unscored —
  CVE-2018-16403

  libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and d…

  elfutils elfutils elfutils Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16398

  In Twistlock AuthZ Broker 0.1, regular expressions are mishandled, as demonstrated by containers/aa/pause?aaa=\/start t…

  Sep 3, 2018
• Unscored —
  CVE-2018-16413

  ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function …

  imagemagick imagemagick imagemagick6 Debian Ubuntu Alpine
  Sep 3, 2018
• Medium 6.1
  CVE-2018-16407

  Moderate severity vulnerability that affects mayan-edms

  An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.

  mayan-edms PyPI
  Sep 3, 2018
• Unscored —
  CVE-2018-16409

  In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF.

  Sep 3, 2018
• Medium 6.1
  CVE-2018-16405

  mayan-edms Cross-site Scripting vulnerability

  An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.

  mayan-edms mayan-edms-ng PyPI
  Sep 3, 2018
• Unscored —
  CVE-2018-16397

  In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,

  Sep 3, 2018
• Unscored —
  CVE-2018-16392

  Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenS…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16391

  Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in …

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16393

  Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs1…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16382

  Netwide Assembler (NASM) 2.14rc15 has a buffer over-read in x86/regflags.c.

  nasm nasm Debian Ubuntu
  Sep 3, 2018
• Critical 9.8
  CVE-2018-16385 Public exploit

  ThinkPHP SQL Injection vulnerability

  ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

  topthink/framework Packagist
  Sep 3, 2018
• High 8.8
  CVE-2018-16387

  Elefant CMS CSRF Vulnerability

  An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add.

  elefant/cms Packagist
  Sep 3, 2018
• Unscored —
  CVE-2018-16372

  The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw …

  Sep 3, 2018
• Unscored —
  CVE-2018-16371

  PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=User_g…

  Sep 3, 2018
• Unscored —
  CVE-2018-16374

  Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.

  Sep 3, 2018
• Unscored —
  CVE-2018-16379

  Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen.

  Sep 3, 2018
• Unscored —
  CVE-2018-16370 Public exploit

  In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade b…

  Sep 3, 2018
• Unscored —
  CVE-2018-16380

  An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add …

  Sep 3, 2018
• Unscored —
  CVE-2018-16384

  A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.…

  modsecurity-crs modsecurity-crs Debian Ubuntu
  Sep 3, 2018
• Unscored —
  CVE-2018-16368

  SplashXPath::strokeAdjust in splash/SplashXPath.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (h…

  ipe xpdf xpdf Debian Ubuntu
  Sep 3, 2018
• Unscored —
  CVE-2018-16376

  An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet…

  openjpeg2 openjpeg2 openjpeg Debian Ubuntu Azure Linux
  Sep 3, 2018
• Unscored —
  CVE-2018-16373 Public exploit

  Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.

  Sep 3, 2018
• Unscored —
  CVE-2018-16369

  XRef::fetch in XRef.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (stack consumption) via a craf…

  ipe xpdf xpdf Debian Ubuntu
  Sep 3, 2018
• Unscored —
  CVE-2018-16375

  An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function …

  openjpeg2 openjpeg2 Debian Ubuntu
  Sep 3, 2018