Skip to content
OpenAdvisories

Archive

28 September 2018

Vulnerabilities first published on this day (UTC), newest first.

← August 2018 2018 / September /28 October 2018 →
  1. 120
  2. 228
  3. 331
  4. 452
  5. 554
  6. 651
  7. 765
  8. 87
  9. 97
  10. 1047
  11. 1139
  12. 1269
  13. 13104
  14. 1431
  15. 159
  16. 1626
  17. 1738
  18. 1878
  19. 1957
  20. 2043
  21. 2163
  22. 226
  23. 2316
  24. 2427
  25. 2554
  26. 2663
  27. 2715
  28. 2862
  29. 292
  30. 306
All Critical High Medium Low Exploited only Public exploit

62 results · Feed

  • Unscored —
    CVE-2018-16659 Public exploit

    An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked …

  • Unscored —
    CVE-2018-16587

    In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker cou…

    otrs2 otrs2 Debian Ubuntu
  • Unscored —
    CVE-2018-17581

    CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive fun…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-17376 Public exploit

    SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filte…

  • Unscored —
    CVE-2018-17055

    An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.

  • Unscored —
    CVE-2018-17394 Public exploit

    SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.

  • Unscored —
    CVE-2018-17377 Public exploit

    SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter.

  • High 7.5
    CVE-2018-17567

    Jekyll allows attackers to access arbitrary files by specifying a symlink

    Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.

    jekyll jekyll jekyll Debian Ubuntu RubyGems
  • Unscored —
    CVE-2018-17383 Public exploit

    SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir par…

  • Unscored —
    CVE-2018-17375 Public exploit

    SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.

  • Unscored —
    CVE-2018-17378 Public exploit

    SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order …

  • Unscored —
    CVE-2018-17391 Public exploit

    SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.

  • Unscored —
    CVE-2018-17397 Public exploit

    SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.

  • Unscored —
    CVE-2018-17385 Public exploit

    SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radi…

  • Unscored —
    CVE-2018-17382 Public exploit

    SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter_letter parameter.

  • Unscored —
    CVE-2018-17056

    Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows r…

  • Unscored —
    CVE-2018-17380 Public exploit

    SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_…

  • Unscored —
    CVE-2018-17379 Public exploit

    SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order paramet…

  • Unscored —
    CVE-2018-17384 Public exploit

    SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter.

  • Unscored —
    CVE-2018-14957

    CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.ph…

  • Unscored —
    CVE-2018-14956

    CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker can inject malicious queries into the applic…

  • Unscored —
    CVE-2018-14037

    Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbi…