Skip to content
OpenAdvisories

Archive

October 2018

Vulnerabilities first published in this month (UTC), newest first.

← September 2018 2018 / October November 2018 →
  1. 151
  2. 278
  3. 340
  4. 429
  5. 5134
  6. 62
  7. 76
  8. 848
  9. 958
  10. 10110
  11. 1116
  12. 12114
  13. 13 
  14. 144
  15. 1533
  16. 1625
  17. 17262
  18. 1862
  19. 1942
  20. 202
  21. 214
  22. 2214
  23. 2369
  24. 2435
  25. 257
  26. 2637
  27. 2715
  28. 2840
  29. 2954
  30. 3040
  31. 3142
All Critical High Medium Low Exploited only Public exploit

1,473 results · Feed

  • Medium 5.4
    CVE-2018-1766

    IBM Team Concert (RTC) 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerabili…

    IBM Rational Team Concert
  • Unscored —
    CVE-2018-0735

    Timing attack against ECDSA signature generation

    The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-18790

    An issue was discovered in zzcms 8.3. SQL Injection exists in admin/special_add.php via a zxbigclassid cookie. (This ne…

  • Unscored —
    CVE-2018-18788

    An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. (This …

  • Unscored —
    CVE-2018-18784

    An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. (This nee…

  • Unscored —
    CVE-2018-18789

    An issue was discovered in zzcms 8.3. SQL Injection exists in zt/top.php via a Host HTTP header to zt/news.php.

  • Unscored —
    CVE-2018-18782

    Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.

  • Unscored —
    CVE-2018-18787

    An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs.php via a pxzs cookie.

  • Unscored —
    CVE-2018-18785

    An issue was discovered in zzcms 8.3. SQL Injection exists in zs/subzs.php with a zzcmscpid cookie to zs/search.php.

  • Unscored —
    CVE-2018-18792

    An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs_list.php via a pxzs cookie.

  • Unscored —
    CVE-2018-18783

    XSS was discovered in SEMCMS V3.4 via the semcms_remail.php?type=ok umail parameter.

  • Unscored —
    CVE-2018-18791

    An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie.

  • Unscored —
    CVE-2018-18781

    DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.

  • Unscored —
    CVE-2018-18786

    An issue was discovered in zzcms 8.3. SQL Injection exists in ajax/zs.php via a pxzs cookie.

  • Unscored —
    CVE-2018-18771

    An issue was discovered in LuLu CMS through 2015-05-14. backend\modules\filemanager\controllers\DefaultController.php a…

  • Unscored —
    CVE-2018-18778 Public exploit Scanner template EPSS 71%

    ACME mini_httpd before 1.30 lets remote users read arbitrary files.

    mini-httpd mini-httpd mini_httpd Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-18765

    An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose …

    smplayer Debian
  • Unscored —
    CVE-2018-18764

    An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose …

    smplayer smplayer Debian Ubuntu
  • Unscored —
    CVE-2018-18752

    Webiness Inventory 2.3 suffers from an Arbitrary File upload vulnerability via PHP code in the protected/library/ajax/W…

  • Unscored —
    CVE-2018-18754

    ZyXEL VMG3312-B10B 1.00(AAPP.7) devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/de…

  • Unscored —
    CVE-2018-18753

    Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF.

  • Unscored —
    CVE-2018-18751

    An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related…

    gettext gettext gettext Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-18744

    An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS_Main.php URI.

  • Unscored —
    CVE-2018-18735

    A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33.

  • Unscored —
    CVE-2018-18738

    An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Categories.php?pid=1&lgid=1 category_key parameter.

  • Unscored —
    CVE-2018-18742

    A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI.

  • Unscored —
    CVE-2018-18740

    An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.

  • Unscored —
    CVE-2018-18737

    An XXE issue was discovered in Douchat 4.0.4 because Data\notify.php calls simplexml_load_string. This can also be used…

  • Unscored —
    CVE-2018-18733

    An XSS issue was discovered in Catfish CMS 4.8.30, related to "write source code," a similar issue to CVE-2018-13999.

  • Unscored —
    CVE-2018-18749

    data-tools through 2017-07-26 has an Integer Overflow leading to an incorrect end value for the write_wchars function.

  • Unscored —
    CVE-2018-18734

    A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30.

  • Unscored —
    CVE-2018-18736

    An XSS issue was discovered in catfish blog 2.0.33, related to "write source code."

  • Unscored —
    CVE-2018-18745

    An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing.

  • Unscored —
    CVE-2018-18748

    Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powersh…

  • Unscored —
    CVE-2018-18739

    An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.

  • Unscored —
    CVE-2018-18741

    An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Download.php?lgid=1 during editing.

  • Unscored —
    CVE-2018-18743

    An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.

  • Unscored —
    CVE-2016-10732

    ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.p…

  • Unscored —
    CVE-2016-10734

    ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.

  • Unscored —
    CVE-2016-10733

    ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.