Skip to content
OpenAdvisories

Archive

22 November 2018

Vulnerabilities first published on this day (UTC), newest first.

← October 2018 2018 / November /22 December 2018 →
  1. 129
  2. 228
  3. 33
  4. 46
  5. 522
  6. 647
  7. 750
  8. 838
  9. 932
  10. 108
  11. 119
  12. 1243
  13. 1338
  14. 14157
  15. 1542
  16. 1639
  17. 1720
  18. 185
  19. 1910
  20. 2036
  21. 2115
  22. 2212
  23. 2313
  24. 241
  25. 253
  26. 2661
  27. 2796
  28. 2842
  29. 2944
  30. 3037
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Unscored —
    CVE-2018-19464

    Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishan…

  • Unscored —
    CVE-2018-19463

    zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by u…

  • Unscored —
    CVE-2018-19457

    Logicspice FAQ Script 2.9.7 allows uploading arbitrary files, which leads to remote command execution via admin/faqs/fa…

  • Unscored —
    CVE-2018-19459 Public exploit

    Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.

  • High 7.5
    CVE-2018-19458 Public exploit Scanner template EPSS 33%

    Unauthenticated File Read in PHP Proxy

    In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.

    athlon1600/php-proxy-app Packagist
  • Medium 5.9
    CVE-2018-19443

    Session Fixation in Tryton

    The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. T…

    tryton tryton-client Ubuntu PyPI
  • Unscored —
    CVE-2018-19434

    An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15…

  • Unscored —
    CVE-2018-19435

    An issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parame…

  • Unscored —
    CVE-2018-19433

    ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value.

  • Unscored —
    CVE-2018-19432

    An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function sf_write_int in sndfi…

    libsndfile libsndfile Debian Ubuntu
  • Unscored —
    CVE-2018-19437

    UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash]…

  • Unscored —
    CVE-2018-19436

    An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Inject…