Skip to content
OpenAdvisories

Archive

26 November 2018

Vulnerabilities first published on this day (UTC), newest first.

← October 2018 2018 / November /26 December 2018 →
  1. 129
  2. 228
  3. 33
  4. 46
  5. 522
  6. 647
  7. 750
  8. 838
  9. 932
  10. 108
  11. 119
  12. 1243
  13. 1338
  14. 14157
  15. 1542
  16. 1639
  17. 1720
  18. 185
  19. 1910
  20. 2036
  21. 2115
  22. 2212
  23. 2313
  24. 241
  25. 253
  26. 2661
  27. 2796
  28. 2842
  29. 2944
  30. 3037
All Critical High Medium Low Exploited only Public exploit

61 results · Feed

  • Unscored —
    CVE-2018-19548

    index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginFor…

  • Unscored —
    CVE-2018-19547

    JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.

  • Unscored —
    CVE-2018-19552

    Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid[] request to Dynamiccontenttags.php.

  • Unscored —
    CVE-2018-19559

    CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter.

  • Unscored —
    CVE-2018-19561

    sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account.

  • Unscored —
    CVE-2018-19551

    Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttag…

  • Unscored —
    CVE-2018-19558

    An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because…

  • Unscored —
    CVE-2018-19557

    An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img…

  • Unscored —
    CVE-2018-19544

    JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.

  • Unscored —
    CVE-2018-19550 Public exploit

    Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit…

  • Unscored —
    CVE-2018-19542

    An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/j…

    jasper Ubuntu
  • Unscored —
    CVE-2018-19543

    An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode i…

    jasper Ubuntu
  • Unscored —
    CVE-2018-19537 Public exploit

    TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_h…

  • Unscored —
    CVE-2018-19540

    An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.1…

    jasper Ubuntu
  • Unscored —
    CVE-2018-19539

    An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/…

    jasper Ubuntu
  • Unscored —
    CVE-2018-19541

    An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.1…

    jasper Ubuntu
  • Unscored —
    CVE-2018-19532

    A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDo…

    libpodofo libpodofo podofo Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-19528

    TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafte…

  • Unscored —
    CVE-2018-19530

    HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function u…

  • Unscored —
    CVE-2018-19531

    HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function u…

  • Unscored —
    CVE-2018-19535

    In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (applic…

    exiv2 exiv2 Debian Ubuntu