Skip to content
OpenAdvisories

Archive

27 December 2018

Vulnerabilities first published on this day (UTC), newest first.

← November 2018 2018 / December /27 January 2019 →
  1. 18
  2. 21
  3. 354
  4. 480
  5. 530
  6. 675
  7. 757
  8. 88
  9. 93
  10. 1032
  11. 1153
  12. 1281
  13. 1356
  14. 1421
  15. 152
  16. 16 
  17. 1778
  18. 1819
  19. 1931
  20. 20136
  21. 2130
  22. 2214
  23. 2340
  24. 2441
  25. 2526
  26. 2633
  27. 2711
  28. 2882
  29. 29 
  30. 3029
  31. 3134
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • Unscored —
    CVE-2018-1000889

    Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loadin…

  • Unscored —
    CVE-2018-1000890

    FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachm…

  • Unscored —
    CVE-2018-1000887

    Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an aut…

  • High 8.8
    CVE-2018-1000888 Public exploit EPSS 19%

    Archive_Tar contains Potential RCE if filename starts with phar://

    PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…

    drupal7 php-pear php-pear pear/archive_tar Debian Ubuntu Alpine Packagist
  • Unscored —
    CVE-2018-20528

    JEECMS 9 has SSRF via the ueditor/getRemoteImage.jspx upfile parameter.

  • Unscored —
    CVE-2018-20530

    PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CV…

  • Unscored —
    CVE-2018-20524

    The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message, because a danmuWrapper DI…

  • Unscored —
    CVE-2018-20520

    MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.

  • Unscored —
    CVE-2018-20519

    An issue was discovered in 74cms v4.2.111. It allows remote authenticated users to read or modify arbitrary resumes by …

  • Unscored —
    CVE-2018-20511

    An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c a…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2018-20508

    CrashFix 1.0.4 has SQL Injection via the User[status] parameter. This is related to actionIndex in UserController.php, …