15 January 2019

60 results · Feed

• Unscored —
  CVE-2018-20719

  In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history …

  Jan 15, 2019
• Unscored —
  CVE-2018-20714

  The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vul…

  Jan 15, 2019
• Unscored —
  CVE-2018-20715

  The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to th…

  Jan 15, 2019
• Unscored —
  CVE-2018-20716

  CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature.

  Jan 15, 2019
• High 8.8
  CVE-2018-20713

  Shopware SQL Injection

  Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.

  shopware/shopware Packagist
  Jan 15, 2019
• High 8.8
  CVE-2018-20717

  PrestaShop PHP Object Injection

  In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process …

  prestashop/prestashop Packagist
  Jan 15, 2019
• Unscored —
  CVE-2017-18358

  LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email addres…

  Jan 15, 2019
• Unscored —
  CVE-2017-18356

  In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the targ…

  Jan 15, 2019
• Medium 6.5
  CVE-2017-18357 Public exploit EPSS 27%

  Shopware XXE Vulnerability

  Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.

  shopware/shopware Packagist
  Jan 15, 2019
• Medium 4.1
  CVE-2019-3811

  A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root…

  The sssd Project sssd sssd sssd Debian Ubuntu
  Jan 15, 2019
• Unscored —
  CVE-2019-6295

  Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter.

  Jan 15, 2019
• Unscored —
  CVE-2019-6294

  An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/c…

  Jan 15, 2019
• Unscored —
  CVE-2019-6296

  Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter.

  Jan 15, 2019
• Unscored —
  CVE-2019-6289

  uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by…

  Jan 15, 2019
• Unscored —
  CVE-2018-20712

  A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed i…

  binutils libiberty binutils binutils-avr Debian Ubuntu Alpine
  Jan 15, 2019
• Unscored —
  CVE-2019-6290

  An infinite recursion issue was discovered in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exha…

  nasm nasm Debian Ubuntu
  Jan 15, 2019
• Unscored —
  CVE-2019-6293

  An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion pr…

  flex flex flex Debian Ubuntu Azure Linux
  Jan 15, 2019
• Unscored —
  CVE-2019-6291

  An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack e…

  nasm nasm Debian Ubuntu
  Jan 15, 2019
• Unscored —
  CVE-2019-6292

  An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::Si…

  yaml-cpp yaml-cpp yaml-cpp0.3 yaml-cpp Debian Ubuntu Azure Linux
  Jan 15, 2019
• Unscored —
  CVE-2019-6267

  The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mish…

  Jan 15, 2019