CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
51 CVE-2018-18765 125 DoS 2018-10-29 2018-12-07
6.4
None Remote Low Not required Partial None Partial
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
52 CVE-2018-18764 125 DoS 2018-10-29 2018-12-07
6.4
None Remote Low Not required Partial None Partial
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
53 CVE-2018-18754 522 2018-10-29 2019-10-02
5.0
None Remote Low Not required Partial None None
ZyXEL VMG3312-B10B 1.00(AAPP.7) devices have a backdoor root account with the [email protected]!Sr0O+ password hash in the etc/default.cfg file.
54 CVE-2018-18753 2018-10-29 2018-10-29
0.0
None ??? ??? ??? ??? ??? ???
Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF.
55 CVE-2018-18752 434 2018-10-29 2018-12-07
7.5
None Remote Low Not required Partial Partial Partial
Webiness Inventory 2.3 suffers from an Arbitrary File upload vulnerability via PHP code in the protected/library/ajax/WsSaveToModel.php logo parameter.
56 CVE-2018-18751 415 2018-10-29 2018-12-07
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
57 CVE-2018-18749 190 Overflow 2018-10-29 2018-12-17
4.3
None Remote Medium Not required None None Partial
data-tools through 2017-07-26 has an Integer Overflow leading to an incorrect end value for the write_wchars function.
58 CVE-2018-18748 2018-10-29 2018-11-09
0.0
None ??? ??? ??? ??? ??? ???
** DISPUTED ** Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE: the vendor disputes this issue because the observed behavior is consistent with the product's intended functionality.
59 CVE-2018-18745 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing.
60 CVE-2018-18744 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS_Main.php URI.
61 CVE-2018-18743 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.
62 CVE-2018-18742 352 CSRF 2018-10-29 2018-11-14
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI.
63 CVE-2018-18741 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Download.php?lgid=1 during editing.
64 CVE-2018-18740 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.
65 CVE-2018-18739 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.
66 CVE-2018-18738 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Categories.php?pid=1&lgid=1 category_key parameter.
67 CVE-2018-18737 611 2018-10-29 2018-12-11
5.0
None Remote Low Not required Partial None None
An XXE issue was discovered in Douchat 4.0.4 because Data\notify.php calls simplexml_load_string. This can also be used for SSRF.
68 CVE-2018-18736 79 XSS 2018-10-29 2018-12-07
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in catfish blog 2.0.33, related to "write source code."
69 CVE-2018-18735 352 CSRF 2018-10-29 2018-11-14
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33.
70 CVE-2018-18734 352 CSRF 2018-10-29 2018-11-13
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30.
71 CVE-2018-18733 79 XSS 2018-10-29 2018-12-07
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in Catfish CMS 4.8.30, related to "write source code," a similar issue to CVE-2018-13999.
72 CVE-2018-18732 Overflow 2018-10-29 2018-10-29
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'ntpServer' parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
73 CVE-2018-18731 Overflow 2018-10-29 2018-10-29
0.0
None ??? ??? ??? ??? ??? ???
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceMac' parameter for a post request, the value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
74 CVE-2018-18730 119 Overflow 2018-10-29 2018-12-14
7.8
None Remote Low Not required None None Complete
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request, each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
75 CVE-2018-18729 787 Overflow +Info 2018-10-29 2019-10-02
9.0
None Remote Low Not required Partial Partial Complete
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a heap-based buffer overflow vulnerability in the router's web server -- httpd. While processing the 'mac' parameter for a post request, the value is directly used in a strcpy to a variable placed on the heap, which can leak sensitive information or even hijack program control flow.
76 CVE-2018-18728 78 Exec Code 2018-10-29 2019-10-02
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. They allow remote code execution via shell metacharacters in the usbName field to the __fastcall function with a POST request.
77 CVE-2018-18727 119 Overflow 2018-10-29 2018-12-14
7.8
None Remote Low Not required None None Complete
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceList' parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
78 CVE-2018-18726 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5.
79 CVE-2018-18725 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in admin/banner/editbanner?id=20 in YUNUCMS 1.1.5.
80 CVE-2018-18724 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5.
81 CVE-2018-18723 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5.
82 CVE-2018-18722 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5.
83 CVE-2018-18721 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5.
84 CVE-2018-18720 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5.
85 CVE-2018-18718 415 2018-10-29 2018-12-07
4.6
None Local Low Not required Partial Partial Partial
An issue was discovered in gThumb through 3.6.2. There is a double-free vulnerability in the add_themes_from_dir method in dlg-contact-sheet.c because of two successive calls of g_free, each of which frees the same buffer.
86 CVE-2018-18717 79 XSS 2018-10-29 2018-12-10
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=[XSS] URI.
87 CVE-2018-18713 Dir. Trav. 2018-10-29 2018-10-29
0.0
None ??? ??? ??? ??? ??? ???
The function down_sql_action() in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=down_sql&name=../ URI.
88 CVE-2018-18712 352 CSRF 2018-10-29 2018-11-16
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1.
89 CVE-2018-18711 352 CSRF 2018-10-29 2018-11-16
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.
90 CVE-2018-18710 200 +Info 2018-10-29 2019-04-03
2.1
None Local Low Not required Partial None None
An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.
91 CVE-2018-18709 119 Overflow 2018-10-29 2018-12-14
7.8
None Remote Low Not required None None Complete
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "firewallEn" parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
92 CVE-2018-18708 119 Overflow 2018-10-29 2018-12-14
7.8
None Remote Low Not required None None Complete
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function "fromAddressNat" for a post request, the value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
93 CVE-2018-18707 119 Overflow 2018-10-29 2018-12-14
7.8
None Remote Low Not required None None Complete
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "ssid" parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
94 CVE-2018-18706 119 Overflow 2018-10-29 2018-12-14
7.8
None Remote Low Not required None None Complete
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function "fromDhcpListClient" for a request, it is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
95 CVE-2018-18705 89 Sql 2018-10-29 2018-12-04
7.5
None Remote Low Not required Partial Partial Partial
PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php.
96 CVE-2018-18704 89 Sql 2018-10-29 2018-12-04
7.5
None Remote Low Not required Partial Partial Partial
PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter.
97 CVE-2018-18703 22 Dir. Trav. Bypass 2018-10-29 2018-12-04
5.0
None Remote Low Not required Partial None None
PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal, bypassing the login page, as demonstrated by the Mailserver_filesystem/home.php coninb, consent, contrsh, condrft, or conspam parameter.
98 CVE-2018-18702 89 Sql 2018-10-29 2018-12-04
7.5
None Remote Low Not required Partial Partial Partial
spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, and used for database insertion.
99 CVE-2018-18701 835 2018-10-29 2019-10-02
4.3
None Remote Medium Not required None None Partial
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
100 CVE-2018-18700 835 2018-10-29 2019-10-02
4.3
None Remote Medium Not required None None Partial
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
Total number of vulnerabilities : 1473   Page : 1 2 (This Page)3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.