CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
2301 CVE-2018-19114 20 +Priv 2018-11-08 2019-10-02
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindoc_id value containing the relative pathname of this uploaded file. For example, the mindoc_id (aka session ID) could be of the form aa/../../uploads/blog/201811/attach_#.jpg where '#' is a hex value displayed in the upload field of a manage/blogs/edit/ screen.
2302 CVE-2018-19109 425 Bypass 2018-11-08 2019-10-02
6.5
None Remote Low Single system Partial Partial Partial
tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column.
2303 CVE-2018-19105 787 DoS 2018-11-08 2019-05-05
6.8
None Remote Medium Not required Partial Partial Partial
LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.
2304 CVE-2018-19104 352 CSRF 2018-11-08 2018-12-11
6.8
None Remote Medium Not required Partial Partial Partial
In BageCMS 3.1.3, upload/index.php has a CSRF vulnerability that can be used to upload arbitrary files and get server privileges.
2305 CVE-2018-19053 94 Exec Code 2018-11-07 2018-12-12
6.5
None Remote Low Single system Partial Partial Partial
PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statement, followed by a SELECT statement containing this PHP code.
2306 CVE-2018-19027 704 Exec Code 2019-01-30 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
2307 CVE-2018-19019 704 Exec Code 2019-01-22 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
2308 CVE-2018-19018 824 Exec Code 2019-02-12 2019-10-09
6.0
None Remote Medium Single system Partial Partial Partial
An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
2309 CVE-2018-19017 416 Exec Code 2019-01-22 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). When processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
2310 CVE-2018-19015 77 Exec Code 2019-01-28 2019-10-09
6.0
None Remote Medium Single system Partial Partial Partial
An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file. An attacker could exploit this to execute code under the privileges of the application.
2311 CVE-2018-19011 94 Exec Code 2019-01-22 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application.
2312 CVE-2018-19008 20 Exec Code 2019-02-13 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor wherein the application doesn't properly prevent the insertion of specially crafted files which could allow arbitrary code execution.
2313 CVE-2018-19005 20 Exec Code 2018-12-20 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing specially crafted POC files lacking user input validation. This may allow an attacker to read confidential information and remotely execute arbitrary code.
2314 CVE-2018-18993 119 Exec Code Overflow 2018-12-04 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior). When processing project files, the application allows input data to exceed the buffer. An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the application.
2315 CVE-2018-18992 74 Exec Code 2019-02-05 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server.
2316 CVE-2018-18989 416 Exec Code 2018-12-04 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
2317 CVE-2018-18987 502 Exec Code 2018-11-30 2018-12-27
6.8
None Remote Medium Not required Partial Partial Partial
VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without first checking for validity, allowing attacker supplied input to be written to known memory locations. This may cause the program to crash or allow remote code execution.
2318 CVE-2018-18983 119 Exec Code Overflow 2018-11-30 2018-12-27
6.8
None Remote Medium Not required Partial Partial Partial
VT-Designer Version 2.1.7.31 is vulnerable by the program reading the contents of a file (which is already in memory) into another heap-based buffer, which may cause the program to crash or allow remote code execution.
2319 CVE-2018-18982 89 Exec Code Sql 2018-11-27 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.
2320 CVE-2018-18942 20 Exec Code 2018-11-05 2019-01-14
6.5
None Remote Low Single system Partial Partial Partial
In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.
2321 CVE-2018-18936 22 Dir. Trav. 2018-11-05 2018-12-11
6.4
None Remote Low Not required None Partial Partial
An issue was discovered in PopojiCMS v2.0.1. admin_library.php allows remote attackers to delete arbitrary files via directory traversal in the po-admin/route.php?mod=library&act=delete id parameter.
2322 CVE-2018-18935 352 CSRF 2018-11-05 2018-12-10
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account.
2323 CVE-2018-18913 426 2019-03-21 2019-09-27
6.9
None Local Medium Not required Complete Complete Complete
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location within the system. The issue lies in the loading of the shcore.dll and dcomp.dll files: these files are being searched for by the program in the same system-wide directory where the HTML file is executed.
2324 CVE-2018-18891 287 2018-10-31 2018-12-03
6.4
None Remote Low Not required None Partial Partial
MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.
2325 CVE-2018-18881 254 DoS 2019-03-21 2019-04-03
6.8
None Remote Low Single system None None Complete
A Denial of Service (DOS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module 1.05 with firmware revision v1.05. An authenticated user can configure invalid network settings, stopping TCP based communications to the device. A physical factory reset is required to restore the device to an operational state.
2326 CVE-2018-18879 94 2019-06-18 2019-06-18
6.5
None Remote Low Single system Partial Partial Partial
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php.
2327 CVE-2018-18877 287 2019-06-18 2019-06-18
6.5
None Remote Low Single system Partial Partial Partial
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page config_main.php that allows manipulation of the device.
2328 CVE-2018-18873 476 2018-10-31 2019-08-09
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.
2329 CVE-2018-18862 425 2019-03-21 2019-10-02
6.5
None Remote Low Single system Partial Partial Partial
BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Details/Default+Admin+View/, AST%3AARServerConnection/Default+Admin+View/, and AR+System+Administration%3A+Server+Information/Default+Admin+View/.
2330 CVE-2018-18842 352 Exec Code CSRF 2018-10-30 2019-01-09
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code.
2331 CVE-2018-18820 119 DoS Exec Code Overflow 2018-11-05 2019-01-23
6.8
None Remote Medium Not required Partial Partial Partial
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.
2332 CVE-2018-18802 352 CSRF 2019-06-18 2019-06-18
6.8
None Remote Medium Not required Partial Partial Partial
The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod_users/controller.php?action=edit.
2333 CVE-2018-18799 352 CSRF 2018-11-16 2018-12-18
6.8
None Remote Medium Not required Partial Partial Partial
School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
2334 CVE-2018-18797 352 CSRF 2018-11-16 2018-12-18
6.8
None Remote Medium Not required Partial Partial Partial
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
2335 CVE-2018-18794 352 CSRF 2018-11-16 2018-12-18
6.8
None Remote Medium Not required Partial Partial Partial
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
2336 CVE-2018-18790 89 Sql 2018-10-29 2018-12-04
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in zzcms 8.3. SQL Injection exists in admin/special_add.php via a zxbigclassid cookie. (This needs an admin user login.)
2337 CVE-2018-18788 89 Sql 2018-10-29 2018-12-04
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. (This needs an admin user login.)
2338 CVE-2018-18784 89 Sql 2018-10-29 2018-12-04
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. (This needs an admin user login.)
2339 CVE-2018-18773 352 CSRF 2018-11-20 2018-11-29
6.8
None Remote Medium Not required Partial Partial Partial
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.
2340 CVE-2018-18772 352 CSRF 2018-11-20 2018-11-29
6.8
None Remote Medium Not required Partial Partial Partial
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.
2341 CVE-2018-18765 125 DoS 2018-10-29 2018-12-07
6.4
None Remote Low Not required Partial None Partial
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
2342 CVE-2018-18764 125 DoS 2018-10-29 2018-12-07
6.4
None Remote Low Not required Partial None Partial
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
2343 CVE-2018-18742 352 CSRF 2018-10-29 2018-11-14
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI.
2344 CVE-2018-18735 352 CSRF 2018-10-29 2018-11-14
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33.
2345 CVE-2018-18734 352 CSRF 2018-10-29 2018-11-13
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30.
2346 CVE-2018-18712 352 CSRF 2018-10-29 2018-11-16
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1.
2347 CVE-2018-18711 352 CSRF 2018-10-29 2018-11-16
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.
2348 CVE-2018-18699 787 2018-10-29 2018-12-06
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c.
2349 CVE-2018-18696 352 CSRF 2018-12-28 2019-05-15
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0?language=en_US) and disagrees that this issue is a vulnerability. They also claim that MicroStrategy was never properly informed of this issue via normal support channels or their vulnerability reporting page on their website, so they were unable to evaluate the report or explain how this is something their customers view as a feature and not a security vulnerability.
2350 CVE-2018-18646 918 2018-12-04 2018-12-27
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.