CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2018-17004 20 2018-09-13 2018-10-30
4.0
None Remote Low Single system None None Partial
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wlan_access name.
252 CVE-2018-17003 79 XSS 2018-09-21 2018-11-09
4.3
None Remote Medium Not required None Partial None
In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert.
253 CVE-2018-17002 79 XSS 2018-09-21 2018-11-09
4.3
None Remote Medium Not required None Partial None
On the RICOH MP 2001 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
254 CVE-2018-17001 79 XSS 2018-09-21 2018-11-09
4.3
None Remote Medium Not required None Partial None
On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
255 CVE-2018-17000 476 2018-09-13 2019-04-05
4.3
None Remote Medium Not required None None Partial
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
256 CVE-2018-16999 787 DoS 2018-09-13 2018-11-15
4.3
None Remote Medium Not required None None Partial
Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to cause a denial of service via a crafted input file.
257 CVE-2018-16987 522 2018-09-13 2019-10-02
4.0
None Remote Low Single system Partial None None
Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code.
258 CVE-2018-16985 125 DoS 2018-09-13 2018-11-27
5.0
None Remote Low Not required None None Partial
In Lizard (formerly LZ5) 2.0, use of an invalid memory address was discovered in LZ5_compress_continue in lz5_compress.c, related to LZ5_compress_fastSmall and MEM_read32. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
259 CVE-2018-16983 Bypass 2018-09-13 2019-10-02
7.5
None Remote Low Not required Partial Partial Partial
NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type value.
260 CVE-2018-16982 125 DoS 2018-09-12 2018-11-29
4.3
None Remote Medium Not required None None Partial
Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.
261 CVE-2018-16981 119 Overflow 2018-09-12 2018-11-02
6.8
None Remote Medium Not required Partial Partial Partial
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
262 CVE-2018-16980 79 XSS 2018-09-12 2018-11-02
4.3
None Remote Medium Not required None Partial None
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters.
263 CVE-2018-16979 113 2018-09-12 2018-10-31
5.8
None Remote Medium Not required Partial Partial None
Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.
264 CVE-2018-16978 79 XSS 2018-09-12 2018-10-31
4.3
None Remote Medium Not required None Partial None
Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473.
265 CVE-2018-16977 200 +Info 2018-09-12 2018-10-31
5.0
None Remote Low Not required Partial None None
Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php.
266 CVE-2018-16976 362 2018-09-12 2019-10-02
5.5
None Remote Low Single system Partial Partial None
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.
267 CVE-2018-16975 20 Exec Code 2018-09-12 2018-11-19
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input validation in apps/designer/handlers/csspreview.php.
268 CVE-2018-16974 434 Exec Code Bypass 2018-09-12 2018-11-19
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters (for bypassing the blacklist).
269 CVE-2018-16971 200 +Info 2018-09-12 2018-11-21
4.0
None Remote Low Single system Partial None None
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-purchased course contents (quiz / test) via a modified id parameter.
270 CVE-2018-16970 538 2018-09-12 2018-11-21
4.0
None Remote Low Single system Partial None None
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter.
271 CVE-2018-16969 200 +Info 2018-09-26 2018-11-23
4.0
None Remote Low Single system Partial None None
Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message.
272 CVE-2018-16968 22 Dir. Trav. 2018-09-26 2018-11-23
3.5
None Remote Medium Single system None Partial None
Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal.
273 CVE-2018-16965 79 XSS 2018-09-21 2018-11-09
4.3
None Remote Medium Not required None Partial None
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.
274 CVE-2018-16962 123 2018-09-12 2018-11-28
7.2
None Local Low Not required Complete Complete Complete
Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.
275 CVE-2018-16959 200 +Info 2018-09-17 2018-12-06
5.0
None Remote Low Not required Partial None None
An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecure default User Profile community configuration that allows anonymous users to retrieve the account names of all portal users via /portal/server.pt/user/user/ requests. When WCI is synchronised with Active Directory (AD), this vulnerability can expose the account names of all AD users. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
276 CVE-2018-16958 732 2018-09-17 2019-10-02
5.8
None Remote Medium Not required Partial Partial None
An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NET_SessionID primary session cookie, when Internet Information Services (IIS) with ASP.NET is used, is not protected with the HttpOnly attribute. The attribute cannot be enabled by customers. Consequently, this cookie is exposed to session hijacking attacks should an adversary be able to execute JavaScript in the origin of the portal installation. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
277 CVE-2018-16957 798 2018-09-17 2018-12-06
10.0
None Remote Low Not required Complete Complete Complete
The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. Authentication to the Oracle WCI search service uses this hardcoded password and cannot be customised by customers. An adversary able to access this service over a network could perform search queries to extract large quantities of sensitive information from the WCI installation. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
278 CVE-2018-16956 20 DoS 2018-09-17 2018-12-06
4.0
None Remote Low Single system None None Partial
The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be renamed to include characters unsupported for URIs by the web server hosting the WCI Portal software (such as IIS). Renaming pages to include unsupported characters, such as 0x7f, prevents these pages from being accessed over the web server, causing a Denial of Service (DoS) to the page. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
279 CVE-2018-16955 79 XSS 2018-09-17 2018-11-09
4.3
None Remote Medium Not required None Partial None
The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). The content of the in_hi_redirect parameter, when prefixed with the https:// scheme, is unsafely reflected in a HTML META tag in the HTTP response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
280 CVE-2018-16954 601 2018-09-17 2018-12-13
5.8
None Remote Medium Not required Partial Partial None
An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The login function of the portal is vulnerable to insecure redirection (also called an open redirect). The in_hi_redirect parameter is not validated by the application after a successful login. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
281 CVE-2018-16953 79 XSS 2018-09-17 2018-11-09
4.3
None Remote Medium Not required None Partial None
The AjaxView::DisplayResponse() function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
282 CVE-2018-16952 352 CSRF 2018-09-17 2018-12-07
6.8
None Remote Medium Not required Partial Partial Partial
The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal user's password). NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
283 CVE-2018-16951 352 Exec Code CSRF 2018-09-11 2018-11-02
6.0
None Remote Medium Single system Partial Partial Partial
xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832.
284 CVE-2018-16950 20 DoS 2018-09-11 2018-11-27
3.3
None Local Network Low Not required None None Partial
Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.
285 CVE-2018-16949 400 2018-09-11 2019-01-02
5.0
None Remote Low Not required None None Partial
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.
286 CVE-2018-16948 200 +Info 2018-09-11 2018-11-19
5.0
None Remote Low Not required Partial None None
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.
287 CVE-2018-16947 287 2018-09-11 2019-10-02
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.
288 CVE-2018-16946 552 2018-09-11 2019-10-02
5.0
None Remote Low Not required Partial None None
LG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) files and download backup files (via download.php) without authenticating. These backup files contain user credentials and configuration information for the camera device. An attacker is able to discover the backup filename via reading the system logs or report data, or just by brute-forcing the backup filename pattern. It may be possible to authenticate to the admin account with the admin password.
289 CVE-2018-16836 22 Dir. Trav. 2018-09-11 2019-01-08
7.5
None Remote Low Not required Partial Partial Partial
Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.
290 CVE-2018-16833 79 XSS 2018-09-21 2018-11-09
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI.
291 CVE-2018-16832 352 CSRF 2018-09-11 2018-12-19
4.3
None Remote Medium Not required None Partial None
CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header.
292 CVE-2018-16831 22 Dir. Trav. Bypass 2018-09-11 2018-11-16
7.1
None Remote Medium Not required Complete None None
Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statement.
293 CVE-2018-16822 89 Sql 2018-09-21 2018-11-07
7.5
None Remote Low Not required Partial Partial Partial
SeaCMS 6.64 allows SQL Injection via the upload/admin/admin_video.php order parameter.
294 CVE-2018-16821 434 2018-09-21 2018-11-27
5.0
None Remote Low Not required Partial None None
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admin_template.php?path=../templets/../../ requests.
295 CVE-2018-16820 22 Dir. Trav. 2018-09-18 2018-11-07
5.0
None Remote Low Not required Partial None None
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests.
296 CVE-2018-16819 22 Dir. Trav. 2018-09-18 2018-11-19
5.5
None Remote Low Single system None Partial Partial
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests.
297 CVE-2018-16807 772 2018-09-10 2019-10-02
5.0
None Remote Low Not required None None Partial
In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol parser.
298 CVE-2018-16806 327 2018-09-10 2019-10-02
3.3
None Local Network Low Not required None Partial None
A Pektron Passive Keyless Entry and Start (PKES) system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipher, which makes it easier for attackers to obtain access via an approach involving a 5.4 TB precomputation, followed by wake-frame reception and two challenge/response operations, to clone a key fob within a few seconds.
299 CVE-2018-16805 79 XSS 2018-09-10 2018-11-09
3.5
None Remote Medium Single system None Partial None
In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator.
300 CVE-2018-16802 Exec Code 2018-09-10 2019-10-02
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.
Total number of vulnerabilities : 1171   Page : 1 2 3 4 5 6 (This Page)7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.