Security Vulnerabilities Published In 2018(File Inclusion)

2018 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2018-1999009	200	Exec Code +Info File Inclusion	2018-07-23	2020-08-03	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.
2	CVE-2018-1000504	601	File Inclusion	2018-06-26	2018-09-04	9.0	None	Remote	Low	???	Complete	Complete	Complete
Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerability appears to have been fixed in 2.8.
3	CVE-2018-1000502	829	File Inclusion	2018-06-26	2019-10-03	6.5	None	Remote	Low	???	Partial	Partial	Partial
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. This attack appear to be exploitable via Must have access to admin panel. This vulnerability appears to have been fixed in 1.8.15.
4	CVE-2018-19789	434	Exec Code File Inclusion	2018-12-18	2019-05-10	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.
5	CVE-2018-19784	326	File Inclusion	2018-12-01	2019-10-03	5.0	None	Remote	Low	Not required	Partial	None	None
The str_rot_pass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, which makes it easier for attackers to calculate the authorization data needed for local file inclusion.
6	CVE-2018-19410		File Inclusion	2018-11-21	2019-10-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
7	CVE-2018-19246	200	+Info File Inclusion	2018-11-13	2018-12-13	5.0	None	Remote	Low	Not required	Partial	None	None
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.
8	CVE-2018-18323	22	Dir. Trav. File Inclusion	2018-10-15	2023-01-24	5.0	None	Remote	Low	Not required	Partial	None	None
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../ URI.
9	CVE-2018-17246	829	Exec Code File Inclusion	2018-12-20	2020-08-14	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
10	CVE-2018-15486	829	File Inclusion	2018-09-07	2019-10-03	6.4	None	Remote	Low	Not required	Partial	Partial	None
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka KONE-02.
11	CVE-2018-14573	22	Dir. Trav. File Inclusion	2018-07-23	2018-09-20	2.1	None	Local	Low	Not required	Partial	None	None
A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683.
12	CVE-2018-14429	22	Dir. Trav. File Inclusion	2018-08-14	2018-10-12	5.0	None	Remote	Low	Not required	Partial	None	None
man-cgi before 1.16 allows Local File Inclusion via absolute path traversal, as demonstrated by a cgi-bin/man-cgi?/etc/passwd URI.
13	CVE-2018-12712	20	File Inclusion	2018-06-26	2018-08-20	6.5	None	Remote	Low	???	Partial	Partial	Partial
An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion.
14	CVE-2018-12065	20	Exec Code File Inclusion	2018-06-08	2018-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files (execute PHP code) or read non-PHP files by replacing a helper.json file.
15	CVE-2018-12031	22	Dir. Trav. File Inclusion	2018-06-07	2018-07-27	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.
16	CVE-2018-11543	22	Dir. Trav. File Inclusion	2018-07-09	2018-09-12	5.0	None	Remote	Low	Not required	Partial	None	None
A Local File Inclusion (LFI) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the downloading of arbitrary files via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
17	CVE-2018-11222	20	File Inclusion	2018-06-16	2018-08-14	5.0	None	Remote	Low	Not required	Partial	None	None
Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.
18	CVE-2018-11101	79	Exec Code XSS File Inclusion	2018-05-17	2018-06-19	4.3	None	Remote	Medium	Not required	None	Partial	None
Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fails to sanitize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML message. Specifically the IMG and IFRAME elements can be used to include remote or local resources. For example, the use of an IFRAME element enables full code execution, allowing an attacker to download/upload files, information, etc. The SCRIPT element was also found to be injectable. On the Windows operating system, the CSP fails to prevent remote inclusion of resources via the SMB protocol. In this case, remote execution of JavaScript can be achieved by referencing the script on an SMB share within an IFRAME element, for example: <IFRAME src=\\DESKTOP-XXXXX\Temp\test.html> and then replying to it. The included JavaScript code is then executed automatically, without any interaction needed from the user. The vulnerability can be triggered in the Signal-Desktop client by sending a specially crafted message and then replying to it with any text or content in the reply (it doesn't matter).
19	CVE-2018-10759	89	Exec Code Sql File Inclusion	2018-05-16	2019-12-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter.
20	CVE-2018-10260	20	File Inclusion	2018-05-01	2018-06-13	6.5	None	Remote	Low	???	Partial	Partial	Partial
A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.
21	CVE-2018-10220	918	File Inclusion	2018-04-19	2018-05-24	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
DISPUTED Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/handlers/emulators/rfi.py supports Remote File Inclusion emulation.
22	CVE-2018-8711	20	File Inclusion	2018-03-14	2018-04-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
23	CVE-2018-7997	79	XSS File Inclusion	2018-03-09	2018-03-27	4.3	None	Remote	Medium	Not required	None	Partial	None
Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript.
24	CVE-2018-7422	22	Dir. Trav. File Inclusion	2018-03-19	2020-08-24	5.0	None	Remote	Low	Not required	Partial	None	None
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
25	CVE-2018-0610	269	Exec Code +Info File Inclusion	2018-06-26	2019-10-03	6.5	None	Remote	Low	???	Partial	Partial	Partial
Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information.
26	CVE-2018-0013	200	+Info File Inclusion	2018-01-10	2019-10-09	4.0	None	Remote	Low	???	Partial	None	None
A local file inclusion vulnerability in Juniper Networks Junos Space Network Management Platform may allow an authenticated user to retrieve files from the system.
27	CVE-2017-1000454	74	File Inclusion	2018-01-02	2018-01-16	4.6	None	Local	Low	Not required	Partial	Partial	Partial
CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
28	CVE-2017-18354	22	Dir. Trav. File Inclusion	2018-12-17	2019-01-04	5.0	None	Remote	Low	Not required	Partial	None	None
Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote attacker.
29	CVE-2017-14095	829	Exec Code File Inclusion	2018-01-19	2019-10-09	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable system.
30	CVE-2017-0370	20	File Inclusion	2018-04-13	2018-05-14	5.0	None	Remote	Low	Not required	None	Partial	None
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.
31	CVE-2016-9483	502	File Inclusion	2018-07-13	2019-10-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obtain files from the server.

Total number of vulnerabilities : 31 Page : 1 (This Page)