CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In November 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
801 CVE-2018-19220 94 Exec Code 2018-11-12 2018-12-11
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI.
802 CVE-2018-19221 89 Sql 2018-11-12 2018-12-11
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter.
803 CVE-2018-19222 79 XSS 2018-11-12 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysql_hy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists.
804 CVE-2018-19223 79 XSS 2018-11-12 2018-12-11
3.5
None Remote Medium ??? None Partial None
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI.
805 CVE-2018-19224 565 2018-11-12 2020-08-24
5.0
None Remote Low Not required None Partial None
An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.
806 CVE-2018-19225 352 CSRF 2018-11-12 2018-12-11
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in LAOBANCMS 2.0. admin/mima.php has CSRF.
807 CVE-2018-19226 200 +Info 2018-11-12 2018-12-11
5.0
None Remote Low Not required Partial None None
An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to list .txt files via a direct request for the /data/0/admin.txt URI.
808 CVE-2018-19227 79 XSS 2018-11-12 2018-12-11
3.5
None Remote Medium ??? None Partial None
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/liuyan.php neirong[] parameter.
809 CVE-2018-19228 22 Dir. Trav. 2018-11-12 2018-12-11
6.4
None Remote Low Not required None Partial Partial
An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter, as demonstrated by deleting install/install.txt to permit a reinstallation.
810 CVE-2018-19229 79 XSS 2018-11-12 2018-12-11
3.5
None Remote Medium ??? None Partial None
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter.
811 CVE-2018-19244 611 +Info 2018-11-13 2019-02-01
5.0
None Remote Low Not required Partial None None
An XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked.
812 CVE-2018-19246 200 +Info File Inclusion 2018-11-13 2018-12-13
5.0
None Remote Low Not required Partial None None
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.
813 CVE-2018-19271 89 Sql 2018-11-14 2019-07-30
6.5
None Remote Low ??? Partial Partial Partial
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.
814 CVE-2018-19274 502 Exec Code 2018-11-17 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.
815 CVE-2018-19277 91 Bypass 2018-11-14 2022-04-18
6.8
None Remote Medium Not required Partial Partial Partial
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
816 CVE-2018-19278 119 Overflow 2018-11-14 2018-12-30
5.0
None Remote Low Not required None None Partial
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.
817 CVE-2018-19279 312 2018-11-14 2019-10-03
2.1
None Local Low Not required Partial None None
PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater.
818 CVE-2018-19280 79 XSS 2018-11-14 2019-07-30
4.3
None Remote Medium Not required None Partial None
Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
819 CVE-2018-19281 89 Sql 2018-11-14 2019-07-30
7.5
None Remote Low Not required Partial Partial Partial
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
820 CVE-2018-19286 79 XSS 2018-11-15 2020-06-25
4.3
None Remote Medium Not required None Partial None
The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and then creating and sharing a note.
821 CVE-2018-19287 79 XSS 2018-11-15 2018-12-14
4.3
None Remote Medium Not required None Partial None
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
822 CVE-2018-19288 79 XSS 2018-11-15 2021-05-04
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
823 CVE-2018-19289 79 XSS 2018-11-15 2020-08-24
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
824 CVE-2018-19290 78 DoS 2018-11-30 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack against the PHP daemon with a crafted command, resulting in a denial of service or possibly unspecified other impact, as demonstrated by the "!calc 5 x 5" command. In versions before 3.0, modules/HELPBOT_MODULE/calc.php has the vulnerable code; in 3.0 and above, modules/HELPBOT_MODULE/HelpbotController.class.php has the vulnerable code.
825 CVE-2018-19291 352 CSRF 2018-11-15 2019-04-16
5.8
None Remote Medium Not required None Partial Partial
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI.
826 CVE-2018-19296 502 2018-11-16 2021-05-21
6.8
None Remote Medium Not required Partial Partial Partial
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
827 CVE-2018-19301 79 XSS 2018-11-15 2018-12-31
4.3
None Remote Medium Not required None Partial None
tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.
828 CVE-2018-19311 79 XSS 2018-11-16 2019-07-30
3.5
None Remote Medium ??? None Partial None
Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
829 CVE-2018-19312 89 Sql 2018-11-16 2019-07-30
6.5
None Remote Low ??? Partial Partial Partial
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
830 CVE-2018-19318 352 CSRF 2018-11-16 2018-12-17
6.8
None Remote Medium Not required Partial Partial Partial
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.
831 CVE-2018-19319 352 CSRF 2018-11-16 2018-12-17
4.3
None Remote Medium Not required None Partial None
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges.
832 CVE-2018-19324 79 XSS 2018-11-17 2018-12-17
3.5
None Remote Medium ??? None Partial None
kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.
833 CVE-2018-19326 22 Dir. Trav. 2018-11-17 2018-12-17
5.0
None Remote Low Not required Partial None None
Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd.
834 CVE-2018-19327 352 CSRF 2018-11-17 2018-12-18
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in JTBC(PHP) 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF.
835 CVE-2018-19328 22 Dir. Trav. 2018-11-17 2020-05-07
7.5
None Remote Low Not required Partial Partial Partial
LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal.
836 CVE-2018-19329 22 Dir. Trav. 2018-11-17 2020-08-24
5.5
None Remote Low ??? None Partial Partial
GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button.
837 CVE-2018-19331 89 Sql 2018-11-17 2018-12-18
5.0
None Remote Low Not required Partial None None
An issue was discovered in S-CMS v1.5. There is a SQL injection vulnerability in search.php via the keyword parameter.
838 CVE-2018-19332 352 CSRF 2018-11-17 2018-12-18
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI.
839 CVE-2018-19333 2018-11-17 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in processes running as root (but not escape the sandbox) via vectors involving IPC_RMID shmctl calls, because reference counting is mishandled.
840 CVE-2018-19334 352 +Info CSRF 2018-11-20 2018-12-18
4.3
None Remote Medium Not required Partial None None
Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.
841 CVE-2018-19335 352 +Info CSRF 2018-11-20 2020-08-24
2.6
None Remote High Not required Partial None None
Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.
842 CVE-2018-19340 79 XSS 2018-11-17 2018-12-17
4.3
None Remote Medium Not required None Partial None
Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCountry, Freight, or details parameter.
843 CVE-2018-19341 125 DoS +Info 2018-11-17 2018-12-18
5.8
None Remote Medium Not required Partial None Partial
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader!std::basic_ostream >::operator<<+0x0000000000087906" issue.
844 CVE-2018-19342 125 DoS +Info 2018-11-17 2018-12-18
5.8
None Remote Medium Not required Partial None Partial
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at U3DBrowser+0x000000000000347a" issue.
845 CVE-2018-19343 125 DoS +Info 2018-11-17 2018-12-18
5.8
None Remote Medium Not required Partial None Partial
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faulting Address controls Code Flow starting at U3DBrowser!PlugInMain+0x00000000000f43ff" issue.
846 CVE-2018-19344 125 DoS +Info 2018-11-17 2018-12-18
5.8
None Remote Medium Not required Partial None Partial
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address may be used as a return value starting at U3DBrowser!PlugInMain+0x0000000000031a75" issue.
847 CVE-2018-19345 125 DoS +Info 2018-11-17 2018-12-18
5.8
None Remote Medium Not required Partial None Partial
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at U3DBrowser!PlugInMain+0x0000000000053f8b" issue.
848 CVE-2018-19346 125 DoS +Info 2018-11-17 2018-12-18
5.8
None Remote Medium Not required Partial None Partial
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x00000000000d11ea" issue.
849 CVE-2018-19347 125 DoS +Info 2018-11-17 2018-12-27
5.8
None Remote Medium Not required Partial None Partial
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x00000000000d11bb" issue.
850 CVE-2018-19348 125 DoS +Info 2018-11-17 2018-12-18
5.8
None Remote Medium Not required Partial None Partial
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x000000000012dff5" issue.
Total number of vulnerabilities : 984   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 (This Page)18 19 20
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.