deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-19434
Published: 2018-11-22
Description: An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind SQL injection via the AmtClear_ parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/eddietcc/CVEnotes/tree/master/webERP_4.15_BankMatching; https://github.com/eddietcc/CVEnotes/tree/master/webERP_4.15_BankMatching
CVE: CVE-2018-19435
Published: 2018-11-22
Description: An issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/0xUhaw/CVE-Bins/tree/master/webERP%20SQLI-1; https://github.com/0xUhaw/CVE-Bins/tree/master/webERP%20SQLI-1
CVE: CVE-2018-19436
Published: 2018-11-22
Description: An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/0xUhaw/CVE-Bins/tree/master/webERP%20SQLI-2; https://github.com/0xUhaw/CVE-Bins/tree/master/webERP%20SQLI-2
CVE: CVE-2018-19437
Published: 2018-11-22
Description: UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty.
CVSS Score: 8.8 (HIGH)
References: https://github.com/wwwws1234/ucms/blob/master/Vertical%20crossing%20power.md; https://github.com/wwwws1234/ucms/blob/master/Vertical%20crossing%20power.md
CVE: CVE-2018-19443
Published: 2018-11-22
Description: The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384
References: https://bugs.tryton.org/issue7792; https://discuss.tryton.org/t/security-release-for-issue7792/830; https://bugs.tryton.org/issue7792
CVE: CVE-2018-19457
Published: 2018-11-22
Description: Logicspice FAQ Script 2.9.7 allows uploading arbitrary files, which leads to remote command execution via admin/faqs/faqimages with a .php file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://pentest.com.tr/exploits/Logicspice-FAQ-Script-2-9-7-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/45326/; https://pentest.com.tr/exploits/Logicspice-FAQ-Script-2-9-7-Remote-Code-Execution.html
CVE: CVE-2018-19458
Published: 2018-11-22
Description: In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://pentest.com.tr/exploits/PHP-Proxy-3-0-3-Local-File-Inclusion.html; https://www.exploit-db.com/exploits/45780/; https://pentest.com.tr/exploits/PHP-Proxy-3-0-3-Local-File-Inclusion.html
CVE: CVE-2018-19459
Published: 2018-11-22
Description: Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://pentest.com.tr/exploits/Adult-Filter-1-0-Buffer-Overflow-SEH.html; https://www.exploit-db.com/exploits/45687/; https://pentest.com.tr/exploits/Adult-Filter-1-0-Buffer-Overflow-SEH.html
CVE: CVE-2018-19463
Published: 2018-11-22
Description: zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zb_system/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP by uploading an image in current version." It also requires authentication
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/novysodope/Z-BlogPHP1.5Zero/blob/master/Getshell; https://github.com/zblogcn/zblogphp/issues/205; https://github.com/novysodope/Z-BlogPHP1.5Zero/blob/master/Getshell
CVE: CVE-2018-19464
Published: 2018-11-22
Description: Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/novysodope/Discuz-X3.4/blob/master/XSS; https://github.com/novysodope/Discuz-X3.4/blob/master/XSS
CVE: CVE-2018-19468
Published: 2018-11-23
Description: HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=act_login URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.iwantacve.cn/index.php/archives/83/; http://www.iwantacve.cn/index.php/archives/83/
CVE: CVE-2018-19469
Published: 2018-11-23
Description: ArticleCMS through 2017-02-19 has XSS via the /update_personal_infomation realname or email parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/woider/ArticleCMS/issues/5; https://github.com/woider/ArticleCMS/issues/5
CVE: CVE-2018-19475
Published: 2018-11-23
Description: psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.
CVSS Score: 7.8 (HIGH)
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3005fcb9bb160af199e761e03bc70a9f249a987e; http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=aeea342904978c9fe17d85f4906a0f6fcce2d315; http://www.securityfocus.com/bid/106154
CVE: CVE-2018-19476
Published: 2018-11-23
Description: psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=67d760ab775dae4efe803b5944b0439aa3c0b04a; http://git.ghostscript.com/?p=ghostpdl.git%3Bh=434753adbe8be5534bfb9b7d91746023e8073d16; http://www.securityfocus.com/bid/106154
CVE: CVE-2018-19477
Published: 2018-11-23
Description: psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=ef252e7dc214bcbd9a2539216aab[PII_REDACTED]bb; http://git.ghostscript.com/?p=ghostpdl.git%3Bh=606a22e77e7f081781e99e44644cd0119f559e03; http://www.securityfocus.com/bid/106154
CVE: CVE-2018-19486
Published: 2018-11-23
Description: Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-426
References: http://www.securityfocus.com/bid/106020; http://www.securitytracker.com/id/1042166; https://access.redhat.com/errata/RHSA-2018:3800
CVE: CVE-2018-19490
Published: 2018-11-23
Description: An issue was discovered in datafile.c in Gnuplot 5.2.5. This issue allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in df_generate_ascii_array_entry. To exploit this vulnerability, an attacker must pass an overlong string as the right bound of the range argument that is passed to the plot function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.html; https://lists.debian.org/debian-lts-announce/2018/11/msg00031.html; https://lists.debian.org/debian-lts-announce/2018/11/msg00035.html
CVE: CVE-2018-19491
Published: 2018-11-23
Description: An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.html; https://lists.debian.org/debian-lts-announce/2018/11/msg00031.html; https://lists.debian.org/debian-lts-announce/2018/11/msg00035.html
CVE: CVE-2018-19492
Published: 2018-11-23
Description: An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00066.html; https://lists.debian.org/debian-lts-announce/2018/11/msg00031.html; https://lists.debian.org/debian-lts-announce/2018/11/msg00035.html
CVE: CVE-2018-19499
Published: 2018-11-23
Description: Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the Gdn_Format class.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://hackerone.com/reports/407552; https://hackerone.com/reports/407552
CVE: CVE-2018-19502
Published: 2018-11-23
Description: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a heap-based buffer overflow in the function excluded_channels() in libfaad/syntax.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/TeamSeri0us/pocs/tree/master/faad; https://lists.debian.org/debian-lts-announce/2019/08/msg00033.html; https://seclists.org/bugtraq/2019/Sep/28
CVE: CVE-2018-19503
Published: 2018-11-23
Description: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There was a stack-based buffer overflow in the function calculate_gain() in libfaad/sbr_hfadj.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/TeamSeri0us/pocs/tree/master/faad; https://seclists.org/bugtraq/2019/Sep/28; https://security.gentoo.org/glsa/202006-17
CVE: CVE-2018-19504
Published: 2018-11-23
Description: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.1. There is a NULL pointer dereference in ifilter_bank() in libfaad/filtbank.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-476
References: https://github.com/TeamSeri0us/pocs/tree/master/faad; https://seclists.org/bugtraq/2019/Sep/28; https://security.gentoo.org/glsa/202006-17
CVE: CVE-2018-19517
Published: 2018-11-24
Description: An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/sysstat/sysstat/issues/199; https://github.com/sysstat/sysstat/issues/199
CVE: CVE-2018-19518
Published: 2018-11-25
Description: University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-88
References: http://www.securityfocus.com/bid/106018; http://www.securitytracker.com/id/1042157; https://antichat.com/threads/463395/#post-4254681
CVE: CVE-2018-19519
Published: 2018-11-25
Description: In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-909
References: http://www.securityfocus.com/bid/106098; https://access.redhat.com/errata/RHSA-2019:3976; https://github.com/zyingp/temp/blob/master/tcpdump.md
CVE: CVE-2018-19520
Published: 2018-11-25
Description: An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad function in an attempt to block certain PHP functions such as eval, but does not prevent use of preg_replace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://blog.whiterabbitxyj.com/cve/SDCMS_1.6_code_execution.doc; https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/cve/SDCMS_1.6_code_execution.doc; https://blog.whiterabbitxyj.com/cve/SDCMS_1.6_code_execution.doc
CVE: CVE-2018-19528
Published: 2018-11-26
Description: TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafted DNS packets to port 53/udp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/dns_request_buff_overflow/README.md; https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/dns_request_buff_overflow/README.md
CVE: CVE-2018-19530
Published: 2018-11-26
Description: HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function uses XStream unsafely when configured with an xml.codec=httl.spi.codecs.XstreamCodec setting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/httl/httl/issues/225; https://github.com/httl/httl/issues/225
CVE: CVE-2018-19531
Published: 2018-11-26
Description: HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEncoder unsafely when configured without an xml.codec= setting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/httl/httl/issues/224; https://github.com/httl/httl/issues/224
CVE: CVE-2018-19532
Published: 2018-11-26
Description: A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose. It allows an attacker to cause Denial of Service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-pdftranslatorsettarget-podofo-0-9-6/; https://sourceforge.net/p/podofo/tickets/32/; https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-pdftranslatorsettarget-podofo-0-9-6/
CVE: CVE-2018-19535
Published: 2018-11-26
Description: In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/428; https://github.com/Exiv2/exiv2/pull/430
CVE: CVE-2018-19537
Published: 2018-11-26
Description: TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_hostname line of a configuration file that is encrypted with the 478DA50BF9E3D2CF key and uploaded through the web GUI by using the web admin account. The default password of admin may be used in some cases.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/JackDoan/TP-Link-ArcherC5-RCE; https://github.com/JackDoan/TP-Link-ArcherC5-RCE
CVE: CVE-2018-19539
Published: 2018-11-26
Description: An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html; https://github.com/mdadams/jasper/issues/182; https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html
CVE: CVE-2018-19540
Published: 2018-11-26
Description: An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00025.html; https://github.com/mdadams/jasper/issues/182
CVE: CVE-2018-19541
Published: 2018-11-26
Description: An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00025.html; https://github.com/mdadams/jasper/issues/182
CVE: CVE-2018-19542
Published: 2018-11-26
Description: An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html; https://github.com/mdadams/jasper/issues/182; https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html
CVE: CVE-2018-19543
Published: 2018-11-26
Description: An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html; https://github.com/mdadams/jasper/issues/182
CVE: CVE-2018-19544
Published: 2018-11-26
Description: JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/toiron/setest/blob/64a0b436289c5b177f1a0b28b67719284e03a618/jeecmsaddnews.html; https://github.com/toiron/setest/blob/64a0b436289c5b177f1a0b28b67719284e03a618/jeecmsaddnews.html
CVE: CVE-2018-19545
Published: 2018-11-26
Description: JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/toiron/setest/blob/c[PII_REDACTED]8ade31990785d11ee[PII_REDACTED]c4/jeecmsaddusertest.html; https://github.com/toiron/setest/blob/c[PII_REDACTED]8ade31990785d11ee[PII_REDACTED]c4/jeecmsaddusertest.html
CVE: CVE-2018-19546
Published: 2018-11-26
Description: JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: https://github.com/toiron/setest; https://github.com/toiron/setest/blob/master/csrfandxss.html; https://github.com/toiron/setest
CVE: CVE-2018-19547
Published: 2018-11-26
Description: JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/toiron/setest; https://github.com/toiron/setest/blob/master/csrfandxss.html; https://github.com/toiron/setest
CVE: CVE-2018-19548
Published: 2018-11-26
Description: index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make it easier for remote attackers to obtain access via a brute-force approach.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/EduSec/EduSec/issues/14; https://github.com/EduSec/EduSec/issues/14
CVE: CVE-2018-19549
Published: 2018-11-26
Description: Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14; https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14
CVE: CVE-2018-19550
Published: 2018-11-26
Description: Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/153018/Interspire-Email-Marketer-6.20-Remote-Code-Execution.html; https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14; http://packetstormsecurity.com/files/153018/Interspire-Email-Marketer-6.20-Remote-Code-Execution.html
CVE: CVE-2018-19551
Published: 2018-11-26
Description: Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14; https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14
CVE: CVE-2018-19552
Published: 2018-11-26
Description: Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid[] request to Dynamiccontenttags.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14; https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14
CVE: CVE-2018-19553
Published: 2018-11-26
Description: Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamiccontenttags.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14; https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14
CVE: CVE-2018-19554
Published: 2018-11-26
Description: An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/image/image_tool.jsp.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40buxuqua/dotcms-xss-65cdc4174815; https://medium.com/%40buxuqua/dotcms-xss-65cdc4174815
CVE: CVE-2018-19555
Published: 2018-11-26
Description: tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Spicy1chicken/test/blob/master/Loophole_details.doc; https://github.com/Spicy1chicken/test/blob/master/Loophole_details.doc
CVE: CVE-2018-19556
Published: 2018-11-26
Description: zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/novysodope/Z-BlogPHP1.5Zero/blob/bee6dba066b3f9aa378dcde63e1e0ffad6ad0f49/Url%20hijacking; https://github.com/zblogcn/zblogphp/issues/205; https://github.com/novysodope/Z-BlogPHP1.5Zero/blob/bee6dba066b3f9aa378dcde63e1e0ffad6ad0f49/Url%20hijacking