Fedora 28 : php-zendframework-zend-http (2018-71e9650fa9)

2.8.1 - 2018-08-01 Added - Nothing. Changed - This release modifies how Zend\Http\PhpEnvironment\Request marshals the request URI. In prior releases, we would attempt to inspect the X-Rewrite-Url and X-Original-Url headers, using their values, if present. These headers are issued by the...

Fedora 28 : php-zendframework-zend-feed (2018-7da5983771)

2.10.3 - 2018-08-01 Added - Nothing. Changed - This release modifies how Zend\Feed\Pubsubhubbub\AbstractCallback::detectCallbac kUrl marshals the request URI. In prior releases, we would attempt to inspect the X-Rewrite-Url and X-Original-Url headers, using their values, if present. These headers...

Fedora 28 : nodejs-JSV / nodejs-uri-js (2018-373bbbd408)

Update to latest nodejs-uri-js for CVE fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Cross site scripting

CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...

CVE-2018-19918

CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...

CVE-2018-19918

CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...

PT-2018-15163 · Cuppacms · Cuppacms

Name of the Vulnerable Software and Affected Versions: CuppaCMS affected versions not specified Description: The issue is related to a Cross-Site Scripting XSS attack. It occurs when an SVG document is uploaded to the administrator//component/table manager/view/cu views URI, allowing malicious...

CVE-2018-20614

public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install//step3 URI...

CVE-2018-20606

imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI...

Path traversal

imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI...

CVE-2018-20607

imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI...

CVE-2018-20611

imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI...

CVE-2018-20607

imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI...

CVE-2018-20606

imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI...

CVE-2018-20604

Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...

CVE-2018-20608

imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI...

Code injection

public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install//step3 URI...

CVE-2018-20607

CVE-2018-20607 describes an information-disclosure vulnerability in imcat 4.4 , where remote attackers can obtain potentially sensitive debugging information via the URI root/tools/adbug/binfo.php . The connected documents consistently identify this URI as the disclosure point, indicating a parti...

CVE-2018-20611

imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI...

CVE-2018-20609

CVE-2018-20609 affects imcat 4.4. The vulnerability is an information disclosure: remote attackers can obtain potentially sensitive configuration information through the root/tools/adbug/check.php URI. Connected sources corroborate this description across multiple repositories (NVD, Red Hat, CNVD...