CVE-2018-19598

CVE-2018-19598 affects Statamic 2.10.3. A stored/reflected-like XSS exists via the First Name or Last Name fields in an ‘Add new user’ request to the /users URI. Public exploitation details are not provided in the provided documents. No remediation details are included here.

CVE-2018-19507

CMSimple 4.7.5 is affected by a stored/reflected XSS issue triggered by an admin request using the URI parameter ?file=config&action=array. The NVD entry indicates the vulnerability exists in the web application’s handling of user-supplied input, enabling HTML/script injection that can potentiall...

CVE-2018-19507

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...

CVE-2018-19506

Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...

Cross site scripting

XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...

CVE-2018-20137

XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI...

CVE-2018-20136

XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...

The vulnerability of Cisco Unified Communications Domain Manager relates to insufficient protection of the website structure, allowing attackers to inject arbitrary code into the uploaded web pages.

The vulnerability of the Cisco Unified Communications Domain Manager relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted URI address from a remote location...

CVE-2018-20064

CVE-2018-20064 concerns doorGets 7.0, where a directory-traversal flaw lets remote attackers write arbitrary files. The root cause is a crafted request to dg-user/?controller=theme&action=edit&name=doorgets&file=../../1.txt%00 with content provided in theme_content_nofi, enabling arbitrary file w...

Mail.ru: XSS

Reflected XSS via URI in allods.mail.ru. allods.mail.ru belongs to extended scope...

[SECURITY] Fedora 28 Update: uriparser-0.9.0-1.fc28

Uriparser is a strictly RFC 3986 compliant URI parsing library written in C. uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license...

Code injection

IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequestauthenticate API when an unprotected URI is accessed. IBM X-Force ID: 153629...

Sql injection

S-CMS V3.0 has SQL injection via the Sid parameter, as demonstrated by the /1/?type=productinfo&Sid=140 URI...

Input validation

PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI...

Design/Logic Flaw

SEMCMS 3.5 has XSS via the first text box to the SEMCMSMain.php URI...

CVE-2018-20017

SEMCMS 3.5 has XSS via the first text box to the SEMCMSMain.php URI...

CVE-2018-9548

In multiple functions of ContentProvider.java, there is a possible permission bypass due to a missing URI validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions:...

CVE-2018-9548

CVE-2018-9548 affects Android: multiple ContentProvider.java functions allow a permission bypass due to missing URI validation, enabling local information disclosure without user interaction. Vulnerable in Android 7.0–7.1.2, 8.0–8.1, and 9.0. Mitigation is to apply patches from the 2018-12-01/12-...

CVE-2018-3948

An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. A specially crafted URL can cause the server to stop responding to requests, resulting in downtime for the management portal. An attacker can send either an unauthenticate...

CVE-2018-3948

An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. A specially crafted URL can cause the server to stop responding to requests, resulting in downtime for the management portal. An attacker can send either an unauthenticate...