CVE-2018-14972: Improper Neutralization of Input During Web Page Generation

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS...

CVE-2018-14977: Improper Neutralization of Input During Web Page Generation

An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070...

CVE-2018-14978: Cross-Site Request Forgery (CSRF)

An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI...

CVE-2018-14975: Improper Neutralization of Input During Web Page Generation

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS...

CVE-2018-14976: Improper Neutralization of Input During Web Page Generation

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS...

CVE-2018-14973: Improper Neutralization of Input During Web Page Generation

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS...

PT-2018-12854

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/guest.php file, which has a cross-site scripting XSS vulnerability. This is demonstrated by the name parameter. Recommendations For QCMS version 3.0.1,...

PT-2018-12848

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/user.php file, which has a Cross-Site Scripting XSS issue. Recommendations For QCMS version 3.0.1, consider disabling access to the...

PT-2018-12851

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/news.php file, which has a Cross-Site Scripting XSS issue. Recommendations For QCMS version 3.0.1, consider restricting access to the...

PT-2018-12853

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/category.php file, which has a Cross-Site Scripting XSS issue. Recommendations For QCMS version 3.0.1, consider restricting access to the vulnerable...

PT-2018-12850

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/product.php file, which has a Cross-Site Scripting XSS issue. Recommendations For QCMS version 3.0.1, consider restricting access to the...

PT-2018-12849

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/down.php file, which has a Cross-Site Scripting XSS issue. Recommendations For QCMS version 3.0.1, consider restricting access to the vulnerable...

PT-2018-12852

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/album.php file, which has a Cross-Site Scripting XSS issue. Recommendations For QCMS version 3.0.1, consider disabling access to the...

PT-2018-12847

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/slideshow.php file, which has a Cross-Site Scripting XSS issue. Recommendations For QCMS version 3.0.1, consider disabling access to the slideshow.p...

PT-2018-12846

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/system.php file, which has a cross-site scripting XSS issue. Recommendations For QCMS version 3.0.1, update to a newer version that contains a fix f...

PT-2018-12855

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue exists where CSRF is possible via the "backend/user/admin/add.html" API endpoint. Recommendations For QCMS version 3.0.1, consider implementing proper CSRF protection mechanisms to prevent exploitation. ...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20180725)

This update upgrades Thunderbird to version 52.9.1. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Firefox ESR 52.9 CVE-2018-5188 - Mozilla: Buffer overflow using computed size of canvas element CVE-2018-12359 - Mozilla: Use-after-free using focus...

Mozilla: Invalid data handling during QCMS transformations

An invalid grid size during QCMS color profile transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox ESR 52.9, and Firefox 61...

qcms/fuzz: Crash in lut_inverse_interp16

Detailed report: https://oss-fuzz.com/testcase?key=5643064793104384 Project: qcms Fuzzer: libFuzzerqcmsfuzz Fuzz target binary: fuzz Job Type: libfuzzermsanqcms Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x730fffff16d0 Crash State: lutinverseinterp16 invertlut computeprecache...

Mozilla: Invalid data handling during QCMS transformations

An invalid grid size during QCMS color profile transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox ESR 52.9, and Firefox 61...