CVE-2018-14973

Summary: CVE-2018-14973 affects QCMS 3.0.1, with a cross-site scripting (XSS) vulnerability in the file path upload/System/Controller/backend/product.php. The connected documents corroborate an XSS issue in this component/version. No explicit exploitation details, affected subcomponents beyond th...

CVE-2018-14970

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS...

CVE-2018-14976

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS...

CVE-2018-14970

CVE-2018-14970 affects QCMS 3.0.1, with a cross-site scripting (XSS) flaw in upload/System/Controller/backend/slideshow.php. The connected sources (CNVD, NVD, CVE listings) confirm the vulnerable component/file and the underlying issue is XSS, but do not provide exploit details, affected versions...

CVE-2018-14975

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS...

CVE-2018-14971

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS...

CVE-2018-14969

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS...

CVE-2018-14977

An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070...

CVE-2018-14973

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS...

CVE-2018-14974

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS...

CVE-2018-14978

An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI...

CVE-2018-14978

QCMS 3.0.1 contains a CSRF vulnerability via the backend/user/admin/add.html URI (CVE-2018-14978). The CNVD entry CNVD-2019-10282 documents this issue in QCMS 3.0.1, describing a cross-site forgery that enables unauthorized operations through that endpoint. The CVE entry notes the vulnerability a...

CVE-2018-14969

QCMS 3.0.1 is affected by CVE-2018-14969. The vulnerability is a cross-site scripting flaw in upload/System/Controller/backend/system.php, described in CNVD-2019-10276 as exploitable by remote attackers to inject arbitrary web script or HTML. No specific exploit details or patch information are p...

CVE-2018-14974

CVE-2018-14974 affects QCMS 3.0.1, with a cross-site scripting (XSS) flaw in upload/System/Controller/backend/news.php. CNVD describes remote exploitation to inject arbitrary script/HTML; CVSS3 base score 4.8 (MEDIUM). No remediation details provided in the supplied documents.

CVE-2018-14972

CVE-2018-14972 affects QCMS 3.0.1, with a cross-site scripting vulnerability in upload/System/Controller/backend/down.php. The issue is described across multiple records (NVD/CNVD/CVE entries) as an XSS in that file path; no specific exploit details, affected versions, or remediation are provided...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20180725)

This update upgrades Thunderbird to version 52.9.1. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Firefox ESR 52.9 CVE-2018-5188 - Mozilla: Buffer overflow using computed size of canvas element CVE-2018-12359 - Mozilla: Use-after-free using focus...

Mozilla: Invalid data handling during QCMS transformations

An invalid grid size during QCMS color profile transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox ESR 52.9, and Firefox 61...

qcms/fuzz: Crash in lut_inverse_interp16

Detailed report: https://oss-fuzz.com/testcase?key=5643064793104384 Project: qcms Fuzzer: libFuzzerqcmsfuzz Fuzz target binary: fuzz Job Type: libfuzzermsanqcms Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x730fffff16d0 Crash State: lutinverseinterp16 invertlut computeprecache...

Mozilla: Invalid data handling during QCMS transformations

An invalid grid size during QCMS color profile transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox ESR 52.9, and Firefox 61...

UBUNTU-CVE-2018-12366

An invalid grid size during QCMS color profile transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox ESR 52.9, and Firefox 61...