The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2018-16790 | _bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16789 | libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down. | HIGH | Mar 28, 2019 | n/a |
| CVE-2018-16786 | DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php. | MEDIUM | Sep 21, 2018 | n/a |
| CVE-2018-16785 | XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell | MEDIUM | Sep 19, 2018 | n/a |
| CVE-2018-16784 | DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a <file type='file' name='../ substring. | MEDIUM | Sep 21, 2018 | n/a |
| CVE-2018-16782 | libimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmpr_read_rle_internal function in imagew-bmp.c. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16781 | ffjpeg.dll in ffjpeg before 2018-08-22 allows remote attackers to cause a denial of service (FPE signal) via a progressive JPEG file that lacks an AC Huffman table. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16780 | Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment. | LOW | Sep 10, 2018 | n/a |
| CVE-2018-16779 | BlogCMS through 2016-10-25 has XSS via a comment. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16778 | Cross-site scripting (XSS) vulnerability in Jenzabar v8.2.1 through 9.2.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter (aka the Search Field). | MEDIUM | Dec 21, 2018 | n/a |
| CVE-2018-16776 | wityCMS 0.6.2 has XSS via the Site Name field found in the Contact Configuration page. | LOW | Sep 10, 2018 | n/a |
| CVE-2018-16775 | An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the Categories menu. | LOW | Sep 10, 2018 | n/a |
| CVE-2018-16774 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16773 | EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field. | LOW | Sep 10, 2018 | n/a |
| CVE-2018-16772 | Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new. | LOW | Sep 10, 2018 | n/a |
| CVE-2018-16771 | Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php. | HIGH | Sep 10, 2018 | n/a |
| CVE-2018-16770 | In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because a certain new_allocator allocate call fails. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16769 | In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because libRuntime.so!llvm::InstructionCombiningPass::runOnFunction is mishandled. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16768 | In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because of an unspecified heap-buffer-overflow condition in IR::FunctionValidationContext::end. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16767 | In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because of an unspecified heap-buffer-overflow condition in FunctionValidationContext::popAndValidateOperand. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16766 | In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because Errors::unreachable() is reached. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16765 | In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because of an unspecified heap-buffer-overflow condition in FunctionValidationContext::else_. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16764 | In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because of an IR::FunctionValidationContext::catch_all heap-based buffer over-read. | MEDIUM | Sep 10, 2018 | n/a |
| CVE-2018-16763 | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. | HIGH | Sep 9, 2018 | n/a |
| CVE-2018-16762 | FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items. | HIGH | Sep 9, 2018 | n/a |
| CVE-2018-16761 | Eventum before 3.4.0 has an open redirect vulnerability. | MEDIUM | Sep 9, 2018 | n/a |
| CVE-2018-16759 | The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event. | MEDIUM | Sep 9, 2018 | n/a |
| CVE-2018-16758 | Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets. | MEDIUM | Oct 10, 2018 | n/a |
| CVE-2018-16752 | LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases. | HIGH | Sep 20, 2018 | n/a |
| CVE-2018-16750 | In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found. | MEDIUM | Sep 9, 2018 | n/a |
| CVE-2018-16749 | In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file. | MEDIUM | Sep 9, 2018 | n/a |
| CVE-2018-16745 | An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow a buffer overflow if long untrusted input can reach it. | MEDIUM | Sep 13, 2018 | n/a |
| CVE-2018-16744 | An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow for command injection if untrusted input can reach it, because popen is used. | MEDIUM | Sep 13, 2018 | n/a |
| CVE-2018-16743 | An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy(), which can cause a stack-based buffer overflow. | MEDIUM | Sep 13, 2018 | n/a |
| CVE-2018-16742 | An issue was discovered in mgetty before 1.2.1. In contrib/scrts.c, a stack-based buffer overflow can be triggered via a command-line parameter. | MEDIUM | Sep 13, 2018 | n/a |
| CVE-2018-16741 | An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the faxq-helper activate <jobid> command. | HIGH | Sep 13, 2018 | n/a |
| CVE-2018-16739 | An issue was discovered on certain ABUS TVIP devices. Due to a path traversal in /opt/cgi/admin/filewrite, an attacker can write to files, and thus execute code arbitrarily with root privileges. | -- | Oct 26, 2023 | n/a |
| CVE-2018-16738 | tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1. | MEDIUM | Oct 10, 2018 | n/a |
| CVE-2018-16737 | tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation. | MEDIUM | Oct 10, 2018 | n/a |
| CVE-2018-16736 | In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings). | LOW | Sep 9, 2018 | n/a |
| CVE-2018-16733 | In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block. | MEDIUM | Sep 8, 2018 | n/a |
| CVE-2018-16732 | uploadpluginssysadminSetting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save. | MEDIUM | Sep 8, 2018 | n/a |
| CVE-2018-16731 | CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg, png), and then providing a .php pathname within fileurl JSON data. | HIGH | Sep 8, 2018 | n/a |
| CVE-2018-16730 | uploadpluginssysInstall.php in CScms 4.1 has XSS via the site name. | MEDIUM | Sep 8, 2018 | n/a |
| CVE-2018-16729 | Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files. | LOW | Sep 12, 2018 | n/a |
| CVE-2018-16728 | feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new. | LOW | Sep 12, 2018 | n/a |
| CVE-2018-16727 | razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component. | LOW | Sep 12, 2018 | n/a |
| CVE-2018-16726 | razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component. | LOW | Sep 12, 2018 | n/a |
| CVE-2018-16725 | An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka Non-standard use of the flash component. | MEDIUM | Sep 8, 2018 | n/a |
| CVE-2018-16724 | An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request. | HIGH | Sep 8, 2018 | n/a |
