Security Vulnerabilities - CVEs Published In November 2018
Library Management System 1.0 has SQL Injection via the "Search for Books" screen.
CVSS Score
9.8
EPSS Score
0.003
Published
2018-11-16
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
CVSS Score
8.8
EPSS Score
0.002
Published
2018-11-16
School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
CVSS Score
8.8
EPSS Score
0.002
Published
2018-11-16
The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=[SQL] or index.php?q=single-item&id=[SQL].
CVSS Score
9.8
EPSS Score
0.03
Published
2018-11-16
Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb.
CVSS Score
9.8
EPSS Score
0.03
Published
2018-11-16
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
CVSS Score
9.8
EPSS Score
0.03
Published
2018-11-16
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain functions.
CVSS Score
6.4
EPSS Score
0.003
Published
2018-11-16
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object reference.
CVSS Score
6.4
EPSS Score
0.003
Published
2018-11-16
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
CVSS Score
9.8
EPSS Score
0.061
Published
2018-11-16
The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579.
CVSS Score
4.3
EPSS Score
0.002
Published
2018-11-16