Security Vulnerabilities - CVEs Published In December 2018
Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0723.
CVSS Score
6.1
EPSS Score
0.003
Published
2018-12-26
The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.
CVSS Score
3.4
EPSS Score
0.0
Published
2018-12-26
XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.
CVSS Score
6.5
EPSS Score
0.013
Published
2018-12-26
In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CVSS Score
6.5
EPSS Score
0.002
Published
2018-12-26
An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-12-26
An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field.
CVSS Score
9.8
EPSS Score
0.003
Published
2018-12-26
An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value.
CVSS Score
7.5
EPSS Score
0.003
Published
2018-12-26
An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo S_id parameter.
CVSS Score
9.8
EPSS Score
0.003
Published
2018-12-26
An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter.
CVSS Score
9.8
EPSS Score
0.003
Published
2018-12-26
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-12-25