Security Vulnerabilities - CVEs Published In 2018
Alzip 10.76.0.0 and earlier is vulnerable to a stack overflow caused by improper bounds checking. By persuading a victim to open a specially-crafted LZH archive file, a attacker could execute arbitrary code execution.
CVSS Score
8.8
EPSS Score
0.005
Published
2018-12-21
The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled, as demonstrated by tjbench.
CVSS Score
8.8
EPSS Score
0.002
Published
2018-12-21
An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download&file= followed by a full pathname, and listing of arbitrary directories is possible with /file?action=download&dir= followed by a full pathname. This is related to plugin/controllers/file.py in the e2openplugin-OpenWebif project.
CVSS Score
7.5
EPSS Score
0.005
Published
2018-12-21
There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.
CVSS Score
8.8
EPSS Score
0.004
Published
2018-12-21
Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
CVSS Score
9.8
EPSS Score
0.052
Published
2018-12-21
Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
CVSS Score
6.1
EPSS Score
0.012
Published
2018-12-21
Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-12-21
Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-12-21
Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information.
CVSS Score
8.1
EPSS Score
0.002
Published
2018-12-21
An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.
CVSS Score
9.8
EPSS Score
0.005
Published
2018-12-21