AvaterXXX/CVEs

AvaterXXX/CVEs

Unavailable

This project is no longer available (or publicly accessible) from GitHub

Releases0

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2019-7692 ↗	Feb 10, 2019Sunday, 10 February 2019, 16:29	—	7.5 HIGH
install/install.php in CIM 0.9.3 allows remote attackers to execute arbitrary PHP code via a crafted prefix value because of configuration file mishandling in the N=83 case, as demonstrated by a call to the PHP fputs function that creates a .php file in the public folder.
CVE-2018-20613 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	6.8 MEDIUM
TEMMOKU T1.09 Beta allows admin/user/add CSRF.
CVE-2018-20614 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	5 MEDIUM
public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install/#/step3 URI.
CVE-2018-20607 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	5 MEDIUM
imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI.
CVE-2018-20608 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	5 MEDIUM
imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.
CVE-2018-20612 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	6.8 MEDIUM
UWA 2.3.11 allows index.php?g=admin&c=admin&a=add_admin_do CSRF.
CVE-2018-20611 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	4.3 MEDIUM
imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.
CVE-2018-20610 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	4 MEDIUM
imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.
CVE-2018-20609 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	5 MEDIUM
imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI.
CVE-2018-20606 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	5 MEDIUM
imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI.
CVE-2018-20605 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	7.5 HIGH
imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.
CVE-2018-20597 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	3.5 LOW
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.
CVE-2018-20598 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	6.8 MEDIUM
UCMS 1.4.7 has ?do=user_addpost CSRF.
CVE-2018-20599 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	6.5 MEDIUM
UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action.
CVE-2018-20600 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	4.3 MEDIUM
sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.
CVE-2018-20601 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	3.5 LOW
UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.
CVE-2018-20602 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	5 MEDIUM
Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI.
CVE-2018-20603 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	6.8 MEDIUM
Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.
CVE-2018-20604 ↗	Dec 30, 2018Sunday, 30 December 2018, 21:29	—	4 MEDIUM
Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file.
CVE-2018-20567 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	5 MEDIUM
An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read.
CVE-2018-20566 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	5 MEDIUM
An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read resource" error messages for a crafted installation page.
CVE-2018-20557 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter.
CVE-2018-20561 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter.
CVE-2018-20565 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the nav_name parameter.
CVE-2018-20564 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product_category.php?rec=update has XSS via the cat_name parameter.
CVE-2018-20563 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobile_name parameter.
CVE-2018-20562 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article_category.php?rec=update has XSS via the cat_name parameter.
CVE-2018-20560 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/show.php?rec=update has XSS via the show_name parameter.
CVE-2018-20559 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter.
CVE-2018-20558 ↗	Dec 28, 2018Friday, 28 December 2018, 16:29	—	3.5 LOW
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the site_name parameter.