CVE-2018-17423

An issue was discovered in e107 v2.1.9. There is a XSS attack on e107_admin/comment.php.

Source: CVE-2018-17423

CVE-2018-17840

SQL injection exists in Scriptzee Education Website 1.0 via the college_list.html subject, city, or country parameter.

Source: CVE-2018-17840

CVE-2018-17399

SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter.

Source: CVE-2018-17399

CVE-2019-6114

An issue was discovered in Corel PaintShop Pro 2019 21.0.0.119. An integer overflow in the jp2 parsing library allows an attacker to overwrite memory and to execute arbitrary code.

Source: CVE-2019-6114

CVE-2019-9701

DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.

Source: CVE-2019-9701

CVE-2019-12491

OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors. To exploit the vulnerability an attacker has to have control of a single server on a given cloud (e.g. by renting one). From the source server, the attacker can craft any command and trigger the OnApp platform to execute that command with root privileges on a target server.

Source: CVE-2019-12491

CVE-2018-18425

The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token’s total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using ‘doAirdrop’ ignores the hard cap written in the contract and devalues the token.)

Source: CVE-2018-18425

CVE-2018-19878

An issue was discovered on Teltonika RTU950 R_31.04.89 devices. The application allows a user to login without limitation. For every successful login request, the application saves a session. A user can re-login without logging out, causing the application to store the session in memory. Exploitation of this vulnerability will increase memory use and consume free space.

Source: CVE-2018-19878

CVE-2018-18758

Open Faculty Evaluation System 7 for PHP 7 allows submit_feedback.php SQL Injection, a different vulnerability than CVE-2018-18757.

Source: CVE-2018-18758