Browse CVEs

CRITICAL 9.8 CVE-2018-19510EPSS 20% subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header. Webgalamb after 7.0 Fix from $2,3002019-03-21 CRITICAL 9.8 CVE-2018-19514 In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authent… Webgalamb after 7.0 Fix from $2,3002019-03-21 CRITICAL 9.8 CVE-2018-19515 In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, a… Webgalamb after 7.0 Fix from $2,3002019-03-21 HIGH 7.5 CVE-2018-19513 In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The… Webgalamb after 7.0 Fix from $1,9502019-03-21 HIGH 7.2 CVE-2018-19512EPSS 7% In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticat… Webgalamb after 7.0 Fix from $1,9502019-03-21 MEDIUM 6.5 CVE-2018-19511 wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password. Webgalamb No fix yet Fix from $1,6002019-03-21 MEDIUM 6.1 CVE-2018-19509 wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encoding. Becaus… Webgalamb No fix yet Fix from $1,6002019-03-21