Ens Webgalamb
7 CVEs affecting Ens Webgalamb. Latest disclosed: 2019-03-21. Critical: 3, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-19515 | Critical | 9.8 | 2019-03-21 | In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, atment_sddd… |
CVE-2018-19514 | Critical | 9.8 | 2019-03-21 | In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authentication by… |
CVE-2018-19510 | Critical | 9.8 | 2019-03-21 | subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header. |
CVE-2018-19513 | High | 7.5 | 2019-03-21 | In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file… |
CVE-2018-19512 | High | 7.2 | 2019-03-21 | In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticated adminis… |
CVE-2018-19511 | Medium | 6.5 | 2019-03-21 | wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password. |
CVE-2018-19509 | Medium | 6.1 | 2019-03-21 | wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encoding. Because it is po… |