CVE-2018-17936

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-179378.8gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow r CVE-2018-179385.3Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.CVE-2018-179397.5An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. The CVE-2018-17946.1IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows use CVE-2018-179428.8The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated CVE-2018-179444.9On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by CVE-2018-179466.1The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupda CVE-2018-179476.1The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.CVE-2018-179486.1An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3.CVE-2018-179496.1Cross site scripting vulnerability in iManager prior to 3.1 SP2.CVE-2018-17956.1IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users CVE-2018-179507.5Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2