ssh_companywebsite_project - MidnightBSD Security Advisories

Advisories for ssh_companywebsite_project

CVE-2018-14440 HIGH

An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. SQL injection exists via the admin/noticeManageAction_queryNotice.action noticeInfo parameter.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
ssh_companywebsite_project	ssh_companywebsite	*

CVE-2018-14441 HIGH

An issue was discovered in cckevincyh SSH CompanyWebsite through 2018-05-03. admin/admin/fileUploadAction_fileUpload.action allows arbitrary file upload, as demonstrated by a .jsp file with the image/jpeg content type.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-434,

Products Affected

Vendor	Product	Version
ssh_companywebsite_project	ssh_companywebsite	*