Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2018-0560
Hatena Bookmark App for iOS Version 3.0 to 3.70 allows remote attackers to spoof the address bar via vectors related to URL display.
Affected Products: Hatena Bookmark App for iOS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://bookmark.hatenastaff.com/entry/2018/04/09/170000'}, {'name': 'JVN#77753476', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN77753476/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0561
Untrusted search path vulnerability in The installer of PhishWall Client Internet Explorer edition Ver. 3.7.15 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installer of PhishWall Client Internet Explorer edition
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.securebrain.co.jp/about/news/2018/04/180411.html'}, {'name': 'JVN#92220486', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN92220486/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0562
Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Installer of SoundEngine Free
References: [{'name': 'JVN#85056623', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN85056623/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://soundengine.jp/wordpress/penguin_press/press_release/4187/'}]
CVE State: PUBLISHED
Explain CVE-2018-0563
Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://flets.com/customer/next/sec/setup/esat_install.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://flets.com/customer/tec/fvc/setup/esat_install.html'}, {'name': 'JVN#20040004', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN20040004/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0564
Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15) allows remote attackers to perform arbitrary operations via unspecified vectors.
Affected Products: EC-CUBE
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ec-cube.net/info/weakness/20180416/'}, {'name': 'JVN#52695336', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN52695336/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0565
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Cybozu Office
References: [{'name': 'JVN#51737843', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51737843/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10200'}]
CVE State: PUBLISHED
Explain CVE-2018-0566
Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors.
Affected Products: Cybozu Office
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10195'}, {'name': 'JVN#51737843', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51737843/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0567
Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors.
Affected Products: Cybozu Office
References: [{'name': 'JVN#51737843', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51737843/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10198'}]
CVE State: PUBLISHED
Explain CVE-2018-0568
Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors.
Affected Products: Joruri Gw
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/joruri/joruri-gw/blob/master/doc/INSTALL.txt'}, {'name': 'JVN#95589314', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN95589314/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0569
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.
Affected Products: baserCMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://basercms.net/security/JVN67881316'}, {'name': 'JVN#67881316', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67881316/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0570
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: baserCMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://basercms.net/security/JVN67881316'}, {'name': 'JVN#67881316', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67881316/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0571
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
Affected Products: baserCMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://basercms.net/security/JVN67881316'}, {'name': 'JVN#67881316', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67881316/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0572
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.
Affected Products: baserCMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://basercms.net/security/JVN67881316'}, {'name': 'JVN#67881316', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67881316/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0573
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.
Affected Products: baserCMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://basercms.net/security/JVN67881316'}, {'name': 'JVN#67881316', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67881316/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0574
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: baserCMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://basercms.net/security/JVN67881316'}, {'name': 'JVN#67881316', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67881316/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0575
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.
Affected Products: baserCMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://basercms.net/security/JVN67881316'}, {'name': 'JVN#67881316', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67881316/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0576
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Events Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/events-manager/#developers'}, {'name': 'JVN#85531148', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN85531148/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9609'}]
CVE State: PUBLISHED
Explain CVE-2018-0577
Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: WP Google Map Plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wordpress.org/plugins/wp-google-map-plugin/#developers'}, {'name': 'JVN#01040170', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN01040170/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9610'}]
CVE State: PUBLISHED
Explain CVE-2018-0578
Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: PixelYourSite
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/pixelyoursite/#developers'}, {'name': 'JVN#61081552', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN61081552/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0579
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Open Graph for Facebook, Google+ and Twitter Card Tags
References: [{'name': 'JVN#08386386', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN08386386/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/wonderm00ns-simple-facebook-open-graph-tags/#developers'}]
CVE State: PUBLISHED
Explain CVE-2018-0580
Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (for Windows) Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER (for Windows) Ver.1.6.3 and earlier, with its timestamp prior to April 25, 2018, 17:02:49) allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: CLIP STUDIO series
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.clip-studio.com/clip_site/download/clipstudioaction/csaupdater/index_win'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.clipstudio.net/en/dl'}, {'name': 'JVN#68345747', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN68345747/'}]
CVE State: PUBLISHED
Explain CVE-2018-0581
Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: RT-AC87U
References: [{'name': 'JVN#33901663', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN33901663/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.asus.com/Networking/RTAC87U/HelpDesk_BIOS/'}]
CVE State: PUBLISHED
Explain CVE-2018-0582
Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: RT-AC68U
References: [{'name': 'JVN#73742314', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN73742314/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.asus.com/Networking/RTAC68U/HelpDesk_BIOS/'}]
CVE State: PUBLISHED
Explain CVE-2018-0583
Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: RT-AC1200HP
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.asus.com/Networking/RTAC1200HP/HelpDesk_BIOS/'}, {'name': 'JVN#34562916', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN34562916/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0584
IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication [effect_of_bypassing_authentication] via unspecified vectors.
Affected Products: IIJ SmartKey App for Android
References: [{'name': 'JVN#27137002', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN27137002/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0585
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Ultimate Member
References: [{'name': 'JVN#28804532', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28804532/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/ultimate-member/#developers'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9608'}]
CVE State: PUBLISHED
Explain CVE-2018-0586
Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors.
Affected Products: Ultimate Member
References: [{'name': 'JVN#28804532', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28804532/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/ultimate-member/#developers'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9608'}]
CVE State: PUBLISHED
Explain CVE-2018-0587
Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.
Affected Products: Ultimate Member
References: [{'name': 'JVN#28804532', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28804532/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/ultimate-member/#developers'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9608'}]
CVE State: PUBLISHED
Explain CVE-2018-0588
Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: Ultimate Member
References: [{'name': 'JVN#28804532', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28804532/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/ultimate-member/#developers'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9608'}]
CVE State: PUBLISHED
Explain CVE-2018-0589
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors.
Affected Products: Ultimate Member
References: [{'name': 'JVN#28804532', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28804532/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/ultimate-member/#developers'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9608'}]
CVE State: PUBLISHED
Explain CVE-2018-0590
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors.
Affected Products: Ultimate Member
References: [{'name': 'JVN#28804532', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28804532/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/ultimate-member/#developers'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9608'}]
CVE State: PUBLISHED
Explain CVE-2018-0591
The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: KINEPASS App
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://play.google.com/store/apps/details?id=jp.tjoy.kinepass&hl=en'}, {'name': 'JVN#83671755', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN83671755/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://itunes.apple.com/us/app/kinepasu-apuridekantan-bian/id637453055?mt=8'}]
CVE State: PUBLISHED
Explain CVE-2018-0592
Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Microsoft OneDrive
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/'}, {'name': 'JVN#91151862', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91151862/index.html'}, {'name': '104563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104563'}]
CVE State: PUBLISHED
Explain CVE-2018-0593
Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installer of Microsoft OneDrive
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/'}, {'name': 'JVN#91151862', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91151862/index.html'}, {'name': '104563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104563'}]
CVE State: PUBLISHED
Explain CVE-2018-0594
Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Skype for Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/'}, {'name': 'JVN#91151862', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91151862/index.html'}, {'name': '104563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104563'}]
CVE State: PUBLISHED
Explain CVE-2018-0595
Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installer of Skype for Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/'}, {'name': 'JVN#91151862', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91151862/index.html'}, {'name': '104563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104563'}]
CVE State: PUBLISHED
Explain CVE-2018-0596
Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installer of Visual Studio Community
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/'}, {'name': 'JVN#91151862', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91151862/index.html'}, {'name': '104563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104563'}]
CVE State: PUBLISHED
Explain CVE-2018-0597
Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installer of Visual Studio Code
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/'}, {'name': 'JVN#91151862', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91151862/index.html'}, {'name': '104563', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104563'}]
CVE State: PUBLISHED
Explain CVE-2018-0598
Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Self-extracting archive files created by IExpress bundled with Microsoft Windows
References: [{'url': 'https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/'}, {'name': 'JVN#72748502', 'tags': ['third-party-advisory'], 'url': 'http://jvn.jp/en/jp/JVN72748502/index.html'}, {'url': 'https://msrc.microsoft.com/blog/2018/04/triaging-a-dll-planting-vulnerability/'}]
CVE State: PUBLISHED
Explain CVE-2018-0599
Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installer of Visual C++ Redistributable
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/'}, {'name': 'JVN#81196185', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN81196185/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0600
Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: the installer of PlayMemories Home for Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://support.d-imaging.sony.co.jp/www/disoft/int/download/playmemories-home/win/ja/index.html'}, {'name': 'JVN#13940333', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN13940333/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0601
Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: axpdfium
References: [{'name': 'JVN#79301396', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN79301396/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/yak1ex/axpdfium/wiki/JVN%2379301396%28en%29'}]
CVE State: PUBLISHED
Explain CVE-2018-0602
Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Email Subscribers & Newsletters
References: [{'name': 'JVN#16471686', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN16471686/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wordpress.org/plugins/email-subscribers/#developers'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9101'}]
CVE State: PUBLISHED
Explain CVE-2018-0603
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Site Reviews
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/9102'}, {'name': 'JVN#60978548', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN60978548/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wordpress.org/plugins/site-reviews/#developers'}]
CVE State: PUBLISHED
Explain CVE-2018-0604
Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.
Affected Products: Pixelpost
References: [{'name': 'JVN#27978559', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN27978559/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0605
Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Pixelpost
References: [{'name': 'JVN#27978559', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN27978559/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0606
SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: Pixelpost
References: [{'name': 'JVN#27978559', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN27978559/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0607
SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'name': 'JVN#13415512', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN13415512/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.cybozu.support/article/33120/'}]
CVE State: PUBLISHED
Explain CVE-2018-0608
Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.
Affected Products: H2O
References: [{'name': 'JVN#93226941', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN93226941/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/h2o/h2o/issues/1775'}]
CVE State: PUBLISHED
Explain CVE-2018-0609
Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: n/a
References: [{'name': 'JVN#92265618', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN92265618/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://linecorp.com/en/security/article/172'}]
CVE State: PUBLISHED
Explain CVE-2018-0610
Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information.
Affected Products: Zenphoto
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.zenphoto.org/news/zenphoto-1.5'}, {'name': 'JVN#33124193', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN33124193/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0611
The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: ANA App for iOS
References: [{'name': 'JVN#71535108', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN71535108/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ana.co.jp/ja/jp/share/mobile/smartphone/app_ana/#title'}]
CVE State: PUBLISHED
Explain CVE-2018-0612
Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: 5000 trillion yen converter
References: [{'name': 'JVN#98975951', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN98975951/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://chrome.google.com/webstore/detail/5000%E5%85%86%E5%86%86%E3%82%B3%E3%83%B3%E3%83%90%E3%83%BC%E3%82%BF%E3%83%BC/mgaphgebhfgmkahikdhdomnnpelbijmo'}]
CVE State: PUBLISHED
Explain CVE-2018-0613
NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D 01.03.00 and earlier, CSDJ-A 03.00.00) allows remote authenticated attackers to bypass access restriction to conduct arbitrary operations with administrative privilege via unspecified vectors.
Affected Products: Calsos CSDX and CSDJ series products
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.necplatforms.co.jp/product/enkaku/info180702.html'}, {'name': 'JVN#63895206', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN63895206/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0614
Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D 01.03.00 and earlier, CSDJ-A 03.00.00) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Calsos CSDX and CSDJ series products
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.necplatforms.co.jp/product/enkaku/info180702.html'}, {'name': 'JVN#63895206', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN63895206/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0617
Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: MemoCGI
References: [{'name': 'JVN#58362455', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN58362455/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.chama.ne.jp/download/etc/memo/index.htm'}]
CVE State: PUBLISHED
Explain CVE-2018-0618
Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Mailman
References: [{'name': '[mailman-announce] 20180622 Mailman 2.1.27 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail.python.org/pipermail/mailman-announce/2018-June/000236.html'}, {'name': 'DSA-4246', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4246'}, {'name': '[debian-lts-announce] 20180724 [SECURITY] [DLA 1442-1] mailman security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00034.html'}, {'name': 'JVN#00846677', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00846677/index.html'}, {'name': 'GLSA-201904-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201904-10'}, {'name': 'USN-4348-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/4348-1/'}]
CVE State: PUBLISHED
Explain CVE-2018-0619
Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Installer of Glary Utilities
References: [{'name': 'JVN#84967039', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN84967039/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0620
Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: the installer of LOGICOOL Game Software
References: [{'name': 'JVN#52574492', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN52574492/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0621
Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: the installer of LOGICOOL CONNECTION UTILITY SOFTWARE
References: [{'name': 'JVN#52574492', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN52574492/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0622
The DHC Online Shop App for Android version 3.2.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: DHC Online Shop App for Android
References: [{'name': 'JVN#77409513', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN77409513/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0623
Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver. 20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of msjet49.dll loaded by the vulnerable products.
Affected Products: Multiple Yayoi 17 Series products
References: [{'name': 'JVN#06813756', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN06813756/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0624
Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver.20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of ykkapi.dll loaded by the vulnerable products.
Affected Products: Multiple Yayoi 17 Series products
References: [{'name': 'JVN#06813756', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN06813756/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0625
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter.
Affected Products: WG1200HP
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#00401783', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN00401783/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0626
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter.
Affected Products: WG1200HP
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#00401783', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN00401783/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0627
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
Affected Products: WG1200HP
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#00401783', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN00401783/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0628
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
Affected Products: WG1200HP
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#00401783', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN00401783/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0629
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
Affected Products: Aterm W300P
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#26629618', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN26629618/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0630
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter.
Affected Products: Aterm W300P
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#26629618', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN26629618/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0631
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
Affected Products: Aterm W300P
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#26629618', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN26629618/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0632
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response.
Affected Products: Aterm W300P
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#26629618', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN26629618/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0633
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.
Affected Products: Aterm W300P
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}, {'name': 'JVN#26629618', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN26629618/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0634
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL.
Affected Products: HC100RC
References: [{'name': 'JVN#84825660', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN84825660/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0635
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter.
Affected Products: HC100RC
References: [{'name': 'JVN#84825660', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN84825660/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0636
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634.
Affected Products: HC100RC
References: [{'name': 'JVN#84825660', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN84825660/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0637
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter.
Affected Products: HC100RC
References: [{'name': 'JVN#84825660', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN84825660/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0638
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter.
Affected Products: HC100RC
References: [{'name': 'JVN#84825660', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN84825660/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0639
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time parameter, and offset parameter.
Affected Products: HC100RC
References: [{'name': 'JVN#84825660', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN84825660/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0640
Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, time parameter, and offset parameter.
Affected Products: HC100RC
References: [{'name': 'JVN#84825660', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN84825660/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0641
Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter, time parameter, and offset parameter.
Affected Products: HC100RC
References: [{'name': 'JVN#84825660', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN84825660/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jpn.nec.com/security-info/secinfo/nv18-011.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0642
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: FV Flowplayer Video Player
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers'}, {'name': 'JVN#70246549', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN70246549/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0643
Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-server) 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
Affected Products: Ubuntu14.04 ORCA(Online Receipt Computer Advantage)4.8.0(panda-server) 1:1.4.9+p41-u4jma1 and earlier
References: [{'name': 'JVN#37376131', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN37376131/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.orca.med.or.jp/news/vulnerability_2018-07-18-1.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0644
Buffer overflow in Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-client2) 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 5.0.0 (panda-client2) 1:2.0.0+p48-u4jma1 and earlier, and Ubuntu16.04 ORCA (Online Receipt Computer Advantage) 5.0.0 (panda-client2) 1:2.0.0+p48-u5jma1 and earlier allows authenticated attackers to cause denial-of-service (DoS) condition via unspecified vectors.
Affected Products: Ubuntu14.04 ORCA(Online Receipt Computer Advantage)4.8.0(panda-client2) 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 ORCA(Online Receipt Computer Advantage)5.0.0(panda-client2) 1:2.0.0+p48-u4jma1 and earlier, and Ubuntu16.04 ORCA(Online Receipt Computer Advantage)5.0.0(panda-client2) 1:2.0.0+p48-u5jma1 and earlier
References: [{'name': 'JVN#37376131', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN37376131/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.orca.med.or.jp/news/vulnerability_2018-07-18-1.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0645
MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors.
Affected Products: MTAppjQuery
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.tinybeans.net/blog/2015/06/26-230919.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bit-part.net/news/2018/07/mtappjquery-20180717.html'}, {'name': 'JVN#62423700', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN62423700/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0646
Directory traversal vulnerability in Explzh v.7.58 and earlier allows an attacker to read arbitrary files via unspecified vectors.
Affected Products: Explzh
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ponsoftware.com/archiver/explzh/explzh.htm#explz759'}, {'name': 'JVN#55813866', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN55813866/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0647
Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Affected Products: WL-330NUL
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.asus.com/us/Networking/WL330NUL/HelpDesk_BIOS/'}, {'name': 'JVN#71329812', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN71329812/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0648
Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Installer of ChatWork Desktop App for Windows
References: [{'name': 'JVN#39171169', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN39171169/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://go.chatwork.com/download/'}]
CVE State: PUBLISHED
Explain CVE-2018-0649
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installers of multiple Canon IT Solutions Inc. software programs
References: [{'name': 'JVN#41452671', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN41452671/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://eset-support.canon-its.jp/faq/show/10720?site_domain=default'}]
CVE State: PUBLISHED