Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2018-0482
A vulnerability in the web-based management interface of Cisco Prime Network Control System could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.
Affected Products: Cisco Prime Network Control System 
References: [{'name': '20190109 Cisco Prime Network Control System Stored Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-pnc-stored-xss'}, {'name': '106514', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106514'}]
CVE State: PUBLISHED
Explain CVE-2018-0483
A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient validation of user-supplied input of an affected client. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. A successful exploit could allow the attacker to execute arbitrary script code in the context of the targeted client or allow the attacker to access sensitive client-based information.
Affected Products: Cisco Jabber IM for Android 
References: [{'name': '106506', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106506'}, {'name': '20190109 Cisco Jabber Client Framework Instant Message Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-jcf-im-xss'}]
CVE State: PUBLISHED
Explain CVE-2018-0484
A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual routing and forwarding (VRF) instance despite the absence of the vrf-also keyword in the access-class configuration. The vulnerability is due to a missing check in the SSH server. An attacker could use this vulnerability to open an SSH connection to an affected Cisco IOS or IOS XE device with a source address belonging to a VRF instance. Once connected, the attacker would still need to provide valid credentials to access the device.
Affected Products: Cisco IOS 
References: [{'name': '20190109 Cisco IOS and IOS XE Software Secure Shell Connection on VRF Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ios-ssh-vrf'}, {'name': '106560', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106560'}]
CVE State: PUBLISHED
Explain CVE-2018-0485
A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers (ISR G2) and the Cisco 4451-X Integrated Services Router (ISR4451-X) could allow an unauthenticated, remote attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of user input. An attacker could exploit this vulnerability by first connecting to the SM-1T3/E3 module console and entering a string sequence. A successful exploit could allow the attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resulting in a DoS condition on an affected device.
Affected Products: Cisco IOS Software
References: [{'name': '20180926 Cisco IOS and IOS XE Software SM-1T3/E3 Service Module Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-sm1t3e3'}, {'name': '1041737', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041737'}, {'name': '1041736', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041736'}, {'name': '105433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105433'}]
CVE State: PUBLISHED
Explain CVE-2018-0486
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.
Affected Products: XMLTooling-C before 1.6.3
References: [{'name': 'DSA-4085', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4085'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lists.debian.org/debian-security-announce/2018/msg00007.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://shibboleth.net/community/advisories/secadv_20180112.txt'}, {'name': '[debian-lts-announce] 20180114 [SECURITY] [DLA 1242-1] xmltooling security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html'}, {'name': '1040177', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040177'}]
CVE State: PUBLISHED
Explain CVE-2018-0487
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session.
Affected Products: ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0
References: [{'name': 'DSA-4147', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4147'}, {'name': 'DSA-4138', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4138'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01'}, {'name': '103056', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103056'}, {'name': 'GLSA-201804-19', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201804-19'}, {'name': 'USN-4267-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/4267-1/'}]
CVE State: PUBLISHED
Explain CVE-2018-0488
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.
Affected Products: ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0
References: [{'name': '103057', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103057'}, {'name': 'DSA-4147', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4147'}, {'name': 'DSA-4138', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4138'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01'}, {'name': 'GLSA-201804-19', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201804-19'}, {'name': 'USN-4267-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/4267-1/'}]
CVE State: PUBLISHED
Explain CVE-2018-0489
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
Affected Products: Shibboleth XMLTooling-C before 1.6.4
References: [{'name': '1040435', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040435'}, {'name': '103172', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103172'}, {'name': 'DSA-4126', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4126'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://shibboleth.net/community/advisories/secadv_20180227.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt'}, {'name': '[debian-lts-announce] 20180228 [SECURITY] [DLA 1296-1] xmltooling security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/02/msg00031.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0490
An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting.
Affected Products: Tor
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://trac.torproject.org/projects/tor/ticket/25074'}, {'name': 'DSA-4183', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4183'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915'}]
CVE State: PUBLISHED
Explain CVE-2018-0491
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.
Affected Products: Tor
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://trac.torproject.org/projects/tor/ticket/24700'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://trac.torproject.org/projects/tor/ticket/25117'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915'}, {'name': '44994', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44994/'}]
CVE State: PUBLISHED
Explain CVE-2018-0492
Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.
Affected Products: beep
References: [{'name': '44452', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44452/'}, {'name': 'DSA-4163', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4163'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2018-0492'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://lists.debian.org/debian-security-announce/2018/msg00089.html'}, {'name': '[debian-lts-announce] 20180403 [SECURITY] [DLA 1338-1] beep security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/04/msg00002.html'}, {'name': 'GLSA-201805-15', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201805-15'}]
CVE State: PUBLISHED
Explain CVE-2018-0493
remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution.
Affected Products: remctl
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.eyrie.org/?p=kerberos/remctl.git%3Ba=commit%3Bh=86c7e44090c988112a37589d2c7a94029eb5e641'}, {'name': 'DSA-4159', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4159'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.eyrie.org/~eagle/software/remctl/security/2018-04-01.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0494
GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.
Affected Products: WGet
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt'}, {'name': 'RHSA-2018:3052', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3052'}, {'tags': ['x_refsource_MISC'], 'url': 'https://savannah.gnu.org/bugs/?53763'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd'}, {'name': 'GLSA-201806-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201806-01'}, {'name': 'DSA-4195', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4195'}, {'name': '104129', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104129'}, {'name': '1040838', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040838'}, {'name': '44601', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44601/'}, {'name': 'USN-3643-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3643-2/'}, {'name': '[debian-lts-announce] 20180511 [SECURITY] [DLA 1375-1] wget security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/05/msg00006.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.html'}, {'name': 'USN-3643-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3643-1/'}]
CVE State: PUBLISHED
Explain CVE-2018-0496
Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.
Affected Products: DFArc2 before 3.14 unknown
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://savannah.gnu.org/forum/forum.php?forum_id=9169'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998'}, {'name': '[debian-lts-announce] 20190224 [SECURITY] [DLA 1686-1] freedink-dfarc security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2019/02/msg00033.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0497
ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix (with a wrong SHA-384 calculation) for CVE-2013-0169.
Affected Products: ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14
References: [{'name': '[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html'}, {'name': 'DSA-4296', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4296'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02'}, {'name': 'USN-4267-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/4267-1/'}]
CVE State: PUBLISHED
Explain CVE-2018-0498
ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack.
Affected Products: ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14
References: [{'name': '[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html'}, {'name': 'DSA-4296', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4296'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02'}, {'name': 'USN-4267-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/4267-1/'}]
CVE State: PUBLISHED
Explain CVE-2018-0499
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().
Affected Products: Xapian xapian-core before 1.4.6
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://trac.xapian.org/wiki/SecurityFixes/2018-07-02'}, {'name': 'USN-3709-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3709-1/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0500
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).
Affected Products: curl before 7.61.0
References: [{'name': '1041280', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041280'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/curl/curl/commit/ba1dbd78e5f1ed67c1b8d37ac89d90e5e330b628'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://curl.haxx.se/docs/adv_2018-70a2.html'}, {'name': 'GLSA-201807-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201807-04'}, {'name': 'RHSA-2018:2486', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2486'}, {'name': 'USN-3710-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3710-1/'}]
CVE State: PUBLISHED
Explain CVE-2018-0501
The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.
Affected Products: APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://mirror.fail'}, {'name': 'USN-3746-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3746-1/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47'}, {'tags': ['x_refsource_MISC'], 'url': 'https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec'}]
CVE State: PUBLISHED
Explain CVE-2018-0502
An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.
Affected Products: zsh before 5.6
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/908000'}, {'tags': ['x_refsource_MISC'], 'url': 'https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zsh.org/mla/zsh-announce/136'}, {'name': 'USN-3764-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3764-1/'}, {'name': 'GLSA-201903-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201903-02'}, {'name': '[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0503
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.
Affected Products: mediawiki
References: [{'name': '[wikitech-l] 20180920 Security release: 1.27.5 / 1.29.3 / 1.30.1 / 1.31.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html'}, {'name': '1041695', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041695'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T169545'}, {'name': 'DSA-4301', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4301'}, {'name': 'RHSA-2019:3142', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3142'}, {'name': 'RHSA-2019:3238', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3238'}, {'name': 'RHSA-2019:3813', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3813'}]
CVE State: PUBLISHED
Explain CVE-2018-0504
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid
Affected Products: mediawiki
References: [{'name': '[wikitech-l] 20180920 Security release: 1.27.5 / 1.29.3 / 1.30.1 / 1.31.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html'}, {'name': '1041695', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041695'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T187638'}, {'name': 'DSA-4301', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4301'}, {'name': 'RHSA-2019:3238', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3238'}, {'name': 'RHSA-2019:3813', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3813'}]
CVE State: PUBLISHED
Explain CVE-2018-0505
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock
Affected Products: mediawiki
References: [{'name': '[wikitech-l] 20180920 Security release: 1.27.5 / 1.29.3 / 1.30.1 / 1.31.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://phabricator.wikimedia.org/T194605'}, {'name': '1041695', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041695'}, {'name': 'DSA-4301', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4301'}, {'name': 'RHSA-2019:3142', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3142'}, {'name': 'RHSA-2019:3238', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3238'}, {'name': 'RHSA-2019:3813', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3813'}]
CVE State: PUBLISHED
Explain CVE-2018-0506
Nootka 1.4.4 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Affected Products: Nootka
References: [{'name': 'JVN#10103841', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN10103841/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0507
Untrusted search path vulnerability in FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.11 and earlier versions, FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.11 and earlier versions allow an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: FLET'S VIRUS CLEAR Easy Setup & Application Tool
References: [{'name': 'JVN#26255241', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN26255241/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0508
Cross-site scripting vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: epg search result viewer(kkcald)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://dbit.web.fc2.com/'}, {'name': 'JVN#91393903', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN91393903/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0509
Cross-site request forgery (CSRF) vulnerability in epg search result viewer (kkcald) 0.7.21 and earlier allows an attacker to hijack the authentication of administrators via unspecified vectors.
Affected Products: epg search result viewer(kkcald)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://dbit.web.fc2.com/'}, {'name': 'JVN#91393903', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN91393903/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0510
Buffer overflow in epg search result viewer (kkcald) 0.7.19 and earlier allows remote attackers to perform unintended operations or execute DoS (denial of service) attacks via unspecified vectors.
Affected Products: epg search result viewer(kkcald)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://dbit.web.fc2.com/'}, {'name': 'JVN#91393903', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN91393903/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0511
Cross-site scripting vulnerability in WP Retina 2x prior to version 5.2.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: WP Retina 2x
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/1802137/#file1'}, {'name': 'JVN#30636823', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN30636823/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0512
Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors.
Affected Products: IP address setting tool "MagicalFinder"
References: [{'name': 'JVN#36048131', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN36048131/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.iodata.jp/support/information/2018/magicalfinder/'}]
CVE State: PUBLISHED
Explain CVE-2018-0513
Cross-site scripting vulnerability in MTS Simple Booking C, MTS Simple Booking Business version 1.28.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: MTS Simple Booking C
References: [{'name': 'JVN#99312352', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN99312352/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mtssb.mt-systems.jp/jvn99312352/'}]
CVE State: PUBLISHED
Explain CVE-2018-0514
MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Affected Products: MP Form Mail CGI eCommerce Edition
References: [{'name': 'JVN#15462187', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN15462187/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.futomi.com/library/mpmailec.html#history'}]
CVE State: PUBLISHED
Explain CVE-2018-0515
Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: "FLET'S Azukeru Backup Tool"
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://flets.com/azukeru/login/news/info_180213.html'}, {'name': 'JVN#04564808', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN04564808/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0516
Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: FLET'S v4 / v6 address selection tool
References: [{'name': 'JVN#87403477', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN87403477/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://flets-w.com/topics/2018/20180207a.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0517
Untrusted search path vulnerability in Anshin net security for Windows Version 16.0.1.44 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Anshin net security for Windows
References: [{'name': 'JVN#70615027', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN70615027/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0518
LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: LINE for iOS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://linecorp.com/en/security/article/136'}, {'name': 'JVN#75453852', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN75453852/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0519
Cross-site scripting vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: FS010W
References: [{'name': 'JVN#83834277', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN83834277/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0520
Cross-site request forgery (CSRF) vulnerability in FS010W firmware FS010W_00_V1.3.0 and earlier allows an attacker to hijack the authentication of administrators via unspecified vectors.
Affected Products: FS010W
References: [{'name': 'JVN#83834277', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN83834277/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0521
Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.
Affected Products: WXR-1900DHP2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://buffalo.jp/support_s/s20180223.html'}, {'name': 'JVN#97144273', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN97144273/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0522
Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted file.
Affected Products: WXR-1900DHP2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://buffalo.jp/support_s/s20180223.html'}, {'name': 'JVN#97144273', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN97144273/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0523
Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
Affected Products: WXR-1900DHP2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://buffalo.jp/support_s/s20180223.html'}, {'name': 'JVN#97144273', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN97144273/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0524
Jubatus 1.0.2 and earlier allows remote code execution via unspecified vectors.
Affected Products: Jubatus
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/jubatus/jubatus/blob/master/ChangeLog.rst'}, {'name': 'JVN#56132776', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN56132776/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0525
Directory traversal vulnerability in Jubatus 1.0.2 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: Jubatus
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/jubatus/jubatus/blob/master/ChangeLog.rst'}, {'name': 'JVN#56132776', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN56132776/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0526
Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#51737843', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51737843/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10030'}]
CVE State: PUBLISHED
Explain CVE-2018-0527
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Cybozu Office
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10029'}, {'name': 'JVN#51737843', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51737843/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0528
Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified vectors.
Affected Products: Cybozu Office
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9812'}, {'name': 'JVN#51737843', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51737843/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0529
Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors.
Affected Products: Cybozu Office
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10052'}, {'name': 'JVN#51737843', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN51737843/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0530
SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9326'}, {'name': 'JVN#65268217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65268217/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0531
Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a folder and/or notification settings via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9349'}, {'name': 'JVN#65268217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65268217/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0532
Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9378'}, {'name': 'JVN#65268217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65268217/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0533
Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9375'}, {'name': 'JVN#65268217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65268217/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0534
Cross-site scripting vulnerability in ArsenoL Version 0.5 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: ArsenoL
References: [{'name': 'JVN#30864198', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN30864198/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0535
Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: PHP 2chBBS
References: [{'name': 'JVN#48774168', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN48774168/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0536
Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz.cgi.
Affected Products: QQQ SYSTEMS
References: [{'name': 'JVN#64990648', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN64990648/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0537
Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz_op.cgi.
Affected Products: QQQ SYSTEMS
References: [{'name': 'JVN#96655441', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN96655441/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0538
Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: QQQ SYSTEMS
References: [{'name': 'JVN#46471407', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN46471407/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0539
QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors.
Affected Products: QQQ SYSTEMS
References: [{'name': 'JVN#22536871', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN22536871/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0540
Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: ViX
References: [{'name': 'JVN#56764650', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN56764650/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0541
Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code via unspecified vectors.
Affected Products: Tiny FTP Daemon
References: [{'name': 'JVN#92259864', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN92259864/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0542
Directory traversal vulnerability in WebProxy version 1.7.8 allows an attacker to read arbitrary files via unspecified vectors.
Affected Products: WebProxy
References: [{'name': 'JVN#87226910', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN87226910/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0543
Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Jtrim
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://woodybells.com/jtrim.html'}, {'name': 'JVN#71816327', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN71816327/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0544
Untrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: WinShot
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://woodybells.com/winshot.html'}, {'name': 'JVN#01837169', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN01837169/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0545
LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Affected Products: LXR
References: [{'name': 'JVN#72589538', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN72589538/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lxr.sourceforge.net/en/bugsandlimits.php'}]
CVE State: PUBLISHED
Explain CVE-2018-0546
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: WP All Import
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/1742744/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/wp-all-import/#developers'}, {'name': 'JVN#33527174', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN33527174/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0547
Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: WP All Import
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/wp-all-import/#developers'}, {'name': 'JVN#60032768', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN60032768/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/1827741/'}]
CVE State: PUBLISHED
Explain CVE-2018-0548
Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9886'}, {'name': 'JVN#65268217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65268217/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0549
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'name': 'JVN#65268217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65268217/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10058'}]
CVE State: PUBLISHED
Explain CVE-2018-0550
Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10056'}, {'name': 'JVN#65268217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65268217/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0551
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10211'}, {'name': 'JVN#65268217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65268217/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0552
Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver. 5.1.26 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installer of PhishWall Client Firefox and Chrome edition for Windows
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.securebrain.co.jp/about/news/2018/03/180314.html'}, {'name': 'JVN#39896275', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN39896275/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0553
The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: iRemoconWiFi App for Android
References: [{'name': 'JVN#43382653', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN43382653/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://play.google.com/store/apps/details?id=jp.co.glamo.iremoconwifi'}]
CVE State: PUBLISHED
Explain CVE-2018-0554
Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.
Affected Products: WZR-1750DHP2
References: [{'name': 'JVN#93397125', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN93397125/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://buffalo.jp/support_s/s20180328.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0555
Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file.
Affected Products: WZR-1750DHP2
References: [{'name': 'JVN#93397125', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN93397125/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://buffalo.jp/support_s/s20180328.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0556
Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
Affected Products: WZR-1750DHP2
References: [{'name': 'JVN#93397125', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN93397125/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://buffalo.jp/support_s/s20180328.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0557
Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'E-mail Details Screen' via unspecified vectors.
Affected Products: Cybozu Mailwise
References: [{'name': 'JVN#52319657', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN52319657/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10194'}]
CVE State: PUBLISHED
Explain CVE-2018-0558
Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors.
Affected Products: Cybozu Mailwise
References: [{'name': 'JVN#52319657', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN52319657/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10193'}]
CVE State: PUBLISHED
Explain CVE-2018-0559
Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors.
Affected Products: Cybozu Mailwise
References: [{'name': 'JVN#52319657', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN52319657/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/10196'}]
CVE State: PUBLISHED