Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2018-0650
The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: LINE MUSIC for Android
References: [{'name': 'JVN#16933564', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN16933564/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://play.google.com/store/apps/details?id=jp.linecorp.linemusic.android&hl=en'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://linecorp.com/en/security/article/182'}]
CVE State: PUBLISHED
Explain CVE-2018-0651
Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and earlier, STARDOM FCN/FCJ Simulator R4.20 and earlier, ASTPLANNER R15.01 and earlier, TriFellows V5.04 and earlier) allows remote attackers to stop the license management function or execute an arbitrary program via unspecified vectors.
Affected Products: The license management function of YOKOGAWA products
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://web-material3.yokogawa.com/YSAR-18-0006-E.pdf'}, {'name': '105124', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105124'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jvn.jp/vu/JVNVU93845358/'}]
CVE State: PUBLISHED
Explain CVE-2018-0652
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page.
Affected Products: GROWI
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://weseek.co.jp/security/2018/07/31/growi-prevent-xss/'}, {'name': 'JVN#18716340', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18716340/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0653
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view.
Affected Products: GROWI
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://weseek.co.jp/security/2018/07/31/growi-prevent-xss/'}, {'name': 'JVN#18716340', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18716340/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0654
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page.
Affected Products: GROWI
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://weseek.co.jp/security/2018/07/31/growi-prevent-xss/'}, {'name': 'JVN#18716340', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18716340/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0655
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page.
Affected Products: GROWI
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://weseek.co.jp/security/2018/07/31/growi-prevent-xss/'}, {'name': 'JVN#18716340', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18716340/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0656
Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: The installer of Digital Paper App
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://esupport.sony.com/US/p/swu-download.pl?upd_id=10998&PASSVAL2=SMB.'}, {'name': 'JVN#75700242', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN75700242/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0657
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE
References: [{'name': 'JVN#06372244', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN06372244/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0658
Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier allows an attacker with administrative rights to execute arbitrary PHP code on the server via unspecified vectors.
Affected Products: EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE
References: [{'name': 'JVN#06372244', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN06372244/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0659
Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing files via specially crafted ATC file.
Affected Products: AttacheCase
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hibara.org/software/attachecase/?lang=en'}, {'name': 'JVN#62121133', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN62121133/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0660
Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file.
Affected Products: AttacheCase
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hibara.org/software/attachecase/?lang=en'}, {'name': 'JVN#62121133', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN62121133/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0661
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to bypass access restriction to add files on a specific directory that may result in executing arbitrary OS commands/code or information including credentials leakage or alteration.
Affected Products: Multiple I-O DATA network camera products
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.iodata.jp/support/information/2018/ts-wrlp/'}, {'name': 'JVN#83701666', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN83701666/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0662
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to add malicious files on the device and execute arbitrary code.
Affected Products: Multiple I-O DATA network camera products
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.iodata.jp/support/information/2018/ts-wrlp/'}, {'name': 'JVN#83701666', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN83701666/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0663
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) use hardcoded credentials which may allow an remote authenticated attacker to execute arbitrary OS commands on the device via unspecified vector.
Affected Products: Multiple I-O DATA network camera products
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.iodata.jp/support/information/2018/ts-wrlp/'}, {'name': 'JVN#83701666', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN83701666/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0664
A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors.
Affected Products: NoMachine App for Android
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.nomachine.com/TR06P08619'}, {'name': 'JVN#14451678', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN14451678/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0665
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0666.
Affected Products: Yamaha Broadband VoIP Router RT57i
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://flets-w.com/solution/kiki_info/info/180829.html'}, {'name': 'JVN#69967692', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN69967692/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://web116.jp/ced/support/news/contents/2018/20180829b.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN69967692.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0666
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0665.
Affected Products: Yamaha Broadband VoIP Router RT57i
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://flets-w.com/solution/kiki_info/info/180829.html'}, {'name': 'JVN#69967692', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN69967692/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://web116.jp/ced/support/news/contents/2018/20180829b.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN69967692.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0667
Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.mnc.co.jp/INplc/info_20180907_E.htm'}, {'name': 'JVN#59624986', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN59624986/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0668
Buffer overflow in INplc-RT 3.08 and earlier allows remote attackers to cause denial-of-service (DoS) condition that may result in executing arbtrary code via unspecified vectors.
Affected Products: INplc-RT
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.mnc.co.jp/INplc/info_20180907_E.htm'}, {'name': 'JVN#59624986', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN59624986/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0669
INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0670.
Affected Products: INplc-RT
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.mnc.co.jp/INplc/info_20180907_E.htm'}, {'name': 'JVN#59624986', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN59624986/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0670
INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0669.
Affected Products: INplc-RT
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.mnc.co.jp/INplc/info_20180907_E.htm'}, {'name': 'JVN#59624986', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN59624986/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0671
Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on the Windows system via unspecified vectors.
Affected Products: INplc-RT
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.mnc.co.jp/INplc/info_20180907_E.htm'}, {'name': 'JVN#59624986', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN59624986/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0672
Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Movable Type
References: [{'name': 'JVN#89550319', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN89550319/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0673
Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors.
Affected Products: Cybozu Garoon
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://cs.cybozu.co.jp/2018/006717.html'}, {'name': 'JVN#12583112', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN12583112/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0674
AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.
Affected Products: AttacheCase
References: [{'name': 'JVN#02037158', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN02037158/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://hibara.org/software/attachecase/?lang=en'}]
CVE State: PUBLISHED
Explain CVE-2018-0675
AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.
Affected Products: AttacheCase
References: [{'name': 'JVN#02037158', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN02037158/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://hibara.org/software/attachecase/?lang=en'}]
CVE State: PUBLISHED
Explain CVE-2018-0676
BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and execute an arbitrary command via unspecified vectors.
Affected Products: BN-SDWBP3
References: [{'name': 'JVN#65082538', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN65082538/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://p3.support.panasonic.com/faq/show/5017?&site_domain=p3'}]
CVE State: PUBLISHED
Explain CVE-2018-0677
BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS commands via unspecified vectors.
Affected Products: BN-SDWBP3
References: [{'name': 'JVN#65082538', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN65082538/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://p3.support.panasonic.com/faq/show/5017?&site_domain=p3'}]
CVE State: PUBLISHED
Explain CVE-2018-0678
Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via unspecified vectors.
Affected Products: BN-SDWBP3
References: [{'name': 'JVN#65082538', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN65082538/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://p3.support.panasonic.com/faq/show/5017?&site_domain=p3'}]
CVE State: PUBLISHED
Explain CVE-2018-0679
Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions) allows attacker with administrator rights to inject arbitrary web script or HTML via the administrative page.
Affected Products: multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.fxc.jp/news/20171228.html'}, {'name': 'JVN#68528150', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN68528150/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0680
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to read/send mail or change the configuration.
Affected Products: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/pop/support/security/181003.html'}, {'name': 'JVN#00344155', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00344155/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/imap/support/security/181003.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0681
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to login to the Management page and change the configuration.
Affected Products: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/pop/support/security/181003.html'}, {'name': 'JVN#00344155', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00344155/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/imap/support/security/181003.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0682
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) does not properly manage sessions, which allows remote attackers to read/send mail or change the configuration via unspecified vectors.
Affected Products: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/pop/support/security/181003.html'}, {'name': 'JVN#00344155', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00344155/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/imap/support/security/181003.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0683
Buffer overflow in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote attackers to execute arbitrary code or cause a denial-of-service (DoS) condition via Cookie data.
Affected Products: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/pop/support/security/181003.html'}, {'name': 'JVN#00344155', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00344155/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/imap/support/security/181003.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0684
Buffer overflow in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R3.0 and earlier, Denbun IMAP version V3.3I R3.0 and earlier) allows remote attackers to execute arbitrary code or cause a denial-of-service (DoS) condition via multipart/form-data format data.
Affected Products: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R3.0 and earlier, Denbun IMAP version V3.3I R3.0 and earlier)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/pop/support/security/181003.html'}, {'name': 'JVN#00344155', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00344155/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/imap/support/security/181003.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0685
SQL injection vulnerability in the Denbun POP version V3.3P R4.0 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via HTTP requests for mail search.
Affected Products: Denbun POP version V3.3P R4.0 and earlier
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/pop/support/security/181003.html'}, {'name': 'JVN#00344155', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00344155/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/imap/support/security/181003.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0686
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated attackers to upload and execute any executable files via unspecified vectors.
Affected Products: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/pop/support/security/181003.html'}, {'name': 'JVN#00344155', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00344155/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/imap/support/security/181003.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0687
Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/pop/support/security/181003.html'}, {'name': 'JVN#00344155', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00344155/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.denbun.com/en/imap/support/security/181003.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0690
An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to tamper with an update file and inject executable files.
Affected Products: Music Center for PC
References: [{'name': 'JVN#36623716', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN36623716/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://musiccenter.sony.net/en/downloads/update.php'}]
CVE State: PUBLISHED
Explain CVE-2018-0691
Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.au.com/information/notice_mobile/service/2018-002/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.softbank.jp/mobile/info/personal/news/service/20180927a/'}, {'name': 'JVN#37288228', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN37288228/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.nttdocomo.co.jp/info/notice/page/180927_00.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0692
Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Products: Baidu Browser
References: [{'name': 'JVN#77885134', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN77885134/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0693
Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in the specific directory in FileZen via unspecified vectors.
Affected Products: FileZen
References: [{'name': 'JVN#95355683', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN95355683/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.soliton.co.jp/support/2018/003328.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0694
FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Affected Products: FileZen
References: [{'name': 'JVN#95355683', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN95355683/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.soliton.co.jp/support/2018/003328.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0695
Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: User-friendly SVN (USVN)
References: [{'name': 'JVN#73794686', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN73794686/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.usvn.info/2018/10/02/usvn-1.0.8'}]
CVE State: PUBLISHED
Explain CVE-2018-0696
OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
Affected Products: OpenAM
References: [{'name': 'JVN#49995005', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN49995005/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.cs.themistruct.com/report/wam20181012'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.osstech.co.jp/support/am2018-4-1-en'}]
CVE State: PUBLISHED
Explain CVE-2018-0697
Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: Metabase
References: [{'name': 'JVN#14323043', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN14323043/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://metabase.com/'}]
CVE State: PUBLISHED
Explain CVE-2018-0698
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: GROWI
References: [{'name': 'JVN#96493183', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN96493183/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://weseek.co.jp/security/2018/12/25/growi-prevent-xss2/'}]
CVE State: PUBLISHED
Explain CVE-2018-0699
Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: YukiWiki
References: [{'name': 'JVN#36343375', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN36343375/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hyuki.com/yukiwiki/'}]
CVE State: PUBLISHED
Explain CVE-2018-0700
YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory resources and may result in causing a denial of service condition.
Affected Products: YukiWiki
References: [{'name': 'JVN#36343375', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN36343375/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hyuki.com/yukiwiki/'}]
CVE State: PUBLISHED
Explain CVE-2018-0701
BlueStacks App Player (BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and later) allows an attacker on the same network segment to bypass access restriction to gain unauthorized access.
Affected Products: BlueStacks App Player
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://support.bluestacks.com/hc/en-us/articles/360018274091'}, {'name': 'JVN#60702986', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN60702986/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0702
Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors.
Affected Products: Cybozu Mailwise
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://kb.cybozu.support/article/34135/'}, {'name': 'JVN#83739174', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN83739174/index.html'}]
CVE State: PUBLISHED
Explain CVE-2018-0703
Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests.
Affected Products: Cybozu Office
References: [{'name': 'JVN#15232217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN15232217/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://kb.cybozu.support/article/34088/'}]
CVE State: PUBLISHED
Explain CVE-2018-0704
Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen.
Affected Products: Cybozu Office
References: [{'name': 'JVN#15232217', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN15232217/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://kb.cybozu.support/article/34091/'}]
CVE State: PUBLISHED
Explain CVE-2018-0705
Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests.
Affected Products: Cybozu Dezie
References: [{'name': 'JVN#16697622', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/en/jp/JVN16697622/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://kb.cybozu.support/article/34089/'}]
CVE State: PUBLISHED
Explain CVE-2018-0706
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
Affected Products: Q'center Virtual Appliance
References: [{'name': '45015', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45015/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Jul/45'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html'}, {'name': '45043', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45043/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201807-10'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://www.securityfocus.com/archive/1/542141/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2018-0707
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
Affected Products: Q'center Virtual Appliance
References: [{'name': '45015', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45015/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Jul/45'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html'}, {'name': '45043', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45043/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201807-10'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://www.securityfocus.com/archive/1/542141/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2018-0708
Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
Affected Products: Q'center Virtual Appliance
References: [{'name': '45015', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45015/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Jul/45'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201807-10'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://www.securityfocus.com/archive/1/542141/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2018-0709
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
Affected Products: Q'center Virtual Appliance
References: [{'name': '45015', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45015/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Jul/45'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201807-10'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://www.securityfocus.com/archive/1/542141/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2018-0710
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
Affected Products: Q'center Virtual Appliance
References: [{'name': '45015', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45015/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Jul/45'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201807-10'}, {'name': '20180711 [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://www.securityfocus.com/archive/1/542141/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2018-0711
Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.
Affected Products: QTS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201804-27'}, {'name': '1040779', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040779'}]
CVE State: PUBLISHED
Explain CVE-2018-0712
Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions could allow remote attackers to run arbitrary commands or install malware on the NAS.
Affected Products: LDAP Server in QTS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201806-19'}, {'name': '1041141', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041141'}]
CVE State: PUBLISHED
Explain CVE-2018-0714
Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 and their earlier versions could allow remote attackers to run arbitrary commands in the compromised application.
Affected Products: Helpdesk in QTS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201808-13'}]
CVE State: PUBLISHED
Explain CVE-2018-0715
Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application.
Affected Products: Photo Station
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201808-23'}, {'name': '45348', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45348/'}]
CVE State: PUBLISHED
Explain CVE-2018-0716
Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application.
Affected Products: Qsync Central
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201811-29'}]
CVE State: PUBLISHED
Explain CVE-2018-0718
Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised application.
Affected Products: Music Station
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201809-14'}]
CVE State: PUBLISHED
Explain CVE-2018-0719
Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710.
Affected Products: QTS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201809-20'}]
CVE State: PUBLISHED
Explain CVE-2018-0721
Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710.
Affected Products: QTS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201809-20'}]
CVE State: PUBLISHED
Explain CVE-2018-0722
Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device.
Affected Products: Photo Station
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201901-14'}]
CVE State: PUBLISHED
Explain CVE-2018-0723
Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0724.
Affected Products: Q'center Virtual Appliance
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201812-26'}]
CVE State: PUBLISHED
Explain CVE-2018-0724
Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0723.
Affected Products: Q'center Virtual Appliance
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201812-26'}]
CVE State: PUBLISHED
Explain CVE-2018-0728
This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions.
Affected Products: QNAP NAS devices
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201911-20'}]
CVE State: PUBLISHED
Explain CVE-2018-0729
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions.
Affected Products: QNAP NAS devices
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201911-20'}]
CVE State: PUBLISHED
Explain CVE-2018-0730
This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Affected Products: QNAP NAS devices
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.qnap.com/zh-tw/security-advisory/nas-201911-20'}]
CVE State: PUBLISHED
Explain CVE-2018-0733
Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).
Affected Products: OpenSSL
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-07'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-04'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html'}, {'name': 'GLSA-201811-21', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201811-21'}, {'name': '103517', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103517'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-06'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20180330-0002/'}, {'name': '1040576', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040576'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56d5a4bfcaf37fa420aef2bb881aa55e61cf5f2f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.openssl.org/news/secadv/20180327.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html'}]
CVE State: PUBLISHED