Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-13990 State: PUBLISHED Published: 2019-05-06T18:47:16 Last Updated: 2024-08-05T09:21:40.970Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AC:L/AV:N/A:L/C:H/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of Excessive Authentication Attempts. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02 - http://www.securityfocus.com/bid/106737
CVE ID: CVE-2018-13991 State: PUBLISHED Published: 2019-05-07T17:24:24 Last Updated: 2024-08-05T09:21:40.924Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02 - http://www.securityfocus.com/bid/106737
CVE ID: CVE-2018-13992 State: PUBLISHED Published: 2019-05-07T17:28:17 Last Updated: 2024-08-05T09:21:40.731Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by default. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02 - http://www.securityfocus.com/bid/106737
CVE ID: CVE-2018-13993 State: PUBLISHED Published: 2019-05-07T17:32:25 Last Updated: 2024-08-05T09:21:40.827Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02 - http://www.securityfocus.com/bid/106737
CVE ID: CVE-2018-13994 State: PUBLISHED Published: 2019-05-07T17:36:17 Last Updated: 2024-08-05T09:21:40.712Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than 120 connections. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02 - http://www.securityfocus.com/bid/106737
CVE ID: CVE-2018-13996 State: PUBLISHED Published: 2018-07-12T12:00:00 Last Updated: 2024-08-05T09:21:40.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Genann through 2018-07-08 has a stack-based buffer over-read in genann_train in genann.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/codeplea/genann/issues/24#issue-340516591
CVE ID: CVE-2018-13997 State: PUBLISHED Published: 2018-07-12T12:00:00 Last Updated: 2024-08-05T09:21:40.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Genann through 2018-07-08 has a SEGV in genann_run in genann.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/codeplea/genann/issues/24#issuecomment-404429236
CVE ID: CVE-2018-13998 State: PUBLISHED Published: 2018-07-12T12:00:00 Last Updated: 2024-08-05T09:21:40.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClipperCMS/ClipperCMS/issues/491
CVE ID: CVE-2018-13999 State: PUBLISHED Published: 2018-07-12T12:00:00 Last Updated: 2024-08-05T09:21:40.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwlrbh/Catfish/issues/2
CVE ID: CVE-2018-14001 State: PUBLISHED Published: 2018-07-12T15:00:00 Last Updated: 2024-08-05T09:21:40.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability exists in the function batchTransfer of SHARKTECH (SKT), an Ethereum token smart contract. An attacker could use it to set any user's balance. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VenusADLab/EtherTokens/blob/master/SHARKTECH/SHARKTECH.md
CVE ID: CVE-2018-14002 State: PUBLISHED Published: 2018-07-12T15:00:00 Last Updated: 2024-08-05T09:21:40.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability exists in the function distribute of MP3 Coin (MP3), an Ethereum token smart contract. An attacker could use it to set any user's balance. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VenusADLab/EtherTokens/blob/master/SHARKTECH/SHARKTECH.md - https://github.com/VenusADLab/EtherTokens/tree/master/MP3%20Coin%28MP3%29
CVE ID: CVE-2018-14003 State: PUBLISHED Published: 2018-07-12T15:00:00 Last Updated: 2024-08-05T09:21:40.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability exists in the function batchTransfer of WeMediaChain (WMC), an Ethereum token smart contract. An attacker could use it to set any user's balance. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VenusADLab/EtherTokens/blob/master/SHARKTECH/SHARKTECH.md - https://github.com/VenusADLab/EtherTokens/tree/master/WeMediaChain%28WMC%29
CVE ID: CVE-2018-14004 State: PUBLISHED Published: 2018-07-12T15:00:00 Last Updated: 2024-08-05T09:21:40.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability exists in the function transfer_tokens_after_ICO of GlobeCoin (GLB), an Ethereum token smart contract. An attacker could use it to set any user's balance. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VenusADLab/EtherTokens/blob/master/SHARKTECH/SHARKTECH.md - https://github.com/VenusADLab/EtherTokens/tree/master/GlobeCoin%28GLB%29
CVE ID: CVE-2018-14005 State: PUBLISHED Published: 2018-07-12T15:00:00 Last Updated: 2024-08-05T09:21:40.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability exists in the function transferAny of Malaysia coins (Xmc), an Ethereum token smart contract. An attacker could use it to set any user's balance. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VenusADLab/EtherTokens/blob/master/SHARKTECH/SHARKTECH.md - https://github.com/VenusADLab/EtherTokens/tree/master/Malaysia%20coins%28Xmc%29
CVE ID: CVE-2018-14006 State: PUBLISHED Published: 2018-07-12T15:00:00 Last Updated: 2024-08-05T09:21:40.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability exists in the function multipleTransfer of Neo Genesis Token (NGT), an Ethereum token smart contract. An attacker could use it to set any user's balance. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VenusADLab/EtherTokens/blob/master/SHARKTECH/SHARKTECH.md - https://github.com/VenusADLab/EtherTokens/tree/master/Neo%20Genesis%20Token%28NGT%29
CVE ID: CVE-2018-14007 State: PUBLISHED Published: 2018-08-15T18:00:00 Last Updated: 2024-08-05T09:21:40.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix XenServer 7.1 and newer allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-271.html - http://www.securityfocus.com/bid/105110 - https://support.citrix.com/article/CTX236548
CVE ID: CVE-2018-14008 State: PUBLISHED Published: 2019-08-15T16:26:51 Last Updated: 2024-08-05T09:21:40.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices - https://www.arista.com/en/support/advisories-notices/security-advisories/6072-security-advisory-38
CVE ID: CVE-2018-14009 State: PUBLISHED Published: 2018-07-12T16:00:00 Last Updated: 2024-08-05T09:21:40.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WangYihang/Codiad-Remote-Code-Execute-Exploit - https://github.com/Codiad/Codiad/issues/1078 - http://packetstormsecurity.com/files/161944/Codiad-2.8.4-Remote-Code-Execution.html
CVE ID: CVE-2018-14010 State: PUBLISHED Published: 2018-07-15T03:00:00 Last Updated: 2024-08-05T09:21:40.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data. Additional Analyst Notes: - CVE Program Container: References: - http://www.cnvd.org.cn/flaw/show/CNVD-2018-04521 - https://github.com/cc-crack/router/blob/master/CNVD-2018-04521.py
CVE ID: CVE-2018-14012 State: PUBLISHED Published: 2018-07-12T19:00:00Z Last Updated: 2024-09-17T00:16:04.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: WolfSight CMS 3.2 allows SQL injection via the PATH_INFO to the default URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44997/
CVE ID: CVE-2018-14013 State: PUBLISHED Published: 2019-05-29T21:24:02 Last Updated: 2024-08-05T09:21:40.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151472/Zimbra-Collaboration-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2019/Feb/3 - http://www.openwall.com/lists/oss-security/2019/01/30/1 - http://www.securityfocus.com/bid/106787 - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://bugzilla.zimbra.com/show_bug.cgi?id=109018 - https://b
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://bugzilla.zimbra.com/show_bug.cgi?id=109018 - https://bugzilla.zimbra.com/show_bug.cgi?id=109017
CVE ID: CVE-2018-14014 State: PUBLISHED Published: 2018-07-12T19:00:00Z Last Updated: 2024-09-16T23:16:49.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caokang/waimai/issues/2
CVE ID: CVE-2018-14015 State: PUBLISHED Published: 2018-07-12T20:00:00 Last Updated: 2024-08-05T09:21:40.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/10465 - https://github.com/radareorg/radare2/commit/d37d2b858ac47f2f108034be0bcecadaddfbc8b3
CVE ID: CVE-2018-14016 State: PUBLISHED Published: 2018-07-12T20:00:00 Last Updated: 2024-08-05T09:21:40.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Mini Crash Dump file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/10464 - https://github.com/radareorg/radare2/commit/eb7deb281df54771fb8ecf5890dc325a7d22d3e2
CVE ID: CVE-2018-14017 State: PUBLISHED Published: 2018-07-12T20:00:00 Last Updated: 2024-08-05T09:21:40.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in r_bin_java_line_number_table_attr_new. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/10498 - https://github.com/radareorg/radare2/commit/e9ce0d64faf19fa4e9c260250fbdf25e3c11e152
CVE ID: CVE-2018-14020 State: PUBLISHED Published: 2018-08-20T22:00:00 Last Updated: 2024-08-05T09:21:40.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one that is not verified by the Paymorrow module. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.oxid-esales.com/view.php?id=6801 - https://oxidforge.org/en/security-bulletin-2018-003.html
CVE ID: CVE-2018-14023 State: PUBLISHED Published: 2018-08-20T22:00:00 Last Updated: 2024-08-05T09:21:40.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage. Additional Analyst Notes: - CVE Program Container: References: - http://n0sign4l.blogspot.com/2018/08/advisory-id-n0sign4l-002-risk-level-4-5.html?m=1 - https://www.youtube.com/watch?v=oSJscEei5SE&app=desktop
CVE ID: CVE-2018-14027 State: PUBLISHED Published: 2019-07-05T15:43:02 Last Updated: 2024-08-05T09:21:40.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page. Additional Analyst Notes: - CVE Program Container: References: - https://indiancybersecuritysolutions.com/cve-2018-14027-xss-scripting-brute-force
CVE ID: CVE-2018-14028 State: PUBLISHED Published: 2018-08-10T16:00:00 Last Updated: 2024-08-05T09:21:40.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does have the required capabilities for plugin uploads) cannot simply place arbitrary PHP code into a valid plugin ZIP file and upload that
ed capabilities for plugin uploads) cannot simply place arbitrary PHP code into a valid plugin ZIP file and upload that plugin, because a machine's wp-content/plugins directory permissions were set up to block all new plugins. Additional Analyst Notes: - CVE Program Container: References: - https://core.trac.wordpress.org/ticket/44710 - https://github.com/rastating/wordpress-exploit-framework/pull/52 - https://rastating.github.io/unrestricted-file-upload-via-plugin-uploader-in-wordpress/ - http://www.securityfocus.com/bid/105060
CVE ID: CVE-2018-14029 State: PUBLISHED Published: 2018-07-13T02:00:00 Last Updated: 2024-08-05T09:21:40.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45127/ - https://github.com/Creatiwity/wityCMS/issues/153
CVE ID: CVE-2018-14031 State: PUBLISHED Published: 2018-07-13T02:00:00Z Last Updated: 2024-09-17T02:36:08.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5T_copy in H5T.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/hdf5/README2.md
CVE ID: CVE-2018-14032 State: REJECTED Published: 2018-07-13T02:00:00 Last Updated: 2018-08-29T23:57:01 Description: No description available.
CVE ID: CVE-2018-14033 State: PUBLISHED Published: 2018-07-13T02:00:00Z Last Updated: 2024-09-16T17:08:43.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_layout_decode in H5Olayout.c, related to HDmemcpy. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/hdf5/README2.md
CVE ID: CVE-2018-14034 State: PUBLISHED Published: 2018-07-13T02:00:00Z Last Updated: 2024-09-17T00:36:02.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in the function H5O_pline_reset in H5Opline.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/hdf5/README2.md
CVE ID: CVE-2018-14035 State: PUBLISHED Published: 2018-07-13T02:00:00Z Last Updated: 2024-09-17T01:26:33.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5VM_memcpyvv in H5VM.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/hdf5/README2.md
CVE ID: CVE-2018-14036 State: PUBLISHED Published: 2018-07-13T12:00:00 Last Updated: 2024-08-05T09:21:40.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c. Additional Analyst Notes: - CVE Program Container: References: - https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a - http://www.openwall.com/lists/oss-security/2018/07/02/2 - https://bugs.freedesktop.org/show_bug.cgi?id=107085 - http://www.securityfocus.com/bid/104757 - https://bugzilla.suse.com/show_bug.cgi?id=10
ktop.org/show_bug.cgi?id=107085 - http://www.securityfocus.com/bid/104757 - https://bugzilla.suse.com/show_bug.cgi?id=1099699
CVE ID: CVE-2018-14037 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T09:21:40.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload gets executed. Furthermore, if the payload is reflected at any other resource that does rely on the sanitisation of the editor itself, the JavaScript payload will be executed in the context of the application. This allows attackers (
of the editor itself, the JavaScript payload will be executed in the context of the application. This allows attackers (in the worst case) to take over user sessions. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/en/blog/advisories/stored-cross-site-scripting-in-kendo-ui-editor-cve-2018-14037/ - http://seclists.org/fulldisclosure/2018/Sep/49 - http://seclists.org/fulldisclosure/2018/Sep/50
CVE ID: CVE-2018-14038 State: REJECTED Published: 2019-03-07T22:00:00 Last Updated: 2019-03-27T14:54:02 Description: No description available.
CVE ID: CVE-2018-14040 State: PUBLISHED Published: 2018-07-13T14:00:00 Last Updated: 2024-08-05T09:21:41.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/08/msg00027.html - https://seclists.org/bugtraq/2019/May/18 - http://seclists.org/fulldisclosure/2019/May/11 - http://seclists.org/fulldisclosure/2019/May/10 - http://seclists.org/fulldisclosure/2019/May/13 - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E
://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html - http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html - https://lists.apache.org/th
s.html - http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html - https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://github.com/twbs/bootstrap/pull/26630 - https://github.com/twbs/bootstrap/issues/26423 - https://github.com/twbs/bootstrap/issues/26625 - https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/ - https://www.tenable.com/security/tns-2021-14
CVE ID: CVE-2018-14041 State: PUBLISHED Published: 2018-07-13T14:00:00 Last Updated: 2024-08-05T09:21:40.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/May/18 - http://seclists.org/fulldisclosure/2019/May/11 - http://seclists.org/fulldisclosure/2019/May/10 - http://seclists.org/fulldisclosure/2019/May/13 - https://access.redhat.com/errata/RHSA-2019:1456 - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E - https://lists
org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html - http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html - https://lists.apache.org/thread.html/r3dc0c
packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html - https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://github.com/twbs/bootstrap/pull/26630 - https://github.com/twbs/bootstrap/issues/26423 - https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/ - https://github.com/twbs/bootstrap/issues/26627