Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
-> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2018-5743 - https://www.synology.com/security/advisory/Synology_SA_19_20 - https://support.f5.com/csp/article/K74009656?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2018-5744 State: PUBLISHED Published: 2019-10-09T14:17:14.332021Z Last Updated: 2024-09-16T22:21:17.098Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: By exploiting this condition, an attacker can potentially cause named's memory use to grow without bounds until all memory available to the process is exhausted. Typically a server process is limited as to the amount of memory it can use but if the named process is not limited by the operating system all free memory on the server could be exhausted. Description: A failure to free memory can occur when processing messages having a specific combination of EDNS opti
ted. Description: A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2018-5744
CVE ID: CVE-2018-5745 State: PUBLISHED Published: 2019-10-09T14:17:14.370307Z Last Updated: 2024-09-16T23:51:32.462Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: This particular vulnerability would be very difficult for an arbitrary attacker to use because it requires an operator to have BIND configured to use a trust anchor managed by the attacker. However, if successfully exercised, the defect will cause named to deliberately exit after encountering an assertion failure. It is more likely, perhaps, that this bug could be encountered accidentally, as not all versions of BIND support the same set of cryptographic algori
hat this bug could be encountered accidentally, as not all versions of BIND support the same set of cryptographic algorithms. Specifically, recent branches of BIND have begun deliberately removing support for cryptographic algorithms that are now deprecated (for example because they are no longer considered sufficiently secure.) This vulnerability could be encountered if a resolver running a version of BIND which has removed support for deprecated algorithms is configured to use a trust anchor which elects to change algorithm types to one of those deprecated algorithms. Support for GOST was removed from BIND in 9.13.1. Support for DSA was removed from BIND in 9.13.4 Support for RSAMD5 will b
port for GOST was removed from BIND in 9.13.1. Support for DSA was removed from BIND in 9.13.4 Support for RSAMD5 will be removed from future BIND releases in the 9.13 branch and higher. Description: "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, a
ch use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2018-5745 - https://access.redhat.com/errata/RHSA-2019:3552
CVE ID: CVE-2018-5746 State: REJECTED Published: 2020-02-07T16:25:18 Last Updated: 2020-02-07T16:25:18 Description: No description available.
CVE ID: CVE-2018-5747 State: PUBLISHED Published: 2018-01-17T19:00:00 Last Updated: 2024-08-05T05:40:51.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckolivas/lrzip/issues/90 - https://lists.debian.org/debian-lts-announce/2021/08/msg00001.html
CVE ID: CVE-2018-5748 State: PUBLISHED Published: 2018-01-25T16:00:00 Last Updated: 2024-08-05T05:40:51.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1396 - https://www.debian.org/security/2018/dsa-4137 - https://www.redhat.com/archives/libvir-list/2018-January/msg00527.html - https://access.redhat.com/errata/RHSA-2018:1929 - http://www.securityfocus.com/bid/102825 - https://lists.debian.org/debian-lts-announce/2018/03/msg00018.html
CVE ID: CVE-2018-5749 State: PUBLISHED Published: 2018-01-23T19:00:00 Last Updated: 2024-08-05T05:40:51.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/
CVE ID: CVE-2018-5750 State: PUBLISHED Published: 2018-01-26T19:00:00 Last Updated: 2024-08-05T05:40:51.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an SBS HC printk call. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3631-2/ - https://www.debian.org/security/2018/dsa-4187 - http://www.securitytracker.com/id/1040319 - https://usn.ubuntu.com/3631-1/ - https://www.debian.org/security/2018/dsa-4120 - https://usn.ubuntu.com/3697-1/ - https://access.redhat.com/er
/3631-1/ - https://www.debian.org/security/2018/dsa-4120 - https://usn.ubuntu.com/3697-1/ - https://access.redhat.com/errata/RHSA-2018:1062 - https://access.redhat.com/errata/RHSA-2018:2948 - https://usn.ubuntu.com/3697-2/ - https://access.redhat.com/errata/RHSA-2018:0676 - https://patchwork.kernel.org/patch/10174835/ - https://usn.ubuntu.com/3698-1/ - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3698-2/
CVE ID: CVE-2018-5751 State: PUBLISHED Published: 2018-06-15T21:00:00 Last Updated: 2024-08-05T05:40:51.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclis
pp-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/fulldisclosure/2018/Jun/23
CVE ID: CVE-2018-5752 State: PUBLISHED Published: 2018-06-15T21:00:00 Last Updated: 2024-08-05T05:40:51.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.co
ormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/fulldisclosure/2018/Jun/23
CVE ID: CVE-2018-5753 State: PUBLISHED Published: 2018-06-15T21:00:00 Last Updated: 2024-08-05T05:40:51.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a (1) From or (2) Sender address. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/f
-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/fulldisclosure/2018/Jun/23
CVE ID: CVE-2018-5754 State: PUBLISHED Published: 2018-06-15T21:00:00 Last Updated: 2024-08-05T05:40:51.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/fulldi
4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/fulldisclosure/2018/Jun/23
CVE ID: CVE-2018-5755 State: PUBLISHED Published: 2018-06-15T21:00:00 Last Updated: 2024-08-05T05:40:51.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org
te-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/fulldisclosure/2018/Jun/23
CVE ID: CVE-2018-5756 State: PUBLISHED Published: 2018-06-15T21:00:00 Last Updated: 2024-08-05T05:40:51.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/tasks. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/explo
rity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html - https://www.exploit-db.com/exploits/44881/ - http://seclists.org/fulldisclosure/2018/Jun/23
CVE ID: CVE-2018-5757 State: PUBLISHED Published: 2019-04-01T16:17:30 Last Updated: 2024-08-05T05:40:51.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to Remote Code Execution via shell metacharacters in the query string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2018-5757
CVE ID: CVE-2018-5758 State: PUBLISHED Published: 2018-03-12T21:00:00 Last Updated: 2024-08-05T05:40:51.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research/xml-external-entity-injection-xxe-cve-2018-5758/
CVE ID: CVE-2018-5759 State: PUBLISHED Published: 2018-01-24T21:00:00 Last Updated: 2024-08-05T05:40:51.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service (excessive recursion) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102833 - https://bugs.ghostscript.com/show_bug.cgi?id=698868 - http://git.ghostscript.com/?p=mujs.git%3Ba=commit%3Bh=4d45a96e57fbabf00a7378b337d0ddcace6f38c1 - https://www.exploit-db.com/exploits/43904/
CVE ID: CVE-2018-5761 State: PUBLISHED Published: 2018-01-22T17:00:00 Last Updated: 2024-08-05T05:40:51.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vulnerability might expose Rubrik user credentials configured to access vCenter as Rubrik clusters did not verify TLS certificates presented by vCenter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/srau/0ed7747953b3571247a6c485f91619ff - https://support.rubrik.com/articles/How_To/000001135
CVE ID: CVE-2018-5762 State: PUBLISHED Published: 2018-02-26T15:00:00 Last Updated: 2024-08-05T05:40:51.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TLS implementation in the TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 58.1 before 58.160, 59.1 before 059.1a.17 (IC #17), and 60.0 before 60.044 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=46
CVE ID: CVE-2018-5763 State: PUBLISHED Published: 2018-02-19T21:00:00 Last Updated: 2024-08-05T05:40:51.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1. By entering specially crafted URLs, an attacker is able to bring the shop server to a standstill and hence, it stops working. This is only valid if OXID High Performance Option is activated and Varnish is used. Additional Analyst Notes: - CVE Program Container: References: - https://oxidforge.org/en/security-bulletin-2018-001.html
CVE ID: CVE-2018-5764 State: PUBLISHED Published: 2018-01-17T22:00:00 Last Updated: 2024-08-05T05:40:51.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/01/msg00021.html - https://git.samba.org/rsync.git/?p=rsync.git%3Ba=commit%3Bh=7706303828fcde524222babb2833864a4bd09e07 - http://www.securitytracker.com/id/1040276 - https://usn.ubuntu.com/3543-1/ - https://se
fcde524222babb2833864a4bd09e07 - http://www.securitytracker.com/id/1040276 - https://usn.ubuntu.com/3543-1/ - https://security.gentoo.org/glsa/201805-04 - http://www.securityfocus.com/bid/102803 - https://download.samba.org/pub/rsync/src-previews/rsync-3.1.3pre1-NEWS - https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html - https://lists.debian.org/debian-lts-announce/2021/11/msg00028.html
CVE ID: CVE-2018-5766 State: PUBLISHED Published: 2018-01-18T07:00:00 Last Updated: 2024-08-05T05:40:51.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Libav through 12.2, there is an invalid memcpy in the av_packet_ref function of libavcodec/avpacket.c. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted avi file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.libav.org/show_bug.cgi?id=1112 - http://www.securityfocus.com/bid/102793 - https://lists.debian.org/debian-lts-announce/2019/09/msg00000.html
CVE ID: CVE-2018-5767 State: PUBLISHED Published: 2018-02-15T23:00:00 Last Updated: 2024-08-05T05:40:51.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted password parameter for the COOKIE header. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44253/ - https://www.fidusinfosec.com/remote-code-execution-cve-2018-5767/
CVE ID: CVE-2018-5768 State: PUBLISHED Published: 2018-03-20T19:00:00 Last Updated: 2024-08-05T05:40:51.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote, unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter for the COOKIE header. Additional Analyst Notes: - CVE Program Container: References: - https://www.fidusinfosec.com/tenda-ac15-hard-coded-accounts-cve-2018-5768/
CVE ID: CVE-2018-5770 State: PUBLISHED Published: 2018-03-20T15:00:00 Last Updated: 2024-08-05T05:40:51.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a request to /goform/telnet, creating a telnetd service on the device. This service is password protected; however, several default accounts exist on the device that are root accounts, which can be used to log in. Additional Analyst Notes: - CVE Program Container: References: - https://www.fidusinfosec.com/tenda-ac15-unauthenticated-telnetd-start-cve-2018-5770/
CVE ID: CVE-2018-5772 State: PUBLISHED Published: 2018-01-18T07:00:00 Last Updated: 2024-08-05T05:40:51.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 0.26, there is a segmentation fault caused by uncontrolled recursion in the Exiv2::Image::printIFDStructure function in the image.cpp file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102789 - https://security.gentoo.org/glsa/201811-14 - https://github.com/Exiv2/exiv2/issues/216
CVE ID: CVE-2018-5773 State: PUBLISHED Published: 2018-01-18T21:00:00Z Last Updated: 2024-09-16T17:47:46.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/trentm/python-markdown2/issues/285
CVE ID: CVE-2018-5776 State: PUBLISHED Published: 2018-01-18T22:00:00 Last Updated: 2024-08-05T05:40:51.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/ - https://wpvulndb.com/vulnerabilities/9006 - https://github.com/WordPress/WordPress/commit/3fe9cb61ee71fcfadb5e002399296fcc1198d850 - https://codex.wordpress.org/Version_4.9.2
CVE ID: CVE-2018-5777 State: PUBLISHED Published: 2018-01-24T15:00:00 Last Updated: 2024-08-05T05:40:51.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Remote clients can take advantage of a misconfiguration in the TFTP server that could allow attackers to execute arbitrary commands on the TFTP server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/NM/WhatsUpGold2017Plus/01_ReleaseNotes/17PlusSP1/#link4
CVE ID: CVE-2018-5778 State: PUBLISHED Published: 2018-01-24T15:00:00 Last Updated: 2024-08-05T05:40:51.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Multiple SQL injection vulnerabilities are present in the legacy .ASP pages, which could allow attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/NM/WhatsUpGold2017Plus/01_ReleaseNotes/17PlusSP1/#link4
CVE ID: CVE-2018-5779 State: PUBLISHED Published: 2018-03-14T16:00:00 Last Updated: 2024-08-05T05:40:51.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to copy a malicious script into a newly generated PHP file and then execute the generated file using specially crafted requests. Successful exploit could allow an attacker to execute arbitrary code within the context of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-ad
application. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004
CVE ID: CVE-2018-5780 State: PUBLISHED Published: 2018-03-14T16:00:00 Last Updated: 2024-08-05T05:40:51.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using specially crafted requests to the vnewmeeting.php page. Successful exploit could allow an attacker to execute arbitrary PHP code within the context of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-
E Program Container: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004