Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-6356 State: PUBLISHED Published: 2018-02-20T15:00:00 Last Updated: 2024-08-05T06:01:48.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded. Additional Analyst No
le within the Jenkins home directory accessible to the Jenkins master process could be downloaded. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/02/14/1 - http://www.securityfocus.com/bid/103037 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2018-02-14/
CVE ID: CVE-2018-6357 State: PUBLISHED Published: 2018-01-27T17:00:00Z Last Updated: 2024-09-16T19:35:03.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS. Additional Analyst Notes: - CVE Program Container: References: - http://lists.openwall.net/full-disclosure/2018/01/10/8 - https://wordpress.org/plugins/acurax-social-media-widget/#developers
CVE ID: CVE-2018-6358 State: PUBLISHED Published: 2018-01-27T21:00:00 Last Updated: 2024-08-05T06:01:48.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: The printDefineFont2 function (util/listfdb.c) in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attackers to cause a denial of service or unspecified other impact via a crafted FDB file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/04/msg00008.html - https://github.com/libming/libming/issues/104 - https://security.gentoo.org/glsa/201904-24
CVE ID: CVE-2018-6359 State: PUBLISHED Published: 2018-01-27T21:00:00 Last Updated: 2024-08-05T06:01:48.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: The decompileIF function (util/decompile.c) in libming through 0.4.8 is vulnerable to a use-after-free, which may allow attackers to cause a denial of service or unspecified other impact via a crafted SWF file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00008.html - https://github.com/libming/libming/issues/105 - http://www.securityfocus.com/bid/102856 - https://security.gentoo.org/glsa/201904-24
CVE ID: CVE-2018-6360 State: PUBLISHED Published: 2018-01-28T02:00:00 Last Updated: 2024-08-05T06:01:48.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL. Additional An
e issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mpv-player/mpv/commit/e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43 - https://security.gentoo.org/glsa/201805-05 - https://github.com/mpv-player/mpv/issues/5456 - https://www.debian.org/security/2018/dsa-4105
CVE ID: CVE-2018-6361 State: PUBLISHED Published: 2018-05-11T21:00:00 Last Updated: 2024-08-05T06:01:48.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-XSS-FTP-BACKDOOR-ACCOUNT.txt - http://packetstormsecurity.com/files/147553/Easy-Hosting-Control-Panel-0.37.12.b-Cross-Site-Scripting-Add-FTP-Account.html
CVE ID: CVE-2018-6362 State: PUBLISHED Published: 2018-05-11T21:00:00 Last Updated: 2024-08-05T06:01:48.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-XSS-COOKIE-THEFT.txt - http://packetstormsecurity.com/files/147554/Easy-Hosting-Control-Panel-0.37.12.b-Cross-Site-Scripting-Cookie-Theft.html
CVE ID: CVE-2018-6363 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T06:01:48.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43914/ - https://packetstormsecurity.com/files/146131/Task-Rabbit-Clone-1.0-SQL-Injection.html
CVE ID: CVE-2018-6364 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T06:01:48.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43917/ - https://packetstormsecurity.com/files/146130/Multilanguage-Real-Estate-MLM-Script-3.0-SQL-Injection.html
CVE ID: CVE-2018-6365 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T06:01:48.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43915/ - https://packetstormsecurity.com/files/146128/TSiteBuilder-1.0-SQL-Injection.html
CVE ID: CVE-2018-6367 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T06:01:48.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category parameter. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/146136/Vastal-I-Tech-Facebook-Clone-2.9.9-SQL-Injection.html - https://www.exploit-db.com/exploits/43918/
CVE ID: CVE-2018-6368 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:01:48.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed action. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44117
CVE ID: CVE-2018-6370 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:01:48.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under the all-offers/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44123
CVE ID: CVE-2018-6372 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:01:49.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44115
CVE ID: CVE-2018-6373 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:01:49.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44109
CVE ID: CVE-2018-6374 State: PUBLISHED Published: 2018-01-31T21:00:00 Last Updated: 2024-08-05T06:01:49.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate Validation. This can lead to the manipulation of the Pulse Connection set. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102908 - http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43620
CVE ID: CVE-2018-6376 State: PUBLISHED Published: 2018-01-30T17:00:00 Last Updated: 2024-08-05T06:01:48.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040316 - https://developer.joomla.org/security-centre/722-20180105-core-sqli-vulnerability.html - http://www.securityfocus.com/bid/102916
CVE ID: CVE-2018-6377 State: PUBLISHED Published: 2018-01-30T17:00:00 Last Updated: 2024-08-05T06:01:49.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/720-20180103-core-xss-vulnerability.html - http://www.securitytracker.com/id/1040316 - http://www.securityfocus.com/bid/102917
CVE ID: CVE-2018-6378 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T06:01:49.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/737-20180509-core-xss-vulnerability-in-the-media-manager.html - http://www.securityfocus.com/bid/104268 - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-6379 State: PUBLISHED Published: 2018-01-30T17:00:00 Last Updated: 2024-08-05T06:01:49.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040316 - https://developer.joomla.org/security-centre/721-20180104-core-xss-vulnerability.html - http://www.securityfocus.com/bid/102918
CVE ID: CVE-2018-6380 State: PUBLISHED Published: 2018-01-30T17:00:00 Last Updated: 2024-08-05T06:01:48.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/718-20180101-core-xss-vulnerability.html - http://www.securitytracker.com/id/1040316 - http://www.securityfocus.com/bid/102921
CVE ID: CVE-2018-6381 State: PUBLISHED Published: 2018-01-29T17:00:00 Last Updated: 2024-08-05T06:01:49.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3699-1/ - https://github.com/gdraheim/zziplib/issues/12 - https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html - h
- https://github.com/gdraheim/zziplib/issues/12 - https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html - https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2018-6381
CVE ID: CVE-2018-6382 State: PUBLISHED Published: 2018-01-30T06:00:00 Last Updated: 2024-08-05T06:01:49.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass Additional Analyst Notes: - CVE Program Container: References: - http://archive.is/https:/mantisbt.org/bugs/view.php?id=23908 - https://man
Notes: - CVE Program Container: References: - http://archive.is/https:/mantisbt.org/bugs/view.php?id=23908 - https://mantisbt.org/bugs/view.php?id=23908
CVE ID: CVE-2018-6383 State: PUBLISHED Published: 2018-01-29T18:00:00 Last Updated: 2024-08-05T06:01:49.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monstra-cms/monstra/issues/429 - http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html - https://github.com/Ha
s/429 - http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html - https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-6383-Exploit
CVE ID: CVE-2018-6384 State: PUBLISHED Published: 2018-01-31T16:00:00 Last Updated: 2024-08-05T06:01:49.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with elevated privileges on the system via a malicious program.exe executable in the %SYSTEMDRIVE% folder. Additional Analyst Notes: - CVE Program Container: References: - https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_nsclient_-_cve-2018-6384.pdf - https://nsclient.org/blog/2018/01/30/CVE-2018-6384-0.3.9/
CVE ID: CVE-2018-6387 State: PUBLISHED Published: 2018-01-29T18:00:00Z Last Updated: 2024-09-16T16:43:09.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of support for the support account, and a hardcoded password of user for the user account. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3654
CVE ID: CVE-2018-6388 State: PUBLISHED Published: 2018-01-29T18:00:00Z Last Updated: 2024-09-16T22:40:23.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping test arguments on the Diagnostics page. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3654
CVE ID: CVE-2018-6389 State: PUBLISHED Published: 2018-02-06T17:00:00 Last Updated: 2024-08-05T06:01:49.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103060 - https://wpvulndb.com/vulnerabilities/9021 - https://www.exploit-db.com/exploits/43968/ - https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.ht
s://www.exploit-db.com/exploits/43968/ - https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html - http://www.securitytracker.com/id/1040347 - https://thehackernews.com/2018/02/wordpress-dos-exploit.html - https://github.com/WazeHell/CVE-2018-6389 - https://github.com/UltimateHackers/Shiva
CVE ID: CVE-2018-6390 State: PUBLISHED Published: 2018-01-29T19:00:00Z Last Updated: 2024-09-17T03:42:45.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of the source memory block before an _copy call, which allows remote attackers to cause a denial of service (access violation and application crash) via a crafted (a) web page, (b) office document, or (c) .rtf file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Khwarezmia/WPS_POC/tree/master/wps_20180129
CVE ID: CVE-2018-6391 State: PUBLISHED Published: 2018-01-29T19:00:00Z Last Updated: 2024-09-17T01:51:50.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation List settings. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/146117/netiswf2419-xsrf.txt - https://www.exploit-db.com/exploits/43919/ - https://0day.today/exploit/29659
CVE ID: CVE-2018-6392 State: PUBLISHED Published: 2018-01-29T19:00:00 Last Updated: 2024-08-05T06:01:49.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file. Additional Analyst Notes: - CVE Program Container: References: - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c6939f65a116b1ffed345d29d8621ee4ffb32235 - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/3f621455d62e46745453568d915badd5b1e5bcd5 - http://www.securityfocus.com/bid/102848 - https://www.debian.org/security/2018/dsa-4249 - https://lists.de
dd5b1e5bcd5 - http://www.securityfocus.com/bid/102848 - https://www.debian.org/security/2018/dsa-4249 - https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html
CVE ID: CVE-2018-6393 State: PUBLISHED Published: 2018-01-29T20:00:00 Last Updated: 2024-08-05T06:01:49.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can "directly modify SQL tables ... [or] run shell scripts ... once ... logged in to the administration interface; there is no need to try to find input validation errors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/c610/tmp/blob/master/sqlipoc-freepbx-14.0.1.24-req.txt - http://www.securit
Container: References: - https://github.com/c610/tmp/blob/master/sqlipoc-freepbx-14.0.1.24-req.txt - http://www.securityfocus.com/bid/102854 - http://code610.blogspot.com/2018/01/post-auth-sql-injection-in-freepbx.html
CVE ID: CVE-2018-6394 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:01:49.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44114
CVE ID: CVE-2018-6395 State: PUBLISHED Published: 2018-01-30T15:00:00 Last Updated: 2024-08-05T06:01:49.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43933/
CVE ID: CVE-2018-6396 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:01:49.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a layout=form_markers action, or the map parameter in a layout=default action. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44113 - http://www.securityfocus.com/bid/103094
CVE ID: CVE-2018-6397 State: PUBLISHED Published: 2018-01-30T15:00:00 Last Updated: 2024-08-05T06:01:49.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43931/
CVE ID: CVE-2018-6398 State: PUBLISHED Published: 2018-01-30T15:00:00 Last Updated: 2024-08-05T06:01:49.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43932/
CVE ID: CVE-2018-6400 State: PUBLISHED Published: 2018-03-12T21:00:00 Last Updated: 2024-08-05T06:01:49.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kingsoft WPS Office Free 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of \\.\pipe\WPSCloudSvr\WpsCloudSvr -- an "insecurely created named pipe." Ensures full access to Everyone users group. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/27
CVE ID: CVE-2018-6401 State: PUBLISHED Published: 2018-05-02T07:00:00 Last Updated: 2024-08-05T06:01:49.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://garrettmiller.github.io/meross-mss110-vuln/
CVE ID: CVE-2018-6402 State: PUBLISHED Published: 2020-04-14T18:40:34 Last Updated: 2024-08-05T06:01:49.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal. An attacker must be able to set up a nearby SSID, similar to an "Evil Twin" attack. Additional Analyst Notes: - CVE Program Container: References: - https://garrettmiller.github.io/meross-mss110-vuln/