Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-12995 State: PUBLISHED Published: 2018-06-29T12:00:00 Last Updated: 2024-08-05T08:52:49.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rocktronica/OneFileCMS/issues/8
CVE ID: CVE-2018-12996 State: PUBLISHED Published: 2018-06-29T12:00:00 Last Updated: 2024-08-05T08:52:49.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jul/71 - http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html - https://github.com/unh3x/just4cve/issues/7 - http://www.cnnvd.org.cn/web/xx
790-build-XSS-File-Read-File-Deletion.html - https://github.com/unh3x/just4cve/issues/7 - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-038 - https://www.manageengine.com/products/applications_manager/issues.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-12996.html
CVE ID: CVE-2018-12997 State: PUBLISHED Published: 2018-06-29T12:00:00 Last Updated: 2024-08-05T08:52:49.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/
le&fileName= substring. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html - https://github.com/unh3x/just4cve/issues/8 - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-037 - http://seclists.org/fulldisclosure/2018/Jul/73
CVE ID: CVE-2018-12998 State: PUBLISHED Published: 2018-06-29T12:00:00 Last Updated: 2024-08-05T08:52:49.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/1
erHelperServlet. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html - https://github.com/unh3x/just4cve/issues/10 - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-036 - http://seclists.org/fulldisclosure/2018/Jul/75
CVE ID: CVE-2018-12999 State: PUBLISHED Published: 2018-06-29T12:00:00 Last Updated: 2024-08-05T08:52:49.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html - https://github.com/unh3x/just4cve/issues/9 - http://seclists.org/fulldis
-13790-build-XSS-File-Read-File-Deletion.html - https://github.com/unh3x/just4cve/issues/9 - http://seclists.org/fulldisclosure/2018/Jul/74 - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-035
CVE ID: CVE-2018-13000 State: PUBLISHED Published: 2018-06-29T14:00:00 Last Updated: 2024-08-05T08:52:50.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST w
nk element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2123
CVE ID: CVE-2018-13001 State: PUBLISHED Published: 2018-06-29T14:00:00 Last Updated: 2024-08-05T08:52:50.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability is non-persistent and the request method to inject/execute is GET with the path, search, rename, or dir parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php
eter. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2122
CVE ID: CVE-2018-13002 State: PUBLISHED Published: 2018-06-29T14:00:00 Last Updated: 2024-08-05T08:52:49.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected
licious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2121
CVE ID: CVE-2018-13003 State: PUBLISHED Published: 2018-06-29T14:00:00 Last Updated: 2024-08-05T08:52:49.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenTSDB/opentsdb/issues/1241
CVE ID: CVE-2018-13005 State: PUBLISHED Published: 2018-06-29T14:00:00 Last Updated: 2024-08-05T08:52:49.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00024.html - https://github.com/gpac/gpac/issues/1088 - https://usn.ubuntu.com/3926-1/
CVE ID: CVE-2018-13006 State: PUBLISHED Published: 2018-06-29T14:00:00 Last Updated: 2024-08-05T08:52:49.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00024.html - https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86 - https://usn.ubuntu.com/3926-1/
CVE ID: CVE-2018-13007 State: PUBLISHED Published: 2018-06-29T14:00:00Z Last Updated: 2024-09-17T02:10:42.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (not conditional on a buffer_size_longs check). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gopro/gpmf-parser/issues/29
CVE ID: CVE-2018-13008 State: PUBLISHED Published: 2018-06-29T14:00:00Z Last Updated: 2024-09-16T17:18:17.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for a positive nest_level. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gopro/gpmf-parser/issues/29
CVE ID: CVE-2018-13009 State: PUBLISHED Published: 2018-06-29T14:00:00Z Last Updated: 2024-09-17T00:55:52.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (conditional on a buffer_size_longs check). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gopro/gpmf-parser/issues/29
CVE ID: CVE-2018-13010 State: PUBLISHED Published: 2018-06-29T14:00:00Z Last Updated: 2024-09-16T23:15:32.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: WSTMall v1.9.1_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wstmall/wstmall/issues/4
CVE ID: CVE-2018-13011 State: PUBLISHED Published: 2018-06-29T15:00:00 Last Updated: 2024-08-05T08:52:49.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gopro/gpmf-parser/issues/31
CVE ID: CVE-2018-13012 State: PUBLISHED Published: 2018-06-29T15:00:00 Last Updated: 2024-08-05T08:52:49.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.12 allows the remote attacker to execute unauthorized code by substituting a forged update server. Additional Analyst Notes: - CVE Program Container: References: - http://www.safensoft.com/security.phtml?c=865#SNSVE-2018-5
CVE ID: CVE-2018-13013 State: PUBLISHED Published: 2018-06-29T15:00:00 Last Updated: 2024-08-05T08:52:49.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper check of unusual conditions when launching msiexec.exe in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.9 allows the local attacker to bypass a code-signing protection mechanism and install/execute an unauthorized program by modifying the system configuration and installing a forged MSI file. (The intended behavior is that the component SysWatch does not allow installation of MSI files unless they are
MSI file. (The intended behavior is that the component SysWatch does not allow installation of MSI files unless they are signed by a limited list of certificates.) Additional Analyst Notes: - CVE Program Container: References: - http://www.safensoft.com/security.phtml?c=865#SNSVE-2018-3
CVE ID: CVE-2018-13014 State: PUBLISHED Published: 2018-06-29T15:00:00 Last Updated: 2024-08-05T08:52:50.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Storing password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.2 allows the local attacker to restore the SysWatch password from the settings database and modify program settings. Additional Analyst Notes: - CVE Program Container: References: - http://www.safensoft.com/security.phtml?c=865#SNSVE-2018-2
CVE ID: CVE-2018-13021 State: PUBLISHED Published: 2018-06-29T17:00:00 Last Updated: 2024-08-05T08:52:49.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Neeke/HongCMS/issues/5
CVE ID: CVE-2018-13022 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T08:52:49.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScript via a modified URL path. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/hack-routers-get-toys-exploiting-the-mi-router-3-1d7fd42f0838
CVE ID: CVE-2018-13023 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T08:52:49.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/hack-routers-get-toys-exploiting-the-mi-router-3-1d7fd42f0838
CVE ID: CVE-2018-13024 State: PUBLISHED Published: 2018-06-29T17:00:00Z Last Updated: 2024-09-17T02:21:08.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action. Additional Analyst Notes: - CVE Program Container: References: - http://www.kingkk.com/2018/06/Metinfo-v6-0-0-getshell-in-background/
CVE ID: CVE-2018-13025 State: PUBLISHED Published: 2018-06-29T17:00:00Z Last Updated: 2024-09-17T02:17:08.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhaoheng521/yxcms/blob/master/Any%20file%20deletion
CVE ID: CVE-2018-13026 State: PUBLISHED Published: 2018-06-30T12:00:00 Last Updated: 2024-08-05T08:52:49.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Type. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gopro/gpmf-parser/issues/32
CVE ID: CVE-2018-13030 State: PUBLISHED Published: 2018-06-30T12:00:00Z Last Updated: 2024-09-17T00:51:47.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in jpeg-compressor 0.1. The build_huffman function in stb_image.c allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kornelski/jpeg-compressor/issues/12 - https://github.com/fouzhe/security/tree/master/jpeg-compressor
CVE ID: CVE-2018-13031 State: PUBLISHED Published: 2018-07-05T20:00:00 Last Updated: 2024-08-05T08:52:49.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnblogs.com/v1vvwv/p/9248562.html - https://www.exploit-db.com/exploits/44960/ - https://github.com/AutismJH/damicms/issues/6
CVE ID: CVE-2018-13032 State: PUBLISHED Published: 2018-07-01T16:00:00 Last Updated: 2024-08-05T08:52:49.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogin_act URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44938/
CVE ID: CVE-2018-13033 State: PUBLISHED Published: 2018-07-01T16:00:00 Last Updated: 2024-08-05T08:52:49.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=23361 - https://access.redhat.com/errata/RHSA-2018:3032 - http://www.s
- https://sourceware.org/bugzilla/show_bug.cgi?id=23361 - https://access.redhat.com/errata/RHSA-2018:3032 - http://www.securityfocus.com/bid/104584 - https://access.redhat.com/errata/RHBA-2019:0327 - https://security.gentoo.org/glsa/201908-01 - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-13034 State: PUBLISHED Published: 2018-07-09T18:00:00 Last Updated: 2024-08-05T08:52:49.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in Jester web framework 0.2.0 allows remote attackers to fetch files in arbitrary locations via "..%f" sequences. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dom96/jester/blob/master/changelog.markdown
CVE ID: CVE-2018-13037 State: PUBLISHED Published: 2018-07-01T18:00:00 Last Updated: 2024-08-05T08:52:49.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in jpeg-compressor 0.1. The bmp_load function in stb_image.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kornelski/jpeg-compressor/issues/13 - https://github.com/fouzhe/security/tree/master/jpeg-compressor
CVE ID: CVE-2018-13038 State: PUBLISHED Published: 2018-07-01T18:00:00 Last Updated: 2024-08-05T08:52:49.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability via an Attachment Document in the article feature. This vulnerability leads to uploading arbitrary PHP code via a .php filename with the application/pdf Content-Type. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSID/OpenSID/issues/1177
CVE ID: CVE-2018-13039 State: PUBLISHED Published: 2018-07-01T18:00:00 Last Updated: 2024-08-05T08:52:49.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSID 18.06-pasca has reflected Cross Site Scripting (XSS) via the cari parameter, aka an index.php/first?cari= URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSID/OpenSID/issues/1175
CVE ID: CVE-2018-13040 State: PUBLISHED Published: 2018-07-01T18:00:00 Last Updated: 2024-08-05T08:52:50.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account (at the admin level) via the index.php/man_user/insert URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSID/OpenSID/issues/1176
CVE ID: CVE-2018-13041 State: PUBLISHED Published: 2018-07-01T18:00:00 Last Updated: 2024-08-05T08:52:49.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mint function of a smart contract implementation for Link Platform (LNK), an Ethereum ERC20 token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dwfault/AirTokens/blob/master/Link_Platform__LNK_/mint%20integer%20overflow.md
CVE ID: CVE-2018-13042 State: PUBLISHED Published: 2018-10-05T21:00:00 Last Updated: 2024-08-05T08:52:49.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity or com.agilebits.onepassword.filling.openyolo.OpenYoloRetrieveActivity from an external application (since they are exported), it is possible to crash the 1Password instance. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46165/ - https://app-updates.agilebits.com/product_history/OPA4 - https:
ferences: - https://www.exploit-db.com/exploits/46165/ - https://app-updates.agilebits.com/product_history/OPA4 - https://www.valbrux.it/blog/2019/01/22/cve-2018-13042-1password-android-7-0-denial-of-service/
CVE ID: CVE-2018-13043 State: PUBLISHED Published: 2018-07-01T22:00:00 Last Updated: 2024-08-05T08:52:49.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/902409 - https://usn.ubuntu.com/3704-1/
CVE ID: CVE-2018-13045 State: PUBLISHED Published: 2019-01-02T18:00:00 Last Updated: 2024-08-05T08:52:49.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to execute arbitrary SQL commands via the "id" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46015/ - http://packetstormsecurity.com/files/150848/Yeswiki-Cercopitheque-SQL-Injection.html
CVE ID: CVE-2018-13049 State: PUBLISHED Published: 2018-07-02T11:00:00 Last Updated: 2024-08-05T08:52:50.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/issues/4270
CVE ID: CVE-2018-13050 State: PUBLISHED Published: 2018-07-02T11:00:00 Last Updated: 2024-08-05T08:52:49.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-f1v3/ForCve/issues/1 - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-13050.html - https://www.manageengine.com/products/applications_manager/issues.html