Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-68138 - http://www.securityfocus.com/bid/105751
CVE ID: CVE-2018-13401 State: PUBLISHED Published: 2018-10-23T14:00:00Z Last Updated: 2024-09-17T03:13:21.525Z Vendors: Atlassian Products: Jira Problem Types: URL Redirection to Untrusted Site ('Open Redirect') Description: The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability. Addit
emote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105751 - https://jira.atlassian.com/browse/JRASERVER-68139
CVE ID: CVE-2018-13402 State: PUBLISHED Published: 2018-10-23T14:00:00Z Last Updated: 2024-09-16T17:52:50.468Z Vendors: Atlassian Products: Jira Problem Types: URL Redirection to Untrusted Site ('Open Redirect') Description: Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect
to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105751 - https://jira.atlassian.com/browse/JRASERVER-68140
CVE ID: CVE-2018-13403 State: PUBLISHED Published: 2019-02-13T18:00:00Z Last Updated: 2024-09-16T18:08:58.970Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when displayed on a Jira dashboard. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-68526
CVE ID: CVE-2018-13404 State: PUBLISHED Published: 2019-02-13T18:00:00Z Last Updated: 2024-09-16T17:28:16.895Z Vendors: Atlassian Products: Jira Problem Types: Server-Side Request Forgery (SSRF) Description: The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports an
.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obtain service information from internal network resources via a Server Side Request Forgery (SSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-68527
CVE ID: CVE-2018-13405 State: PUBLISHED Published: 2018-07-06T14:00:00 Last Updated: 2024-08-05T09:00:35.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalat
n trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3752-2/ - https://access.redhat.com/errata/RHSA-2018:3083 - https://usn.ubuntu.com/3752-3/ - https://twitter.com/grsecurity/status/1015082951204327425 - https://usn.ubuntu.com/3753-2/ - https://usn.ubuntu.com/3754-1/ - http://openwall.com/lists/oss-security/2018/07/13/2 - https://access.redhat.com/errata/RHSA-2018:2948 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce
18:2948 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7 - https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html - https://www.exploit-db.com/exploits/45033/ - https://www.debian.org/security/2018/dsa-4266 - http://www.securityfocus.com/bid/106503 - https://usn.ubuntu.com/3752-1/ - https://access.redhat.com/errata/RHSA-2018:3096 - https://usn.ubuntu.com/3753-1/ - https://github.com/torvalds/linux/commit/0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7 - https://access.redhat.com/errata/RHSA-2019:0717 - https://support.f5.com/csp/article/K00854051 - https://access.redhat.com/errata/RHSA-2019:2476 - https://access.redhat.
https://support.f5.com/csp/article/K00854051 - https://access.redhat.com/errata/RHSA-2019:2476 - https://access.redhat.com/errata/RHSA-2019:2566 - https://access.redhat.com/errata/RHSA-2019:2696 - https://access.redhat.com/errata/RHSA-2019:2730 - https://access.redhat.com/errata/RHSA-2019:4159 - https://access.redhat.com/errata/RHSA-2019:4164 - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=0b3369840cd61c23e2b9241093737b4c395cb406 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKKIAUMR5FAYLZ7HLEPOXMKAAE3BYBQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRBNBX73
XMKAAE3BYBQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRBNBX73SAFKQWBOX76SLMWPTKJPVGEJ/
CVE ID: CVE-2018-13406 State: PUBLISHED Published: 2018-07-06T14:00:00 Last Updated: 2024-08-05T09:00:35.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3752-2/ - https://usn.ubuntu.com/3752-3/ - https://usn.ubuntu.com/3753-2/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.4 - https://usn.ubuntu.com/3754-1/ - http://git.kernel.o
/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.4 - https://usn.ubuntu.com/3754-1/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9f645bcc566a1e9f921bdae7528a01ced5bc3713 - https://github.com/torvalds/linux/commit/9f645bcc566a1e9f921bdae7528a01ced5bc3713 - http://www.securitytracker.com/id/1041355 - https://usn.ubuntu.com/3752-1/ - https://usn.ubuntu.com/3753-1/ - http://www.securityfocus.com/bid/104685 - https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
CVE ID: CVE-2018-13407 State: PUBLISHED Published: 2018-07-06T17:00:00Z Last Updated: 2024-09-17T04:14:41.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/06/jirafeau-version-3-3-0-multiple-vulnerabilities/
CVE ID: CVE-2018-13408 State: PUBLISHED Published: 2018-07-06T17:00:00Z Last Updated: 2024-09-17T01:46:24.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/06/jirafeau-version-3-3-0-multiple-vulnerabilities/
CVE ID: CVE-2018-13409 State: PUBLISHED Published: 2018-07-06T17:00:00Z Last Updated: 2024-09-16T18:23:59.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/06/jirafeau-version-3-3-0-multiple-vulnerabilities/
CVE ID: CVE-2018-13410 State: PUBLISHED Published: 2018-07-06T19:00:00 Last Updated: 2024-08-05T09:00:35.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jul/24
CVE ID: CVE-2018-13411 State: PUBLISHED Published: 2018-09-12T16:00:00 Last Updated: 2024-08-05T09:00:35.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105348 - https://www.manageengine.com/products/desktop-central/elevation-of-system-privilege.html - https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.md
CVE ID: CVE-2018-13412 State: PUBLISHED Published: 2018-09-12T16:00:00 Last Updated: 2024-08-05T09:00:35.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105348 - https://www.manageengine.com/products/desktop-central/elevation-of-system-privilege.html - https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.md
CVE ID: CVE-2018-13415 State: PUBLISHED Published: 2018-08-13T17:00:00 Last Updated: 2024-08-05T09:00:35.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution i
t password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45146/ - http://seclists.org/fulldisclosure/2018/Aug/1
CVE ID: CVE-2018-13416 State: PUBLISHED Published: 2018-08-03T17:00:00 Last Updated: 2024-08-05T09:00:35.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running UMS, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Executi
rtext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45133/ - http://seclists.org/fulldisclosure/2018/Jul/94
CVE ID: CVE-2018-13417 State: PUBLISHED Published: 2018-08-13T17:00:00 Last Updated: 2024-08-05T09:00:35.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Vuze, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution
xt password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/2 - https://www.exploit-db.com/exploits/45145/
CVE ID: CVE-2018-13418 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13419 State: PUBLISHED Published: 2018-07-07T17:00:00 Last Updated: 2024-08-05T09:00:35.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c, as demonstrated by sndfile-convert. NOTE: The maintainer and third parties were unable to reproduce and closed the issue Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erikd/libsndfile/issues/398
CVE ID: CVE-2018-13420 State: PUBLISHED Published: 2018-07-07T17:00:00 Last Updated: 2024-11-14T20:41:44.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gperftools/gperftools/issues/1013
CVE ID: CVE-2018-13421 State: PUBLISHED Published: 2018-07-07T17:00:00 Last Updated: 2024-08-05T09:00:35.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ben-strasser/fast-cpp-csv-parser/issues/67
CVE ID: CVE-2018-13422 State: PUBLISHED Published: 2018-07-07T17:00:00Z Last Updated: 2024-09-16T18:18:09.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: TCExam before 14.1.2 has XSS via an ff_ or xl_ field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tecnickcom/tcexam/pull/223
CVE ID: CVE-2018-13423 State: PUBLISHED Published: 2018-07-07T17:00:00Z Last Updated: 2024-09-16T16:47:51.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/omeka/Omeka/commit/ba841892116544847d76d3838781c9708cb92221 - https://github.com/omeka/Omeka/releases/tag/v2.6.1
CVE ID: CVE-2018-13433 State: PUBLISHED Published: 2018-07-08T12:00:00 Last Updated: 2024-08-05T09:00:35.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BoostIO/Boostnote/issues/2184
CVE ID: CVE-2018-13434 State: PUBLISHED Published: 2018-08-16T20:00:00 Last Updated: 2024-08-05T09:00:35.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is not used. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbrea
is is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tanprathan/f5133651e438b2ad1b39172d52b56115
CVE ID: CVE-2018-13435 State: PUBLISHED Published: 2018-08-16T20:00:00 Last Updated: 2024-08-05T09:00:35.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/tanprathan/19165c43ade898ab8b66
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/tanprathan/19165c43ade898ab8b664098fb171f49
CVE ID: CVE-2018-13439 State: PUBLISHED Published: 2018-07-08T15:00:00 Last Updated: 2024-08-05T09:00:35.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/148390/WeChat-Pay-SDK-XXE-Injection.html
CVE ID: CVE-2018-13440 State: PUBLISHED Published: 2018-07-08T16:00:00 Last Updated: 2024-08-05T09:00:35.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mpruett/audiofile/issues/49 - https://usn.ubuntu.com/3800-1/
CVE ID: CVE-2018-13441 State: PUBLISHED Published: 2018-07-12T18:00:00 Last Updated: 2024-08-05T09:00:35.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.opsview.com/v5.4/docs/whats-new - https://gist.github.com/fakhrizulkifli/8df4a174158df69ebd765f824bd736b8 - https://www.exploit-db.com/exploits/45082/ - https://knowledge.opsview.com/v5.3/docs/whats-new - http://lists.o
d736b8 - https://www.exploit-db.com/exploits/45082/ - https://knowledge.opsview.com/v5.3/docs/whats-new - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html
CVE ID: CVE-2018-13442 State: PUBLISHED Published: 2019-07-16T17:56:43 Last Updated: 2024-08-05T09:00:35.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter. Additional Analyst Notes: - CVE Program Container: References: - https://labs.nettitude.com/blog/cve-2018-13442-solarwinds-npm-sql-injection/
CVE ID: CVE-2018-13443 State: PUBLISHED Published: 2019-04-24T14:05:24 Last Updated: 2024-08-05T09:00:35.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: EOS.IO jit-wasm 4.1 has a heap-based buffer overflow via a crafted wast file. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/eosio - https://github.com/EOSIO/eos - https://github.com/EOSIO/eos/issues/6585
CVE ID: CVE-2018-13444 State: PUBLISHED Published: 2018-07-08T16:00:00Z Last Updated: 2024-09-16T18:33:38.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/admin_manager.php?action=save&id=2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MichaelWayneLIU/seacms/blob/master/seacms1.md
CVE ID: CVE-2018-13445 State: PUBLISHED Published: 2018-07-08T16:00:00Z Last Updated: 2024-09-16T20:31:35.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/admin_manager.php?action=add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MichaelWayneLIU/seacms/blob/master/seacms1.md
CVE ID: CVE-2018-13446 State: PUBLISHED Published: 2018-08-16T20:00:00 Last Updated: 2024-08-05T09:00:35.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred Additional Analyst Notes: - CVE Program Container: References: - https://gist.
oid devices on which rooting has occurred Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tanprathan/efde53e5b312f50edb08f050b6be3928