Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-12545 State: PUBLISHED Published: 2019-03-27T19:21:37 Last Updated: 2024-08-05T08:38:06.170Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-400 Description: In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull
References: - https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull.infra.apache.org%3E - https://lists.apache.org/thread.html/febc94ffec9275dcda64633e0276a1400cd318e571009e4cda9b7a79%40%3Cnotifications.accumulo.apache.org%3E - https://lists.apache.org/thread.html/13f5241048ec0bf966a6ddd306feaf40de5b20e1f09096b9cddeddf2%40%3Ccommits.accumulo.apache.org%3E - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIS4LALKZNLF5X5IGNGRSKERG7FY4QG6/ - https://lists.apache.org
ves/list/package-announce%40lists.fedoraproject.org/message/CIS4LALKZNLF5X5IGNGRSKERG7FY4QG6/ - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096
CVE ID: CVE-2018-12546 State: PUBLISHED Published: 2019-03-27T17:26:20 Last Updated: 2024-08-05T08:38:06.266Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-284 Description: In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127
CVE ID: CVE-2018-12547 State: PUBLISHED Published: 2019-02-11T15:00:00 Last Updated: 2024-08-05T08:38:05.983Z Vendors: The Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-20 Description: In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0474 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=543659 - https://access.redhat.com/errata/RHSA-2019:0
ata/RHSA-2019:0474 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=543659 - https://access.redhat.com/errata/RHSA-2019:0469 - https://access.redhat.com/errata/RHSA-2019:0473 - https://access.redhat.com/errata/RHSA-2019:0472 - https://access.redhat.com/errata/RHSA-2019:0640 - https://access.redhat.com/errata/RHSA-2019:1238
CVE ID: CVE-2018-12548 State: PUBLISHED Published: 2019-01-31T20:00:00 Last Updated: 2024-08-05T08:38:06.287Z Vendors: The Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-822 Description: In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=543792
CVE ID: CVE-2018-12549 State: PUBLISHED Published: 2019-02-11T15:00:00 Last Updated: 2024-08-05T08:38:06.337Z Vendors: The Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-111 Description: In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0469 - https://access.redhat.com/errata/RHSA-2019:0472 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=544019 - https://access.redhat.com/errata/RHSA-2019:0640 - https://access.redhat.com/errata/RHSA-2019:1238
CVE ID: CVE-2018-12550 State: PUBLISHED Published: 2019-03-27T17:26:20 Last Updated: 2024-08-05T08:38:06.290Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-440 Description: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty ACL file mean that all access is denied, which is not a useful configuration but is not unexpected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs
on but is not unexpected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=541870 - https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html
CVE ID: CVE-2018-12551 State: PUBLISHED Published: 2019-03-27T17:26:20 Last Updated: 2024-08-05T08:38:06.296Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-703 Description: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users w
. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=543401 - https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html
CVE ID: CVE-2018-12552 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-12553 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-12554 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-12555 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-12556 State: PUBLISHED Published: 2019-05-16T16:12:53 Last Updated: 2024-08-05T08:38:06.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yarnpkg/website/commits/master - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com
hub.com/yarnpkg/website/commits/master - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://www.openwall.com/lists/oss-security/2019/04/30/4 - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
CVE ID: CVE-2018-12557 State: PUBLISHED Published: 2018-06-19T05:00:00 Last Updated: 2024-08-05T08:38:06.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets. Additional Analyst Notes: - CVE Program Container: References: - http://lists.zuul-ci.org/pipermail/zuul-announce/2018-June/000015.html - https://storyboard.openstack.org/#%21/st
ces: - http://lists.zuul-ci.org/pipermail/zuul-announce/2018-June/000015.html - https://storyboard.openstack.org/#%21/story/2002177 - https://git.zuul-ci.org/cgit/zuul/commit/?id=ffe7278c08e6e36bf8b18f732c764e00ff51551e
CVE ID: CVE-2018-12558 State: PUBLISHED Published: 2018-06-20T14:00:00 Last Updated: 2024-08-05T08:38:06.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f"). Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/06/19/3 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901873 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00012.html
CVE ID: CVE-2018-12559 State: PUBLISHED Published: 2018-06-19T05:00:00 Last Updated: 2024-08-05T08:38:06.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequences such as a home/../usr substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3 - http://www.openwall.com/lists/oss-securi
/github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3 - http://www.openwall.com/lists/oss-security/2018/06/18/1
CVE ID: CVE-2018-12560 State: PUBLISHED Published: 2018-06-19T05:00:00 Last Updated: 2024-08-05T08:38:06.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/06/18/1
CVE ID: CVE-2018-12561 State: PUBLISHED Published: 2018-06-19T05:00:00 Last Updated: 2024-08-05T08:38:06.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3 - http://www.openwall.com/lists/oss-security/2018/06/18/1
CVE ID: CVE-2018-12562 State: PUBLISHED Published: 2018-06-19T05:00:00 Last Updated: 2024-08-05T08:38:06.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3 - http://www.openwall.com/lists/oss-security/2018/06/18/1
CVE ID: CVE-2018-12563 State: PUBLISHED Published: 2018-06-19T05:00:00 Last Updated: 2024-08-05T08:38:06.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml. Additional Analyst Notes: - CVE Program Container: References: - https://git.linaro.org/lava/lava.git/commit/?id=e24ec39599bc07562ad8bc2a581144b8448cb214
CVE ID: CVE-2018-12564 State: PUBLISHED Published: 2018-06-19T05:00:00 Last Updated: 2024-08-05T08:38:06.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/06/msg00011.html - https://www.debian.org/security/2018/dsa-4234 - https://git.linaro.org/lava/lava.git/commit/?id=95a9a77b144ced24d7425d6544ab03ca7f6c75d3
CVE ID: CVE-2018-12565 State: PUBLISHED Published: 2018-06-19T05:00:00 Last Updated: 2024-08-05T08:38:06.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execution can occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4234 - https://git.linaro.org/lava/lava.git/commit/?id=583666c84ea2f12797a3eb71392bcb05782f5b14
CVE ID: CVE-2018-12571 State: PUBLISHED Published: 2018-07-05T20:00:00 Last Updated: 2024-08-05T08:38:06.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly causing a traffic amplification and/or SSRF outcome. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jul/2 - http://www.securitytracker.com/id/1041212 - http://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gate
www.securitytracker.com/id/1041212 - http://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gateway-2010-External-DNS-Interaction.html - http://seclists.org/fulldisclosure/2018/Jul/7
CVE ID: CVE-2018-12572 State: PUBLISHED Published: 2019-03-17T18:20:44 Last Updated: 2024-08-05T08:38:06.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151590/Avast-Anti-Virus-Local-Credential-Disclosure.html
CVE ID: CVE-2018-12574 State: PUBLISHED Published: 2018-07-02T16:00:00 Last Updated: 2024-08-05T08:38:06.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF exists for all actions in the web interface on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices. Additional Analyst Notes: - CVE Program Container: References: - https://software-talk.org/blog/2018/06/tplink-wr841n-csrf-cve-2018-12574/
CVE ID: CVE-2018-12575 State: PUBLISHED Published: 2018-07-02T16:00:00 Last Updated: 2024-08-05T08:38:06.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: On TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n devices, all actions in the web interface are affected by bypass of authentication via an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://software-talk.org/blog/2018/06/tplink-wr841n-broken-auth-cve-2018-12575/
CVE ID: CVE-2018-12576 State: PUBLISHED Published: 2018-07-02T16:00:00 Last Updated: 2024-08-05T08:38:06.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking. Additional Analyst Notes: - CVE Program Container: References: - https://software-talk.org/blog/2018/04/tplink-wr841n-clickjacking-https/
CVE ID: CVE-2018-12577 State: PUBLISHED Published: 2018-07-02T16:00:00 Last Updated: 2024-08-05T08:38:06.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ping and Traceroute features on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow authenticated blind Command Injection. Additional Analyst Notes: - CVE Program Container: References: - https://software-talk.org/blog/2018/06/tplink-wr841n-code-exec-cve-2018-12577/
CVE ID: CVE-2018-12578 State: PUBLISHED Published: 2018-06-19T15:00:00 Last Updated: 2024-08-05T08:38:06.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer overflow in bmp_compress1_row in appliers.cpp in sam2p 0.49.4 that leads to a denial of service or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/08/msg00010.html - https://github.com/pts/sam2p/issues/39
CVE ID: CVE-2018-12579 State: PUBLISHED Published: 2018-08-20T22:00:00 Last Updated: 2024-08-05T08:38:06.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An attacker could gain access to the admin panel or a customer account when using the password reset function. To do so, it is required to own a domain name similar to the one the victim uses for their e-mail accounts. Additional Analyst N
, it is required to own a domain name similar to the one the victim uses for their e-mail accounts. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.oxid-esales.com/view.php?id=6818 - https://oxidforge.org/en/security-bulletin-2018-002.html
CVE ID: CVE-2018-12580 State: PUBLISHED Published: 2018-06-19T16:00:00Z Last Updated: 2024-09-17T03:44:23.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session['user_agent'] in the "Login Sessions" feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.dragonbyte-tech.com/threads/security-bulletin-low-vbsecurity-for-vbulletin-3-vbulletin-4-partial-xss.22534/
CVE ID: CVE-2018-12581 State: PUBLISHED Published: 2018-06-21T20:00:00 Last Updated: 2024-08-05T08:38:06.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104530 - http://www.securitytracker.com/id/1041187 - https://www.phpmyadmin.net/security/PMASA-2018-3/
CVE ID: CVE-2018-12582 State: PUBLISHED Published: 2018-06-19T18:00:00 Last Updated: 2024-08-05T08:38:06.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AKCMS 6.1. CSRF can add an admin account via a /index.php?file=account&action=manageaccounts&job=newaccount URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chenrui1896/issue/blob/master/add_admin - https://github.com/p8w/akcms/issues/1
CVE ID: CVE-2018-12583 State: PUBLISHED Published: 2018-06-19T18:00:00 Last Updated: 2024-08-05T08:38:06.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/p8w/akcms/issues/2 - https://github.com/chenrui1896/issue/blob/master/del_article
CVE ID: CVE-2018-12584 State: PUBLISHED Published: 2018-07-16T20:00:00 Last Updated: 2024-08-05T08:38:06.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cause a denial of service (buffer overflow) or possibly execute arbitrary code when TLS communication is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45174/ - https://github.com/resiprocate/resiprocate/commit/2cb291191c93c7c4e371e22cb89805a5b31d6608 - https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html - http://s
2cb291191c93c7c4e371e22cb89805a5b31d6608 - https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html - http://seclists.org/bugtraq/2018/Aug/14 - https://packetstormsecurity.com/files/148856/reSIProcate-1.10.2-Heap-Overflow.html - http://joachimdezutter.webredirect.org/advisory.html - https://lists.debian.org/debian-lts-announce/2021/12/msg00029.html
CVE ID: CVE-2018-12585 State: PUBLISHED Published: 2018-09-14T21:00:00 Last Updated: 2024-08-05T08:38:06.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XXE vulnerability in the OPC UA Java and .NET Legacy Stack can allow remote attackers to trigger a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105538 - https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12585.pdf
CVE ID: CVE-2018-12587 State: PUBLISHED Published: 2018-08-13T17:00:00 Last Updated: 2024-08-05T08:38:06.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability was found in valeuraddons German Spelling Dictionary v1.3 (an Opera Browser add-on). Instead of providing text for a spelling check, remote attackers may inject arbitrary web script or HTML via the ajax query parameter in the URL Address Bar. Additional Analyst Notes: - CVE Program Container: References: - https://metamorfosec.com/Files/Advisories/METS-2018-003-A_XSS_Vulnerability_in_German_Spelling_Dictionary_1.3.txt - https://www.openbugbounty.org/reports/610381/
CVE ID: CVE-2018-12588 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:38:06.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field). Additional Analyst Notes: - CVE Program Container: References: - https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938 - https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf - https://metamorf