Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-18382 State: PUBLISHED Published: 2018-10-16T07:00:00 Last Updated: 2024-08-05T11:08:21.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45604/
CVE ID: CVE-2018-18384 State: PUBLISHED Published: 2018-10-16T15:00:00 Last Updated: 2024-08-05T11:08:21.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1110194 - https://sourceforge.net/p/infozip/bugs/53/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00009.html - https://access.redhat.com/errata/RHSA-2019:2159
CVE ID: CVE-2018-18385 State: PUBLISHED Published: 2018-10-16T15:00:00 Last Updated: 2024-08-05T11:08:21.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop. Additional Analyst Notes: - CVE Program Container: Reference
etting pushed back onto the reader, hence causing the loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/asciidoctor/asciidoctor/issues/2888
CVE ID: CVE-2018-18386 State: PUBLISHED Published: 2018-10-17T20:00:00 Last Updated: 2024-08-05T11:08:21.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3849-1/ - https://bugzilla.suse.com/show_bug.cgi?id=1094825 - https://usn.ubuntu.com/3849-2/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11 - https://github.com/torvalds/linux/commit/966031f34
2/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11 - https://github.com/torvalds/linux/commit/966031f340185eddd05affcf72b740549f056348 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=966031f340185eddd05affcf72b740549f056348 - https://access.redhat.com/errata/RHSA-2019:0831
CVE ID: CVE-2018-18387 State: PUBLISHED Published: 2018-10-29T18:00:00 Last Updated: 2024-08-05T11:08:21.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TheeBlind/CVE-2018-18387
CVE ID: CVE-2018-18388 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T11:08:21.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222. Additional Analyst Notes: - CVE Program Container: References: - http://blog.escanav.com/2018/11/cve-2018-18388/
CVE ID: CVE-2018-18389 State: PUBLISHED Published: 2018-10-16T18:00:00Z Last Updated: 2024-09-16T22:01:37.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/neo4j/neo4j/issues/12047
CVE ID: CVE-2018-18390 State: PUBLISHED Published: 2018-10-19T14:00:00Z Last Updated: 2024-09-16T18:18:13.248Z Vendors: Moxa Products: ThingsPro IIoT Gateway and Device Management Software Solutions Problem Types: User Enumeration Description: User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/10/18/klcert-18-018-moxa-thingspro-iiot-gateway-and-device-management-software-solutions-user-enumeration/
CVE ID: CVE-2018-18391 State: PUBLISHED Published: 2018-10-19T14:00:00Z Last Updated: 2024-09-16T20:16:17.961Z Vendors: Moxa Products: ThingsPro IIoT Gateway and Device Management Software Solutions Problem Types: User Privilege Escalation Description: User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/10/18/klcert-18-019-moxa-thingspro-iiot-gateway-and-device-management-software-solutions-user-privilege-escalation/
CVE ID: CVE-2018-18392 State: PUBLISHED Published: 2018-10-19T14:00:00Z Last Updated: 2024-09-17T00:17:29.208Z Vendors: Moxa Products: ThingsPro IIoT Gateway and Device Management Software Solutions Problem Types: Privilege Escalation via Broken Access Control Description: Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/10/18/klcert-18-020-moxa-thingspro-iiot-gateway-and-device-management-software-solutions-broken-access-control/
CVE ID: CVE-2018-18393 State: PUBLISHED Published: 2018-10-19T14:00:00Z Last Updated: 2024-09-16T23:16:41.503Z Vendors: Moxa Products: ThingsPro IIoT Gateway and Device Management Software Solutions Problem Types: Password Management Issue Description: Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/10/18/klcert-18-021-moxa-thingspro-iiot-gateway-and-device-management-software-solutions-password-management-issue/
CVE ID: CVE-2018-18394 State: PUBLISHED Published: 2018-10-19T14:00:00Z Last Updated: 2024-09-16T22:14:32.802Z Vendors: Moxa Products: ThingsPro IIoT Gateway and Device Management Software Solutions Problem Types: Sensitive Information Stored in Clear Text Description: Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/10/18/klcert-18-022-moxa-thingspro-iiot-gateway-and-device-management-software-solutions-sensitive-information-stored-in-clear-text/
CVE ID: CVE-2018-18395 State: PUBLISHED Published: 2018-10-19T14:00:00Z Last Updated: 2024-09-16T21:56:41.064Z Vendors: Moxa Products: ThingsPro IIoT Gateway and Device Management Software Solutions Problem Types: Hidden Token Access Description: Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/10/18/klcert-18-023-moxa-thingspro-iiot-gateway-and-device-management-software-solutions-hidden-token-access/
CVE ID: CVE-2018-18396 State: PUBLISHED Published: 2018-10-19T14:00:00Z Last Updated: 2024-09-16T18:33:21.448Z Vendors: Moxa Products: ThingsPro IIoT Gateway and Device Management Software Solutions Problem Types: Remote Code Execution Description: Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/10/18/klcert-18-024-moxa-thingspro-iiot-gateway-and-device-management-software-solutions-remote-code-execution/
CVE ID: CVE-2018-18397 State: PUBLISHED Published: 2018-12-12T07:00:00 Last Updated: 2024-08-05T11:08:21.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3903-2/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.87 - https://github.com/torvalds/linux/
ubuntu.com/3903-2/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.87 - https://github.com/torvalds/linux/commit/29ec90660d68bbdd69507c1c8b4e33aa299278b1 - https://usn.ubuntu.com/3901-2/ - https://access.redhat.com/errata/RHSA-2019:0324 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1700 - https://access.redhat.com/errata/RHSA-2019:0202 - https://access.redhat.com/errata/RHSA-2019:0163 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=29ec90660d68bbdd69507c1c8b4e33aa299278b1 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.7 - https://usn.ubuntu.com/3901-1/ - https://usn.ubuntu.com/3903-1/ - https://access.redhat.com/errata/RH
ChangeLog-4.19.7 - https://usn.ubuntu.com/3901-1/ - https://usn.ubuntu.com/3903-1/ - https://access.redhat.com/errata/RHSA-2019:0831 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2018-18398 State: PUBLISHED Published: 2018-10-19T22:00:00 Last Updated: 2024-08-05T11:08:21.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method. Additional Analyst Notes: - CVE Program Container: References: - https://0xd0ff9.wordpress.com/2018/10/18/cve-2018-18398/
CVE ID: CVE-2018-18399 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T11:08:21.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2018120168 - http://packetstormsecurity.com/files/150810/KARMA-6.0.0-SQL-Injection.html
CVE ID: CVE-2018-18405 State: PUBLISHED Published: 2020-04-22T17:56:57 Last Updated: 2024-08-05T11:08:21.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/CyberSecurityUP/26c5b032897630fe8407da4a8ef216d4 - https://twitter.com/DanielRufde/status/1255185961866145792 - https://gitter.im/jquery/jquery?at=5ea844a05cd4fe50a3d7ddc9 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPR
50a3d7ddc9 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/
CVE ID: CVE-2018-18406 State: PUBLISHED Published: 2019-06-19T16:00:37 Last Updated: 2024-08-05T11:08:21.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final). The Audit Report module is affected by a blind XXE vulnerability when a new Best Practices Report is saved using a special payload inside the xml input field. The XXE vulnerability is blind since the response doesn't directly display a requested file, but rather returns it inside the name data field when the report is saved. An attacker is able to view restricted operating system files. This issue affects all types of users: administrators
d. An attacker is able to view restricted operating system files. This issue affects all types of users: administrators or normal users. Additional Analyst Notes: - CVE Program Container: References: - https://www.tufin.com/ - https://forum.tufin.com/support/kc/latest/ - https://www.exploit-db.com/exploits/45808
CVE ID: CVE-2018-18407 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/488 - https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay/README.md#user-content-heap-overflow-in-csum_replace4 - https://lists.fedoraproject.org/arc
ing360/blob/master/tcpreplay/README.md#user-content-heap-overflow-in-csum_replace4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/
CVE ID: CVE-2018-18408 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function post_args() at tcpbridge.c, causing a denial of service or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/489 - https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay/README.md#use-after-free-in-post_args - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m
use-after-free-in-post_args - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/
CVE ID: CVE-2018-18409 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an address_histogram call or a get_histogram call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simsong/tcpflow/issues/195 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K6MP4YMCJX4ITOBFX427UMOA6E7ZLJDE/ - https://lists.fedoraproject.org/archives/list/package-
sts.fedoraproject.org/message/K6MP4YMCJX4ITOBFX427UMOA6E7ZLJDE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MN5FW6HKPDP7PI2IVNMFSQVIDSCQ5BOR/ - https://usn.ubuntu.com/3955-1/
CVE ID: CVE-2018-18416 State: PUBLISHED Published: 2018-10-19T22:00:00 Last Updated: 2024-08-05T11:08:21.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/settings/update URI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149841/LANGO-Codeigniter-Multilingual-Script-1.0-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/45672/
CVE ID: CVE-2018-18417 State: PUBLISHED Published: 2018-10-19T22:00:00 Last Updated: 2024-08-05T11:08:21.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45681/ - http://packetstormsecurity.com/files/149842/Ekushey-Project-Manager-CRM-3.1-Cross-Site-Scripting.html
CVE ID: CVE-2018-18419 State: PUBLISHED Published: 2018-10-19T22:00:00 Last Updated: 2024-08-05T11:08:21.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filename to the /account URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45686/ - http://packetstormsecurity.com/files/149850/User-Management-1.1-Cross-Site-Scripting.html
CVE ID: CVE-2018-18420 State: PUBLISHED Published: 2018-10-19T22:00:00 Last Updated: 2024-08-05T11:08:21.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149851/Zenar-Content-Management-System-8.3-Cross-Site-Request-Forgery.html
CVE ID: CVE-2018-18422 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/a_adminx.php?x=a URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yanchongchong/swallow/issues/8
CVE ID: CVE-2018-18425 State: PUBLISHED Published: 2019-06-19T15:57:30 Last Updated: 2024-08-05T11:08:21.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.) Additional Analyst Notes: - CVE Program Container: References: - https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d
alyst Notes: - CVE Program Container: References: - https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code - https://www.jianshu.com/p/09f238e9e568
CVE ID: CVE-2018-18426 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: s-cms 3.0 allows remote attackers to execute arbitrary PHP code by placing this code in a crafted User-agent Disallow value in the robots.php txt parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.s-cms.cn/update.html - http://www.ttk7.cn/post-93.html
CVE ID: CVE-2018-18427 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.s-cms.cn/update.html - http://www.ttk7.cn/post-92.html
CVE ID: CVE-2018-18428 State: PUBLISHED Published: 2018-10-19T22:00:00 Last Updated: 2024-08-05T11:08:21.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5497.php - https://packetstormsecurity.com/files/149843 - https://www.exploit-db.com/exploits/45632/
CVE ID: CVE-2018-18430 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/DESTOON/blob/master/XSS.md#xss1 - https://www.patec.cn/newsshow.php?cid=24&id=134
CVE ID: CVE-2018-18431 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/DESTOON/blob/master/XSS.md#xss2 - https://www.patec.cn/newsshow.php?cid=24&id=134
CVE ID: CVE-2018-18432 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/DESTOON/blob/master/CSRF.md - https://www.patec.cn/newsshow.php?cid=24&id=134
CVE ID: CVE-2018-18433 State: PUBLISHED Published: 2018-10-17T04:00:00 Last Updated: 2024-08-05T11:08:21.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the category[catname] parameter to the admin.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/DESTOON/blob/master/XSS.md#xss3 - https://www.patec.cn/newsshow.php?cid=24&id=134
CVE ID: CVE-2018-18434 State: PUBLISHED Published: 2018-10-17T05:00:00 Last Updated: 2024-08-05T11:08:21.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in litemall 0.9.0. Arbitrary file download is possible via ../ directory traversal in linlinjava/litemall/wx/web/WxStorageController.java in the litemall-wx-api component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/linlinjava/litemall/commit/49ab94d0052672d4fb642505d44b94a18abea332 - https://github.com/linlinjava/litemall/issues/76
CVE ID: CVE-2018-18435 State: PUBLISHED Published: 2019-03-17T19:11:14 Last Updated: 2024-08-05T11:08:21.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permission "Everyone: (F)" to the contents of the directory and it's sub-folders. In addition, the program installs a service called "KWSService" which runs as "Localsystem", this will allow any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a malicious one. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.c