Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-16980 State: PUBLISHED Published: 2018-09-12T23:00:00Z Last Updated: 2024-09-16T18:45:21.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/issues/15274
CVE ID: CVE-2018-16981 State: PUBLISHED Published: 2018-09-12T23:00:00Z Last Updated: 2024-09-16T19:15:17.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nothings/stb/issues/656 - https://lists.debian.org/debian-lts-announce/2023/01/msg00045.html
CVE ID: CVE-2018-16982 State: PUBLISHED Published: 2018-09-13T02:00:00Z Last Updated: 2024-09-17T04:23:53.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BYVoid/OpenCC/issues/303
CVE ID: CVE-2018-16983 State: PUBLISHED Published: 2018-09-13T04:00:00 Last Updated: 2024-08-05T10:39:59.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type value. Additional Analyst Notes: - CVE Program Container: References: - https://noscript.net/getit#classic - https://twitter.com/Zerodium/status/1039127214602641409 - https://www.zdnet.com/article/exploit-vendor-drops-tor-browser-zero-day-on-twitter/
CVE ID: CVE-2018-16984 State: PUBLISHED Published: 2018-10-02T18:00:00 Last Updated: 2024-08-05T10:39:58.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes. Additional Analyst Notes: - CVE Program Container: References: - https:
with legacy user accounts using insecure hashes. Additional Analyst Notes: - CVE Program Container: References: - https://www.djangoproject.com/weblog/2018/oct/01/security-release/ - http://www.securitytracker.com/id/1041749 - https://security.netapp.com/advisory/ntap-20190502-0009/
CVE ID: CVE-2018-16985 State: PUBLISHED Published: 2018-09-13T14:00:00 Last Updated: 2024-08-05T10:39:59.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Lizard (formerly LZ5) 2.0, use of an invalid memory address was discovered in LZ5_compress_continue in lz5_compress.c, related to LZ5_compress_fastSmall and MEM_read32. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inikep/lizard/issues/18
CVE ID: CVE-2018-16986 State: PUBLISHED Published: 2018-11-06T16:00:00 Last Updated: 2024-08-05T10:39:59.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Texas Instruments BLE-STACK v2.2.1 for SimpleLink CC2640 and CC2650 devices allows remote attackers to execute arbitrary code via a malformed packet that triggers a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://armis.com/bleedingbit/ - http://e2e.ti.com/support/wireless-connectivity/bluetooth/f/538/t/742827 - http://www.securitytracker.com/id/1042018 - https://www.kb.cert.org/vuls/id/317277 - http://www.securityfocus.com/bid/105812 - https://tools.cisco.com/security/center/content/C
kb.cert.org/vuls/id/317277 - http://www.securityfocus.com/bid/105812 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181101-ap
CVE ID: CVE-2018-16987 State: PUBLISHED Published: 2018-09-13T15:00:00Z Last Updated: 2024-09-16T23:31:28.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2018/09/13/1 - https://ci.squashtest.org/mantis/view.php?id=7553
CVE ID: CVE-2018-16988 State: PUBLISHED Published: 2019-05-02T19:38:07 Last Updated: 2024-08-05T10:39:58.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a password-reset process (pass_reset.php, password_reset.php, XDUser.php) in the past few minutes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grymer/CVE/blob/master/CVE-2018-16988.md
CVE ID: CVE-2018-16994 State: PUBLISHED Published: 2020-02-18T22:27:28 Last Updated: 2024-08-05T10:39:59.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth S20-ETH-BK and Rexroth S20-PN-BK+ (the S20-PN-BK+/S20-ETH-BK fieldbus couplers sold by Bosch Rexroth contain technology from Phoenix Contact). Incorrect handling of a request with non-standard symbols allows remote attackers to initiate a complete lock up of the bus coupler. Authentication of the request is not required. Additional Analyst Notes: - CVE Program Container: References: - htt
ler. Authentication of the request is not required. Additional Analyst Notes: - CVE Program Container: References: - https://www.phoenixcontact.com/assets/downloads_ed/local_pc/web_dwl_technical_info/Security_Advirory_CVE-2018-16994.pdf - https://psirt.bosch.com/security-advisories/bosch-sa-645125.html
CVE ID: CVE-2018-16999 State: PUBLISHED Published: 2018-09-13T16:00:00 Last Updated: 2024-08-05T10:39:59.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to cause a denial of service via a crafted input file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392508 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html
CVE ID: CVE-2018-17000 State: PUBLISHED Published: 2018-09-13T16:00:00 Last Updated: 2024-08-05T10:39:59.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2811 - http://www.securityfocus.com/bid/105342 - https://usn.ubuntu.com/3906-1/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00026.
tyfocus.com/bid/105342 - https://usn.ubuntu.com/3906-1/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html - https://www.debian.org/security/2020/dsa-4670
CVE ID: CVE-2018-17001 State: PUBLISHED Published: 2018-09-21T17:00:00 Last Updated: 2024-08-05T10:39:58.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149441/RICOH-SP-4510SF-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17002 State: PUBLISHED Published: 2018-09-21T17:00:00 Last Updated: 2024-08-05T10:39:59.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH MP 2001 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149443/RICOH-MP-2001-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17003 State: PUBLISHED Published: 2018-09-21T17:00:00 Last Updated: 2024-08-05T10:39:59.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149435/LimeSurvey-3.14.7-Cross-Site-Scripting.html
CVE ID: CVE-2018-17004 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T03:27:23.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wlan_access name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_00/README.md
CVE ID: CVE-2018-17005 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-16T18:23:25.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for firewall dmz enable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_01/README.md
CVE ID: CVE-2018-17006 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T02:20:33.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for firewall lan_manage mac2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_02/README.md
CVE ID: CVE-2018-17007 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-16T17:43:17.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_wds_2g ssid. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_03/README.md
CVE ID: CVE-2018-17008 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T02:58:09.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_host_2g power. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_04/README.md
CVE ID: CVE-2018-17009 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T00:26:42.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_host_2g isolate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_05/README.md
CVE ID: CVE-2018-17010 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-16T19:55:58.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_host_2g bandwidth. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_06/README.md
CVE ID: CVE-2018-17011 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T03:52:47.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for hosts_info para sun. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_07/README.md
CVE ID: CVE-2018-17012 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T02:52:14.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for hosts_info set_block_flag up_limit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_08/README.md
CVE ID: CVE-2018-17013 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T01:02:03.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for protocol wan wan_rate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_09/README.md
CVE ID: CVE-2018-17014 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-16T22:31:14.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for ip_mac_bind name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_10/README.md
CVE ID: CVE-2018-17015 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T02:42:16.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for ddns phddns username. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_11/README.md
CVE ID: CVE-2018-17016 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-16T20:36:50.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for reboot_timer name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_12/README.md
CVE ID: CVE-2018-17017 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T02:46:51.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for dhcpd udhcpd enable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_13/README.md
CVE ID: CVE-2018-17018 State: PUBLISHED Published: 2018-09-13T18:00:00Z Last Updated: 2024-09-17T01:45:41.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for time_switch name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/TP-Link/WR886N/inetd_task_dos_14/README.md
CVE ID: CVE-2018-17019 State: PUBLISHED Published: 2018-09-13T19:00:00Z Last Updated: 2024-09-17T00:26:33.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bro/bro/commit/c2b18849f8bb833253538f5dfedb4ed1dc176a30
CVE ID: CVE-2018-17020 State: PUBLISHED Published: 2018-09-13T19:00:00Z Last Updated: 2024-09-17T00:42:20.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allow remote attackers to cause a denial of service via a single "GET / HTTP/1.1\r\n" line. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/ASUS/ASUS%20GT-AC5300%20DOS1.MD
CVE ID: CVE-2018-17021 State: PUBLISHED Published: 2018-09-13T19:00:00Z Last Updated: 2024-09-16T20:31:40.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability on ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allows remote attackers to inject arbitrary web script or HTML via the appGet.cgi hook parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/ASUS/ac5300_xss/ASUS%20GT-AC5300%20XSS.MD
CVE ID: CVE-2018-17022 State: PUBLISHED Published: 2018-09-13T19:00:00Z Last Updated: 2024-09-17T03:48:36.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (device crash) or possibly have unspecified other impact by setting a long sh_path0 value and then sending an appGet.cgi?hook=select_list("Storage_x_SharedPath") request, because ej_select_list in router/httpd/web.c uses strcpy. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/ASUS/buffer_overflow/ASUS%20GT-AC5300%20stack%20o
iner: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/ASUS/buffer_overflow/ASUS%20GT-AC5300%20stack%20overflow.MD
CVE ID: CVE-2018-17023 State: PUBLISHED Published: 2018-09-13T19:00:00Z Last Updated: 2024-09-16T17:07:54.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/ASUS/csrf_bypass_referer/ASUS%20GT-AC5300%20csrf%20bypass%20referer.MD
CVE ID: CVE-2018-17024 State: PUBLISHED Published: 2018-09-13T20:00:00 Last Updated: 2024-08-05T10:39:59.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monstra-cms/monstra/issues/458 - https://github.com/monstra-cms/monstra/issues/452
CVE ID: CVE-2018-17025 State: PUBLISHED Published: 2018-09-13T20:00:00Z Last Updated: 2024-09-17T03:53:06.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monstra-cms/monstra/issues/458
CVE ID: CVE-2018-17026 State: PUBLISHED Published: 2018-09-13T20:00:00Z Last Updated: 2024-09-17T01:01:12.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/25
CVE ID: CVE-2018-17030 State: PUBLISHED Published: 2018-09-14T02:00:00 Last Updated: 2024-08-05T10:39:59.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/342
CVE ID: CVE-2018-17031 State: PUBLISHED Published: 2018-09-14T02:00:00 Last Updated: 2024-08-05T10:39:59.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/issues/5397
CVE ID: CVE-2018-17034 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blackstar24/UCMS/blob/master/xss.md
CVE ID: CVE-2018-17035 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blackstar24/UCMS/blob/master/README.md
CVE ID: CVE-2018-17036 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blackstar24/UCMS/blob/master/phpinfo.md