Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-14042 State: PUBLISHED Published: 2018-07-13T14:00:00 Last Updated: 2024-08-05T09:21:41.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/May/18 - http://seclists.org/fulldisclosure/2019/May/11 - http://seclists.org/fulldisclosure/2019/May/10 - http://seclists.org/fulldisclosure/2019/May/13 - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc6
f3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html - https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71ee
7355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://github.com/twbs/bootstrap/pull/26630 - https://github.com/twbs/bootstrap/issues/26423 - https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/ - https://github.com/twbs/bootstrap/issues/26628 - https://www.tenable.com/security/tns-2021-14
CVE ID: CVE-2018-14043 State: PUBLISHED Published: 2018-07-13T14:00:00Z Last Updated: 2024-09-16T16:22:38.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: mstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file access control in situations where M_fs_perms_can_access attempts to delete an existing file (that lacks public read/write access) during a copy operation, related to fs/m_fs.c and fs/m_fs_path.c. An attacker could create the file and then would have access to the data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Monetra/mstdlib/issues/2 - https://github.com/Monetra/mstdlib/commit/db124b8f607dd0a40a9aef2d4d468fad433522
//github.com/Monetra/mstdlib/issues/2 - https://github.com/Monetra/mstdlib/commit/db124b8f607dd0a40a9aef2d4d468fad433522a7
CVE ID: CVE-2018-14044 State: PUBLISHED Published: 2018-07-13T15:00:00Z Last Updated: 2024-09-16T19:24:35.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RateTransposer::setChannels function in RateTransposer.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/soundtouch/readme.md
CVE ID: CVE-2018-14045 State: PUBLISHED Published: 2018-07-13T15:00:00Z Last Updated: 2024-09-17T02:31:42.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FIRFilter::evaluateFilterMulti function in FIRFilter.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/soundtouch/readme.md
CVE ID: CVE-2018-14046 State: PUBLISHED Published: 2018-07-13T15:00:00 Last Updated: 2024-08-05T09:21:40.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/378 - https://access.redhat.com/errata/RHSA-2019:2101
CVE ID: CVE-2018-14047 State: PUBLISHED Published: 2018-07-13T16:00:00Z Last Updated: 2024-09-16T20:58:07.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in PNGwriter 0.7.0. It is a SEGV in pngwriter::readfromfile in pngwriter.cc. NOTE: there is a "Warning: PNGwriter was never designed for reading untrusted files with it. Do NOT use this in sensitive environments, especially DO NOT read PNGs from unknown sources with it!" statement in the master/README.md file Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pngwriter/pngwriter/issues/129 - https://github.com/fouzhe/security/tree/master/pngwriter
CVE ID: CVE-2018-14048 State: PUBLISHED Published: 2018-07-13T16:00:00 Last Updated: 2024-08-05T09:21:40.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fouzhe/security/tree/master/libpng - https://github.com/glennrp/libpng/issues/238 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://seclists.org/bugtraq/2019/Apr/30 - http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Update
seclists.org/bugtraq/2019/Apr/30 - http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html - https://security.gentoo.org/glsa/201908-02
CVE ID: CVE-2018-14049 State: PUBLISHED Published: 2018-07-13T16:00:00Z Last Updated: 2024-09-17T01:16:15.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libwav through 2017-04-20. It is a SEGV in the function print_info in wav_info/wav_info.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marc-q/libwav/issues/22 - https://github.com/fouzhe/security/tree/master/libwav
CVE ID: CVE-2018-14050 State: PUBLISHED Published: 2018-07-13T16:00:00Z Last Updated: 2024-09-16T22:25:42.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libwav through 2017-04-20. It is a SEGV in the function wav_free in libwav.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fouzhe/security/tree/master/libwav - https://github.com/marc-q/libwav/issues/20
CVE ID: CVE-2018-14051 State: PUBLISHED Published: 2018-07-13T16:00:00Z Last Updated: 2024-09-16T17:59:03.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function wav_read in libwav.c in libwav through 2017-04-20 has an infinite loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fouzhe/security/tree/master/libwav - https://github.com/marc-q/libwav/issues/21
CVE ID: CVE-2018-14052 State: PUBLISHED Published: 2018-07-13T16:00:00Z Last Updated: 2024-09-16T19:40:29.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libwav through 2017-04-20. It is a SEGV in the function apply_gain in wav_gain/wav_gain.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fouzhe/security/tree/master/libwav - https://github.com/marc-q/libwav/issues/19
CVE ID: CVE-2018-14054 State: PUBLISHED Published: 2018-07-13T00:00:00 Last Updated: 2024-08-05T09:21:40.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0. A dangling pointer is freed again in the destructor once an exception is triggered. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/07/13/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRSO2IM
KZH2IHSITKVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRSO2IMK6P7MOIZWGWKONPIEHKBA7WL3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GISUIWPKBWPXORUFNWBGFTKQS7UUVUC4/ - https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0
CVE ID: CVE-2018-14055 State: PUBLISHED Published: 2018-07-15T01:00:00 Last Updated: 2024-08-05T09:21:40.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/znc/znc/commit/a7bfbd93812950b7444841431e8e297e62cb524e - https://github.com/znc/znc/commit/d22fef8620cdd87490754f607e7153979731c69d - https://www.debian.org/security/2018/dsa-4252 - https://security.gentoo.org/glsa/201807-03
CVE ID: CVE-2018-14056 State: PUBLISHED Published: 2018-07-15T01:00:00 Last Updated: 2024-08-05T09:21:40.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/znc/znc/commit/a4a5aeeb17d32937d8c7d743dae9a4cc755ce773 - https://www.debian.org/security/2018/dsa-4252 - https://security.gentoo.org/glsa/201807-03
CVE ID: CVE-2018-14057 State: PUBLISHED Published: 2018-08-17T18:00:00 Last Updated: 2024-08-05T09:21:40.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "Settings > Users / Roles" function. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/13 - http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html - https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore
ng-SQL-Injection.html - https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/ - https://www.exploit-db.com/exploits/45208/
CVE ID: CVE-2018-14058 State: PUBLISHED Published: 2018-08-17T18:00:00 Last Updated: 2024-08-05T09:21:40.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pimcore before 5.3.0 allows SQL Injection via the REST web service API. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/13 - http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html - https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/ - https://www.exploit-db.com/exploits/45208/
CVE ID: CVE-2018-14059 State: PUBLISHED Published: 2018-08-24T22:00:00 Last Updated: 2024-08-05T09:21:40.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/13 - http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html - https://www.sec-consult.com/en/blog/advisories/sql-injectio
Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html - https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/ - https://www.exploit-db.com/exploits/45208/
CVE ID: CVE-2018-14060 State: PUBLISHED Published: 2018-07-15T03:00:00 Last Updated: 2024-08-05T09:21:40.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data. Additional Analyst Notes: - CVE Program Container: References: - http://www.cnvd.org.cn/flaw/show/CNVD-2018-04520 - https://github.com/cc-crack/router/blob/master/CNVD-2018-04520.py
CVE ID: CVE-2018-14062 State: PUBLISHED Published: 2019-08-15T21:00:08 Last Updated: 2024-08-05T09:21:40.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of service attacks, and send private messages (unrelated to distress alerts) via a crafted 406 MHz digital signal. Additional Analyst Notes: - CVE Program Container: References: - https://conference.hitb.org/hitbsecconf2019ams/sessions/the-birdman-hacking-cospas-sarsat-satellites/ - https://conference.hitb.org/hitbsecconf2019ams/materials/D1T1%20-%20The%20Birdman%20and%20Cospas-Sarsat%20Satellites%20-%20Hao%20Jingli
nce.hitb.org/hitbsecconf2019ams/materials/D1T1%20-%20The%20Birdman%20and%20Cospas-Sarsat%20Satellites%20-%20Hao%20Jingli.pdf
CVE ID: CVE-2018-14063 State: PUBLISHED Published: 2018-07-15T15:00:00 Last Updated: 2024-08-05T09:21:40.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: The increaseApproval function of a smart contract implementation for Tracto (TRCT), an Ethereum ERC20 token, has an integer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tracto2/Tracto-ERC20/issues/1
CVE ID: CVE-2018-14064 State: PUBLISHED Published: 2018-07-15T15:00:00 Last Updated: 2024-08-05T09:21:41.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40s1kr10s/velotismart-0day-ca5056bcdcac - https://www.exploit-db.com/exploits/45030/
CVE ID: CVE-2018-14065 State: PUBLISHED Published: 2018-07-15T15:00:00 Last Updated: 2024-08-05T09:21:41.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: XMLReader.php in PHPOffice Common before 0.2.9 allows XXE. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PHPOffice/Common/releases/tag/0.2.9 - https://github.com/PHPOffice/PHPWord/issues/1421 - https://github.com/PHPOffice/Common/pull/23
CVE ID: CVE-2018-14066 State: PUBLISHED Published: 2018-07-15T16:00:00Z Last Updated: 2024-09-16T18:19:07.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection. One consequence is that an application without the READ_SMS permission can read SMS messages. This affects Infinix X571 phones, as well as various Lenovo phones (such as the A7020) that have since been fixed by Lenovo. Additional Analyst Notes: - CVE Program Container: References: - https://hacked0x90.wordpress.com/2018/07/12/lenovo-infinix-sql-injection-to-mobile-sms-leakage/
CVE ID: CVE-2018-14067 State: PUBLISHED Published: 2020-12-31T02:22:44 Last Updated: 2024-08-05T09:21:40.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS port, because lighttpd listens on all network interfaces (including the external Internet) by default. NOTE: this may overlap CVE-2017-9980. Additional Analyst Notes: - CVE Program Container: References: - https://www.shellcode.it/article/greenpacket-wimax/
CVE ID: CVE-2018-14068 State: PUBLISHED Published: 2018-07-15T17:00:00 Last Updated: 2024-08-05T09:21:41.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/martinzhou2015/SRCMS/issues/20
CVE ID: CVE-2018-14069 State: PUBLISHED Published: 2018-07-15T17:00:00 Last Updated: 2024-08-05T09:21:41.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/martinzhou2015/SRCMS/issues/20
CVE ID: CVE-2018-14071 State: PUBLISHED Published: 2018-07-16T13:00:00 Last Updated: 2024-08-05T09:21:40.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cyberhobo/wordpress-geo-mashup/issues/817 - https://github.com/cyberhobo/wordpress-geo-mashup/commit/838e2fe15a2328f5ae3dfc75d90e420509286f2f - https://github.com/cyberhobo/wordpress-geo-mashup/blob/master/readme.txt
CVE ID: CVE-2018-14072 State: PUBLISHED Published: 2018-07-15T18:00:00Z Last Updated: 2024-09-16T18:19:23.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: libsixel 1.8.1 has a memory leak in sixel_decoder_decode in decoder.c, image_buffer_resize in fromsixel.c, and sixel_decode_raw in fromsixel.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saitoha/libsixel/issues/67#issue-341198610
CVE ID: CVE-2018-14073 State: PUBLISHED Published: 2018-07-15T18:00:00Z Last Updated: 2024-09-16T23:26:31.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: libsixel 1.8.1 has a memory leak in sixel_allocator_new in allocator.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saitoha/libsixel/issues/67#issuecomment-404989926
CVE ID: CVE-2018-14077 State: PUBLISHED Published: 2018-08-20T20:00:00 Last Updated: 2024-08-05T09:21:40.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to backup the device configuration via a direct request to /Maintenance/configfile.cfg. Additional Analyst Notes: - CVE Program Container: References: - https://vulncode.com/advisory/CVE-2018-14077
CVE ID: CVE-2018-14078 State: PUBLISHED Published: 2018-08-20T20:00:00 Last Updated: 2024-08-05T09:21:41.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to reset the admin password via the /ConfigWizard/ChangePwd.esp?2admin URL (Attackers can login using the "admin" username with password "admin" after a successful attack). Additional Analyst Notes: - CVE Program Container: References: - https://vulncode.com/advisory/CVE-2018-14078
CVE ID: CVE-2018-14079 State: PUBLISHED Published: 2018-08-20T20:00:00 Last Updated: 2024-08-05T09:21:41.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to obtain sensitive information via /Status/SystemStatusRpm.esp. Additional Analyst Notes: - CVE Program Container: References: - https://vulncode.com/advisory/CVE-2018-14079
CVE ID: CVE-2018-14080 State: PUBLISHED Published: 2018-10-09T15:00:00 Last Updated: 2024-08-05T09:21:41.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. One can bypass authentication mechanisms to download the configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nivel4.com/investigaciones/nuevas-vulnerabilidades-en-router-d-link-permiten-tomar-control-remoto-del-dispositivo/
CVE ID: CVE-2018-14081 State: PUBLISHED Published: 2018-10-09T15:00:00 Last Updated: 2024-08-05T09:21:41.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. Device passwords, such as the admin password and the WPA key, are stored in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nivel4.com/investigaciones/nuevas-vulnerabilidades-en-router-d-link-permiten-tomar-control-remoto-del-dispositivo/
CVE ID: CVE-2018-14082 State: PUBLISHED Published: 2018-07-18T16:00:00 Last Updated: 2024-08-05T09:21:41.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45141/ - https://gkaim.com/cve-2018-14082-vikas-chaudhary/
CVE ID: CVE-2018-14083 State: PUBLISHED Published: 2018-07-25T23:00:00 Last Updated: 2024-08-05T09:21:41.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: LICA miniCMTS E8K(u/i/...) devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini file, leading to discovery of a password hash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pudding2/CVE-2018-14083
CVE ID: CVE-2018-14084 State: PUBLISHED Published: 2018-07-16T02:00:00Z Last Updated: 2024-09-16T19:00:40.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hellowuzekai/blockchains/blob/master/README.md
CVE ID: CVE-2018-14085 State: PUBLISHED Published: 2018-07-16T02:00:00Z Last Updated: 2024-09-16T16:22:39.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that the owner adds the evil contract address to his sweepers. The evil contract looks like this: contract Exploit { uint public start; function sweep(address _token, uint _amount) returns (bool) { start = 0x123456789; return true;} }. Then, when one calls the function sweep() in the UserWallet contract, it will change the sweeperList to 0X123456789. Additional Analyst Notes:
he function sweep() in the UserWallet contract, it will change the sweeperList to 0X123456789. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hellowuzekai/blockchains/blob/master/delegatecall.md
CVE ID: CVE-2018-14086 State: PUBLISHED Published: 2018-07-16T02:00:00Z Last Updated: 2024-09-16T19:30:10.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. The contract has an integer overflow. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hellowuzekai/blockchains/blob/master/overflow1.md