Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-16254 State: PUBLISHED Published: 2019-04-12T17:57:02 Last Updated: 2024-08-05T10:17:38.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/
gle.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html
CVE ID: CVE-2018-16255 State: PUBLISHED Published: 2019-04-12T17:59:02 Last Updated: 2024-08-05T10:17:38.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or
YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html
CVE ID: CVE-2018-16256 State: PUBLISHED Published: 2019-04-12T18:00:13 Last Updated: 2024-08-05T10:17:38.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-i
document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html
CVE ID: CVE-2018-16257 State: PUBLISHED Published: 2019-04-12T18:02:31 Last Updated: 2024-08-05T10:17:38.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-import-a
t/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html
CVE ID: CVE-2018-16258 State: PUBLISHED Published: 2019-04-12T18:03:54 Last Updated: 2024-08-05T10:17:38.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogsp
ttps://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html
CVE ID: CVE-2018-16259 State: PUBLISHED Published: 2019-04-12T18:05:35 Last Updated: 2024-08-05T10:17:38.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf
es: - https://docs.google.com/document/d/1Lfk0YQMIhlMCOOvVRX8HkU6C50s9QSW7C-9gnNmzsHY/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-in-import-any-xml-or-csv-file-for.html
CVE ID: CVE-2018-16261 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-08-05T10:17:38.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Trust. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877
CVE ID: CVE-2018-16262 State: PUBLISHED Published: 2020-01-22T12:20:33 Last Updated: 2024-08-05T10:17:38.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations. Such actions include installing, decrypting, and killing other packages. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://review.tizen.org/git/?p=platform/core/appfw/pkgmgr-server.git%3Ba=commit%3Bh=aac8a95859828a058d8e06893982b11ebc
https://review.tizen.org/git/?p=platform/core/appfw/pkgmgr-server.git%3Ba=commit%3Bh=aac8a95859828a058d8e06893982b11ebc81dd78 - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16263 State: PUBLISHED Published: 2020-01-22T12:41:08 Last Updated: 2024-08-05T10:17:38.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-
ongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://review.tizen.org/git/?p=platform/upstream/pulseaudio.git%3Ba=commit%3Bh=81e8ba9f3ab0917da4fdfa094f49333be57964c6 - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16264 State: PUBLISHED Published: 2020-01-22T12:42:59 Last Updated: 2024-08-05T10:17:38.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-C
ON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://review.tizen.org/git/?p=platform/upstream/bluez.git%3Ba=commit%3Bh=ff9878c95efc12d4a4495153ab51e3a09f8d3c01 - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16265 State: PUBLISHED Published: 2020-01-22T12:45:43 Last Updated: 2024-08-05T10:17:38.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing process, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim
0CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://review.tizen.org/git/?p=platform/core/connectivity/bluetooth-frwk.git%3Ba=commit%3Bh=074dfc9709d8cee84564fc815796b0ef0c3273f5 - https://review.tizen.org/git/?p=platform/core/connectivity/bluetooth-frwk.git%3Ba=commit%3Bh=bafbd66906ae5712874dc0d7dd6288d2c1ae4db2 - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16266 State: PUBLISHED Published: 2020-01-22T12:15:27 Last Updated: 2024-08-05T10:17:38.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-W
ons/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://review.tizen.org/git/?p=platform/upstream/enlightenment.git%3Ba=commit%3Bh=8ff5c24d04f97b1c84b463535876600b22128fb4 - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16267 State: PUBLISHED Published: 2020-01-22T12:49:24 Last Updated: 2024-08-05T10:17:38.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%
- CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://review.tizen.org/git/?p=platform/core/system/system-popup.git%3Ba=commit%3Bh=57b3c2f3cd61c6f432e7abe3a2d8b0df72fd4b0e - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16268 State: PUBLISHED Published: 2020-01-22T12:51:16 Last Updated: 2024-08-05T10:17:38.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security policy configurations. Such actions include playing an arbitrary sound file or DTMF tones. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Ke
References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://review.tizen.org/git/?p=platform/core/multimedia/libmm-sound.git%3Ba=commit%3Bh=7fce6f2d6d480b3bd0e84a5ba3f72173a37e36db - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16269 State: PUBLISHED Published: 2020-01-22T12:59:55 Last Updated: 2024-08-05T10:17:38.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-C
tations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16270 State: PUBLISHED Published: 2020-01-22T13:01:29 Last Updated: 2024-08-05T10:17:38.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://www.youtube.com/watch?v=3IdgBwbOT-g&f
26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16271 State: PUBLISHED Published: 2020-01-22T13:03:26 Last Updated: 2024-08-05T10:17:38.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20
CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16272 State: PUBLISHED Published: 2020-01-22T13:04:37 Last Updated: 2024-08-05T10:17:38.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2. Additional Analyst Notes: - CVE Program Container: References: - https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-
ntations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf - https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE ID: CVE-2018-16275 State: PUBLISHED Published: 2018-08-31T13:00:00Z Last Updated: 2024-09-16T16:13:35.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: OPSWAT MetaDefender before v4.11.2 allows CSV injection. Additional Analyst Notes: - CVE Program Container: References: - https://onlinehelp.opswat.com/corev4/10._Release_notes.html
CVE ID: CVE-2018-16276 State: PUBLISHED Published: 2018-08-31T16:00:00 Last Updated: 2024-08-05T10:17:38.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3776-1/ - https://usn.ubuntu.com/3776-2/ - https://usn.ubuntu.com/3847-1/ - https://github.com/torvalds/linux/commit/f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 - https://lists.debian.
.com/3847-1/ - https://github.com/torvalds/linux/commit/f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://usn.ubuntu.com/3847-2/ - https://usn.ubuntu.com/3849-1/ - https://bugzilla.suse.com/show_bug.cgi?id=1106095 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 - https://usn.ubuntu.com/3849-2/ - https://www.debian.org/security/2018/dsa-4308 - https://usn.ubuntu.com/3847-3/ - https://bugzilla.suse.com/show_bug.cgi?id=1115593 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.7
CVE ID: CVE-2018-16277 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:17:38.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Image Import function in XWiki through 10.7 has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://mksec.tk/index.php/2018/09/27/cve-2018-16277-xss-in-xwiki/
CVE ID: CVE-2018-16278 State: PUBLISHED Published: 2018-08-31T16:00:00 Last Updated: 2024-08-05T10:17:38.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajax_save_draft function with the dir parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/howchen/howchen/issues/3
CVE ID: CVE-2018-16281 State: PUBLISHED Published: 2018-09-21T16:00:00 Last Updated: 2024-08-05T10:17:38.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/1210816/profields-project-custom-fields/version-history
CVE ID: CVE-2018-16282 State: PUBLISHED Published: 2018-09-20T20:00:00 Last Updated: 2024-08-05T10:17:38.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tim124058/5c4babe391a016c771d2cccabead21cb - https://www.moxa.com/support/download.aspx?type=support&id=15851
CVE ID: CVE-2018-16283 State: PUBLISHED Published: 2018-09-24T22:00:00 Last Updated: 2024-08-05T10:17:38.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Sep/32 - https://wpvulndb.com/vulnerabilities/9132 - https://www.exploit-db.com/exploits/45438/ - https://github.com/springjk/wordpress-wechat-broadcast/issues/14
CVE ID: CVE-2018-16285 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-08-05T10:17:38.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9124 - https://risataim.blogspot.com/2018/09/xss-en-plugin-userpro-de-wordpress.html
CVE ID: CVE-2018-16286 State: PUBLISHED Published: 2018-09-14T21:00:00 Last Updated: 2024-08-05T10:17:38.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits. Additional Analyst Notes: - CVE Program Container: References: - http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html
CVE ID: CVE-2018-16287 State: PUBLISHED Published: 2018-09-14T21:00:00 Last Updated: 2024-08-05T10:17:38.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs. Additional Analyst Notes: - CVE Program Container: References: - http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html
CVE ID: CVE-2018-16288 State: PUBLISHED Published: 2018-09-14T21:00:00 Last Updated: 2024-08-05T10:17:38.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45440/ - http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html
CVE ID: CVE-2018-16291 State: PUBLISHED Published: 2018-10-08T16:00:00 Last Updated: 2024-08-05T10:17:38.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled
s to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.securitytracker.com/id/1041769