Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-19167 State: PUBLISHED Published: 2019-11-05T20:15:19 Last Updated: 2024-08-05T11:30:04.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloakCoin through 2.2.2.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40dsl_uiuc/fake-stake-attacks-on-chain-based-proof-of-stake-cryptocurrencies-b8b05723f806 - http://fc19.ifca.ai/preproceedings/180-preproceedings.pdf
CVE ID: CVE-2018-19168 State: PUBLISHED Published: 2018-11-11T00:00:00Z Last Updated: 2024-09-16T17:24:20.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shell Metacharacter Injection in www/modules/save.php in FruityWifi (aka PatatasFritas/PatataWifi) through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted mod_name parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid session. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xtr4nge/FruityWifi/issues/250
CVE ID: CVE-2018-19170 State: PUBLISHED Published: 2018-11-11T05:00:00Z Last Updated: 2024-09-16T22:02:09.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JpressProjects/jpress/issues/89
CVE ID: CVE-2018-19178 State: PUBLISHED Published: 2018-11-11T16:00:00 Last Updated: 2024-08-05T11:30:04.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zchuanzhao/jeesns/issues/6
CVE ID: CVE-2018-19180 State: PUBLISHED Published: 2018-11-11T17:00:00Z Last Updated: 2024-09-16T17:48:47.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: statics/app/index/controller/Install.php in YUNUCMS 1.1.5 (if install.lock is not present) allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DB_PREFIX field, which is written to database.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/doublefast/yunucms/issues/1
CVE ID: CVE-2018-19181 State: PUBLISHED Published: 2018-11-11T17:00:00Z Last Updated: 2024-09-17T03:23:43.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/doublefast/yunucms/issues/1
CVE ID: CVE-2018-19182 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T11:30:04.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: Engelsystem before commit hash 2e28336 allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MyIgel/engelsystem/commit/2e28336818183e2c63c8015fb476bc01c822f50a - https://github.com/engelsystem/engelsystem/issues/494
CVE ID: CVE-2018-19183 State: PUBLISHED Published: 2018-11-12T00:00:00 Last Updated: 2024-08-05T11:30:04.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" attribute. NOTE: the vendor disputes this because REVERT is a normal bytecode that can be triggered from high-level source code, leading to a normal programmatic execution result. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereumjs/ethereumjs-vm/issues/386 - https://github.com/ethereumjs/ethereumjs-monorepo/issues/395#issuecomment-472449204 - htt
mjs/ethereumjs-vm/issues/386 - https://github.com/ethereumjs/ethereumjs-monorepo/issues/395#issuecomment-472449204 - https://github.com/ethereumjs/ethereumjs-monorepo/issues/386#issuecomment-439372074
CVE ID: CVE-2018-19184 State: PUBLISHED Published: 2018-11-12T02:00:00 Last Updated: 2024-08-05T11:30:04.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/issues/18069
CVE ID: CVE-2018-19185 State: PUBLISHED Published: 2018-11-12T05:00:00 Last Updated: 2024-08-05T11:30:04.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoder_encodeOctetString in mms/asn1/ber_encoder.c. This is exploitable even after CVE-2018-18834 has been patched, with a different dataSetValue sequence than the CVE-2018-18834 attack vector. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fouzhe/security/tree/master/libiec61850#another-heap-buffer-overflow-in-function-berencoder_encodeoctetstring - https://github.com/mz-automation/libiec61850/issues/87
CVE ID: CVE-2018-19186 State: PUBLISHED Published: 2018-11-14T07:00:00 Last Updated: 2024-08-05T11:30:04.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.seekurity.com/blog/general/payfort-multiple-security-issues-and-concerns-in-a-supposed-to-be-pci-dss-compliant-payment-processor-sdk
CVE ID: CVE-2018-19187 State: PUBLISHED Published: 2018-11-14T07:00:00 Last Updated: 2024-08-05T11:30:03.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php echo statement. Additional Analyst Notes: - CVE Program Container: References: - https://www.seekurity.com/blog/general/payfort-multiple-security-issues-and-concerns-in-a-supposed-to-be-pci-dss-compliant-payment-processor-sdk - http://www.securityfocus.com/bid/105930
CVE ID: CVE-2018-19188 State: PUBLISHED Published: 2018-11-14T07:00:00 Last Updated: 2024-08-05T11:30:04.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/payfort/payfort-php-sdk/issues/12 - https://www.seekurity.com/blog/general/payfort-multiple-security-issues-and-concerns-in-a-supposed-to-be-pci-dss-compliant-payment-processor-sdk - http://www.securityfocus.com/bid/105930
CVE ID: CVE-2018-19189 State: PUBLISHED Published: 2018-11-14T07:00:00 Last Updated: 2024-08-05T11:30:04.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement. Additional Analyst Notes: - CVE Program Container: References: - https://www.seekurity.com/blog/general/payfort-multiple-security-issues-and-concerns-in-a-supposed-to-be-pci-dss-compliant-payment-processor-sdk - http://www.securityfocus.com/bid/105930
CVE ID: CVE-2018-19190 State: PUBLISHED Published: 2018-11-14T07:00:00 Last Updated: 2024-08-05T11:30:04.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.seekurity.com/blog/general/payfort-multiple-security-issues-and-concerns-in-a-supposed-to-be-pci-dss-compliant-payment-processor-sdk - http://www.securityfocus.com/bid/105930
CVE ID: CVE-2018-19191 State: PUBLISHED Published: 2019-03-17T21:27:18 Last Updated: 2024-08-05T11:30:04.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151144/Webmin-1.890-Cross-Site-Scripting.html - http://www.webmin.com/index.html
CVE ID: CVE-2018-19192 State: PUBLISHED Published: 2018-11-12T05:00:00Z Last Updated: 2024-09-16T16:27:47.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the data[content] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/XiaoCms/blob/master/CSRF.md
CVE ID: CVE-2018-19193 State: PUBLISHED Published: 2018-11-12T05:00:00Z Last Updated: 2024-09-17T02:41:35.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/XiaoCms/blob/master/XSS.md#xss1
CVE ID: CVE-2018-19194 State: PUBLISHED Published: 2018-11-12T05:00:00Z Last Updated: 2024-09-17T03:43:31.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/XiaoCms/blob/master/INFO_EXP.md
CVE ID: CVE-2018-19195 State: PUBLISHED Published: 2018-11-12T05:00:00Z Last Updated: 2024-09-16T19:04:19.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\show_product.html file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/XiaoCms/blob/master/XSS.md#xss2
CVE ID: CVE-2018-19196 State: PUBLISHED Published: 2018-11-12T05:00:00Z Last Updated: 2024-09-16T20:07:31.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.patec.cn/newsshow.php?cid=24&id=136 - https://github.com/AvaterXXX/XiaoCms/blob/master/GETSHELL.md
CVE ID: CVE-2018-19197 State: PUBLISHED Published: 2018-11-12T05:00:00Z Last Updated: 2024-09-17T03:17:23.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths[]=../ directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.patec.cn/newsshow.php?cid=24&id=136 - https://github.com/AvaterXXX/XiaoCms/blob/master/DIR_DEL.md
CVE ID: CVE-2018-19198 State: PUBLISHED Published: 2018-11-12T15:00:00 Last Updated: 2024-08-05T11:30:04.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/uriparser/uriparser/commit/864f5d4c127def386dd5cc926ad96934b297f04e - https://lists.debian.org/debian-lts-announce/2018/11/msg00019.html - https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog - https://access.redhat.com/err
11/msg00019.html - https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog - https://access.redhat.com/errata/RHSA-2019:2280
CVE ID: CVE-2018-19199 State: PUBLISHED Published: 2018-11-12T15:00:00 Last Updated: 2024-08-05T11:30:04.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/11/msg00019.html - https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog - https://github.com/uriparser/uriparser/commit/f76275d4a91b28d687250525d3a0c5509bbd666f - https://access.redhat.com/errata/RHSA-2019:2280
CVE ID: CVE-2018-19200 State: PUBLISHED Published: 2018-11-12T15:00:00 Last Updated: 2024-08-05T11:30:04.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/11/msg00019.html - https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog - https://github.com/uriparser/uriparser/commit/f58c25069cf4a986fe17a80c5b38687e31feb539
CVE ID: CVE-2018-19201 State: PUBLISHED Published: 2019-03-29T18:58:41 Last Updated: 2024-08-05T11:30:04.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/ - https://github.com/mybb/mybb/blob/feature/SECURITY.md#technical-details-of-known-issues
CVE ID: CVE-2018-19202 State: PUBLISHED Published: 2019-04-11T20:00:10 Last Updated: 2024-08-05T11:30:04.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.mybb.com/ - https://mybb.com/versions/1.8.20/
CVE ID: CVE-2018-19203 State: PUBLISHED Published: 2018-11-12T16:00:00Z Last Updated: 2024-09-16T16:12:25.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-22/ - https://www.paessler.com/prtg/history/stable#18.2.41.1652 - http://en.securitylab.ru/lab/PT-2018-22
CVE ID: CVE-2018-19204 State: PUBLISHED Published: 2018-11-12T16:00:00Z Last Updated: 2024-09-16T23:40:54.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport_' is mishandled. The attacker can craft an HTTP request and override the 'writeresult' command-line parameter for HttpAdvancedSensor.exe to store arbitrary data in an arbitrary place on the file system. For example, the attacker can create an executable file in the
arbitrary data in an arbitrary place on the file system. For example, the attacker can create an executable file in the \Custom Sensors\EXE directory and execute it by creating EXE/Script Sensor. Additional Analyst Notes: - CVE Program Container: References: - https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-23/ - http://en.securitylab.ru/lab/PT-2018-23 - https://www.paessler.com/prtg/history/stable#18.3.44.2054
CVE ID: CVE-2018-19205 State: PUBLISHED Published: 2018-11-12T17:00:00Z Last Updated: 2024-09-16T23:51:52.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php. Additional Analyst Notes: - CVE Program Container: References: - https://roundcube.net/news/2018/07/27/update-1.3.7-released - https://github.com/roundcube/roundcubemail/releases/tag/1.3.7
CVE ID: CVE-2018-19206 State: PUBLISHED Published: 2018-11-12T17:00:00 Last Updated: 2024-08-05T11:30:04.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/roundcube/roundcubemail/releases/tag/1.3.8 - https://www.debian.org/security/2018/dsa-4344 - https://roundcube.net/news/2018/10/26/update-1.3.8-released
CVE ID: CVE-2018-19207 State: PUBLISHED Published: 2018-11-12T17:00:00 Last Updated: 2024-08-05T11:30:04.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105921 - https://wordpress.org/plugins/wp-gdpr-compliance/#developers - https://wpvulndb.com/vulnerabilities/9144 - https://www.wordfence.com/blog/2018/11/trends-following-vulnerability-in-wp-gdpr-complia
lndb.com/vulnerabilities/9144 - https://www.wordfence.com/blog/2018/11/trends-following-vulnerability-in-wp-gdpr-compliance-plugin/
CVE ID: CVE-2018-19208 State: PUBLISHED Published: 2018-11-12T19:00:00 Last Updated: 2024-08-05T11:30:04.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1643752 - https://access.redhat.com/errata/RHSA-2019:2126
CVE ID: CVE-2018-19209 State: PUBLISHED Published: 2018-11-12T19:00:00 Last Updated: 2024-08-05T11:30:04.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwide Assembler (NASM) 2.14rc15 has a NULL pointer dereference in the function find_label in asm/labels.c that will lead to a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - https://repo.or.cz/nasm.git/commitdiff/e996d28c70d45008085322b442b44a9224308548 - https://bugzilla.suse.com/show_bug.cgi?id=1115797
CVE ID: CVE-2018-19210 State: PUBLISHED Published: 2018-11-12T19:00:00 Last Updated: 2024-08-05T11:30:04.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105932 - https://usn.ubuntu.com/3906-1/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00026.html - http://bugzilla.maptools.org/show_bug.cgi?id=2820 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html - https://l
ptools.org/show_bug.cgi?id=2820 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TX5UEYHGMTNEHJB4FHE7HCJ75UQDNKGB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C6IL2QFKE6MGVUTOPU2UUWITTE36KRDF/ - https://seclists.org/bugtraq/2019/Nov/5 - http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.html - https://security.gentoo.org/glsa/202003-25 - https://www.debian.org/security/2020/dsa-4670
CVE ID: CVE-2018-19211 State: PUBLISHED Published: 2018-11-12T19:00:00 Last Updated: 2024-08-05T11:30:04.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1643754
CVE ID: CVE-2018-19212 State: PUBLISHED Published: 2018-11-12T19:00:00Z Last Updated: 2024-09-16T21:03:30.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libwebm through 2018-10-03, there is an abort caused by libwebm::Webm2Pes::InitWebmParser() that will lead to a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1644196
CVE ID: CVE-2018-19213 State: PUBLISHED Published: 2018-11-12T19:00:00Z Last Updated: 2024-09-16T18:29:28.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwide Assembler (NASM) through 2.14rc16 has memory leaks that may lead to DoS, related to nasm_malloc in nasmlib/malloc.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392524
CVE ID: CVE-2018-19214 State: PUBLISHED Published: 2018-11-12T19:00:00 Last Updated: 2024-08-05T11:30:04.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwide Assembler (NASM) 2.14rc15 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for insufficient input. Additional Analyst Notes: - CVE Program Container: References: - https://repo.or.cz/nasm.git/commit/661f723d39e03ca6eb05d7376a43ca33db478354 - https://bugzilla.nasm.us/show_bug.cgi?id=3392521 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html
CVE ID: CVE-2018-19215 State: PUBLISHED Published: 2018-11-12T19:00:00 Last Updated: 2024-08-05T11:30:04.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwide Assembler (NASM) 2.14rc16 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for the special cases of the % and $ and ! characters. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392525 - https://repo.or.cz/nasm.git/commit/4b5b737d4991578b1918303dc0fd9c9ab5c7ce4f - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html
CVE ID: CVE-2018-19216 State: PUBLISHED Published: 2018-11-12T19:00:00 Last Updated: 2024-08-05T11:30:04.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwide Assembler (NASM) before 2.13.02 has a use-after-free in detoken at asm/preproc.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392424 - https://repo.or.cz/nasm.git/commitdiff/9b7ee09abfd426b99aa1ea81d19a3b2818eeabf9 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html