Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-25108 State: PUBLISHED Published: 2025-01-16T10:17:21.149Z Last Updated: 2025-01-16T14:13:05.340Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: WAGO Products: 750-8100 (Controller PFC100), 750-831 (Controller BACnet/IP), 750-880 (Controller ETH), 750-889 (Controller KNX IP) Problem Types: CWE-770 Description: An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2018-013
CVE ID: CVE-2018-25109 State: PUBLISHED Published: 2025-03-23T22:31:04.649Z Last Updated: 2025-03-24T13:35:11.668Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Nintendo Products: Animal Crossing, Doubutsu no Mori+, Doubutsu no Mori e+ Problem Types: CWE-119 Description: A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified as critical. Affected by this vulnerability is an unknown functionality of the component Letter Trigram Handler. The manipulation leads to memory corruption. It is possible to launch the attack on the physical device. The complexity of an attack is rath
ds to memory corruption. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300631 - https://vuldb.com/?ctiid.300631 - https://jamchamb.net/2018/07/11/animal-crossing-nes-emulator-hacks.html - https://hunter-r.com/posts/ac-trigrams/ - https://github.com/FIX94/ac-exploit-gc
CVE ID: CVE-2018-25110 State: PUBLISHED Published: 2025-05-23T14:53:43.335Z Last Updated: 2025-05-23T15:09:17.479Z Problem Types: CWE-1333 Description: Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/markedjs/marked/issu
ial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/markedjs/marked/issues/1070 - https://github.com/markedjs/marked/pull/1083 - https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485 - https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110
CVE ID: CVE-2018-25111 State: PUBLISHED Published: 2025-05-31T00:00:00.000Z Last Updated: 2025-06-02T15:50:39.946Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: django-helpdesk Project Products: django-helpdesk Problem Types: CWE-277 Description: django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/django-helpdesk/django-helpdesk/pull/1120 - https://github.com/django-helpdesk/django-helpdesk/releases/tag/v1.0.0 - https://github.com/django-helpdesk/django-helpdesk/issues/591
CVE ID: CVE-2018-25112 State: PUBLISHED Published: 2025-06-04T09:37:34.736Z Last Updated: 2025-06-04T13:16:07.981Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PHOENIX CONTACT Products: ILC 131, ILC 151, ILC 171, ILC 191 ETH Problem Types: CWE-770 Description: An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creating large amounts of network traffic that needs to be handled by the ILC. This results in a Denial-of-Service of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2018-012/
CVE ID: CVE-2018-25113 State: PUBLISHED Published: 2025-07-23T13:50:31.369Z Last Updated: 2025-07-23T14:47:46.824Z Vendors: Dicoogle Project Products: PACS Web Server Problem Types: CWE-22 Description: An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/45007 - https://raw
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/45007 - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/dicoogle_traversal.rb - https://www.fortiguard.com/encyclopedia/ips/46527/dicoogle-pacs-web-server-directory-traversal - https://www.vulncheck.com/advisories/dicoogle-pacs-web-server-path-traversal
CVE ID: CVE-2018-25114 State: PUBLISHED Published: 2025-07-23T13:50:09.708Z Last Updated: 2025-11-21T14:21:11.444Z Vendors: osCommerce Products: Online Merchant Problem Types: CWE-434, CWE-94 Description: A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in
o the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/44374 - https://www.oscommerce.com/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb - https://www.vulncheck.com/advisories/oscommerce-installer-unauth-config-file-injection-php-code-execution
CVE ID: CVE-2018-25115 State: PUBLISHED Published: 2025-08-27T21:24:23.427Z Last Updated: 2025-11-21T14:26:14.630Z Vendors: D-Link Products: DIR-110, DIR-412, DIR-600, DIR-615, DIR-645, DIR-815 Problem Types: CWE-78 Description: Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands tha
, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cr0n1c/dlink_shell_poc/blob/master/dlink_auth_rce - https://www.exploit-db.com/exploits/43496 - https://legacy.us.dlink.com/ - https://support.dlink.com/EndOfLifePolicy.aspx - https://www.vulncheck.com/advisories/dlink-dir-
/legacy.us.dlink.com/ - https://support.dlink.com/EndOfLifePolicy.aspx - https://www.vulncheck.com/advisories/dlink-dir-rce-service-cgi
CVE ID: CVE-2018-25117 State: PUBLISHED Published: 2025-10-15T01:23:35.427Z Last Updated: 2025-11-21T14:27:57.668Z Vendors: Vesta Products: Control Panel (CP) Problem Types: CWE-506 Description: VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or result
ative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.welivesecurity.com/2018/10/18/new-linux-chachaddos-malware-distributed-servers-vestacp-installed/ - https://github.com/outroll/vesta/commit/ee03eff016e03cb76fac7ae3a0f9d1ef0f8ee35b#diff-df8da0c91e9086454c60cd468849630dL1270 - https://github.com/outroll/v
ommit/ee03eff016e03cb76fac7ae3a0f9d1ef0f8ee35b#diff-df8da0c91e9086454c60cd468849630dL1270 - https://github.com/outroll/vesta/commit/a3f0fa1501d424477786e3e7150bb05c0b99518f#diff-df8da0c91e9086454c60cd468849630dR1256 - https://forum.vestacp.com/viewtopic.php?f=10&t=17641&p=73282 - https://forum.vestacp.com/viewtopic.php?f=10&t=17641&start=180#p73907 - https://vestacp.com/ - https://github.com/outroll/vesta - https://www.vulncheck.com/advisories/vestacp-debian-installer-malicious-backdoor-supply-chain-compromise
CVE ID: CVE-2018-25118 State: PUBLISHED Published: 2025-10-20T21:14:41.304Z Last Updated: 2025-11-21T14:30:55.073Z Vendors: GeoVision Inc. Products: GV-BX1500, GV-MFD1501, GeoVision embedded IP devices Problem Types: CWE-78 Description: GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
in the wild as of 2025-10-19 08:55:13.141502 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/43982 - https://github.com/mcw0/PoC/blob/fb06efe05b7e240dc88ff31eb30e1ef345509dce/Geovision-PoC.py#L15 - https://www.vulncheck.com/advisories/geovision-command-injection-rce-picture-catch-cgi - https://www.geovision.com.tw/blog/?cat=14 - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
CVE ID: CVE-2018-25119 State: PUBLISHED Published: 2025-10-30T21:21:46.769Z Last Updated: 2025-11-17T21:36:22.437Z Vendors: Nagios Products: Fusion Problem Types: CWE-79 Description: Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-fusion/ - https://www.vulncheck.com/advisories/nagios-fusion-xss-via-fusionwindow-parameter
CVE ID: CVE-2018-25120 State: PUBLISHED Published: 2025-10-29T18:39:03.581Z Last Updated: 2025-10-30T17:37:43.230Z Vendors: D-Link Products: DNS-343 ShareCenter Problem Types: CWE-78 Description: D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail Test functionality. The web maintenance script posts to the internal goForm endpoint '/goform/Mail_Test' and uses several form parameters directly in a call to a system email utility without proper input validation. An unauthenticated remote attacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The
tacker can supply crafted form data that injects shell commands, resulting in execution as root on the device. NOTE: The DNS-343 product line has been declared end-of-life. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/43845 - https://qkl.seebug.org/vuldb/ssvid-97088 - https://www.dlink.com/al/sq/products/dns-343-sharecenter-4-bay-network-storage-enclosure - https://github.com/jamesbercegay/advisories/blob/master/%5BGTSA-00128%5D%20D-Link%20DNS-343%20ShareCenter%201.05%20Remote%20Root.txt - https://www.vulncheck.com/advisories/dlink-dns343-sharecenter-command-injection-via-goform-mail-test
CVE ID: CVE-2018-25121 State: PUBLISHED Published: 2025-10-30T21:56:43.433Z Last Updated: 2025-11-17T18:21:38.867Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-views-page
CVE ID: CVE-2018-25122 State: PUBLISHED Published: 2025-10-30T21:37:48.530Z Last Updated: 2025-11-17T18:21:39.028Z Vendors: Nagios Products: XI Problem Types: CWE-78 Description: Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inject commands or otherwise execute arbitrary code with the privileges of the application service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulnc
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-component-download-page-rce
CVE ID: CVE-2018-25123 State: PUBLISHED Published: 2025-10-30T21:40:26.892Z Last Updated: 2025-11-17T18:21:39.196Z Vendors: Nagios Products: XI Problem Types: CWE-250 Description: Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with excessive privileges, allowing a local attacker with limited system access to abuse file/command execution paths or writable resources to gain elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-mrtg-graphing-com
ios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-mrtg-graphing-component
CVE ID: CVE-2018-25124 State: PUBLISHED Published: 2025-11-10T22:32:03.086Z Last Updated: 2025-11-21T14:31:59.026Z Vendors: RainbowFish Software Products: PacsOne Server Problem Types: CWE-22 Description: PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within the web-based DICOM viewer component. Successful exploitation allows a remote unauthenticated attacker to read arbitrary files via the 'nocache.php' endpoint with a crafted 'path' parameter. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/
on 2025-02-02 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/43907 - https://pacsone.net/download.htm - https://www.vulncheck.com/advisories/pacsone-server-dicom-web-viewer-directory-traversal-lfi
CVE ID: CVE-2018-25125 State: PUBLISHED Published: 2025-11-14T22:52:24.858Z Last Updated: 2025-11-21T14:34:25.805Z Vendors: Netis Systems Co., Ltd. Products: DL4322D Problem Types: CWE-120 Description: Netis ADSL Router DL4322D firmware RTK 2.1.1 contains a buffer overflow vulnerability in the embedded FTP service that allows an authenticated remote user to trigger a denial of service. After logging in to the FTP service, sending an FTP command such as ABOR with an excessively long argument causes the service, and in practice the router, to crash or become unresponsive, resulting in a loss of availability for the device and connected users. Additional Analyst Notes: - CISA ADP Vulnrichment:
ulting in a loss of availability for the device and connected users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/45424 - https://web.archive.org/web/20180731191918/http://www.netis-systems.com/Home/detail/id/74.html - https://www.netis-systems.com/ - https://www.vulncheck.com/advisories/netis-dl4322d-ftp-service-dos
CVE ID: CVE-2018-25126 State: PUBLISHED Published: 2025-11-24T20:30:45.278Z Last Updated: 2025-11-24T21:03:00.316Z Vendors: Shenzhen TVT Digital Technology Co., Ltd. Products: NVMS-9000 Problem Types: CWE-798, CWE-78 Description: Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-c
hell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endpoints such as /editBlackAndWhiteList and inject shell metacharacters inside XML parameters, resulting in arbitrary command execution as root. The same vulnerable backend is also reachable in some models through a proprietary TCP service on port 4567 that accepts a magic GUID preface and base64-encoded XML, enabling the same command injection sink. Firmware releases from mid-February 2018 and later are reported to have addressed this issue. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-28 UTC. Additional Analyst No
d this issue. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-28 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.archive.org/web/20180614014914/http://en.tvt.net.cn:80/news/227.html - https://github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt - https://qkl.seebug.org/vuldb/ssvid-97217 - https://blogs.juniper.net/en-us/threat-research/iot-botnet-exploiting-tvt-shenzhen-dvrs-still-lingers - https://www.vulncheck.com/advisories/tvt-nvms9000-hardcoded-api-credentials-and-command-injection
CVE ID: CVE-2018-2000 State: PUBLISHED Published: 2019-04-08T14:50:38.043143Z Last Updated: 2024-09-16T19:35:45.781Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/C:N/AC:L/I:L/A:N/PR:N/AV:N/UI:R/S:U/RL:O/E:U/RC:C) Vendors: IBM Products: Business Automation Workflow Problem Types: Gain Access Description: IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/docview.wss?uid=ibm10870496 - https://exchange.xforce.ibmcloud.
ram Container: References: - https://www.ibm.com/support/docview.wss?uid=ibm10870496 - https://exchange.xforce.ibmcloud.com/vulnerabilities/154890 - http://www.securityfocus.com/bid/107851
CVE ID: CVE-2018-2001 State: PUBLISHED Published: 2019-05-07T18:35:20.747030Z Last Updated: 2024-09-17T03:58:51.036Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/A:N/AC:L/UI:R/S:U/PR:N/C:N/I:L/AV:N/E:U/RC:C/RL:O) Vendors: IBM Products: Cram Social Program Management Problem Types: Gain Access Description: IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154891. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/docview.wss?uid=ibm10883184 - https://exchange.xfo
s: - CVE Program Container: References: - https://www.ibm.com/support/docview.wss?uid=ibm10883184 - https://exchange.xforce.ibmcloud.com/vulnerabilities/154891
CVE ID: CVE-2018-2004 State: PUBLISHED Published: 2019-04-29T16:35:17.609992Z Last Updated: 2024-09-16T19:37:09.398Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/PR:L/A:N/I:L/AC:L/UI:R/C:L/S:C/AV:N/RL:O/RC:C/E:H) Vendors: IBM Products: Jazz Reporting Service Problem Types: Cross-Site Scripting Description: IBM Jazz Reporting Service (JRS) 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155006. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/
n. IBM X-Force ID: 155006. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/docview.wss?uid=ibm10882260 - https://exchange.xforce.ibmcloud.com/vulnerabilities/155006 - http://www.securityfocus.com/bid/108099
CVE ID: CVE-2018-2005 State: PUBLISHED Published: 2019-05-20T17:25:23.312944Z Last Updated: 2024-09-17T00:01:56.088Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/C:L/PR:L/AC:L/S:U/UI:N/I:N/A:N/E:U/RL:O/RC:C) Vendors: IBM Products: BigFix Platform Problem Types: Obtain Information Description: IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IBM X-Force ID: 155007 Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/docview.wss?uid=ibm10881996 - https://exchange.xforce.ibmcloud.com/vulnerabilities/155007
CVE ID: CVE-2018-2006 State: PUBLISHED Published: 2019-02-21T17:00:00Z Last Updated: 2024-09-16T20:51:40.439Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/A:N/AC:L/AV:N/C:N/I:H/PR:H/S:U/UI:N/E:U/RC:C/RL:O) Vendors: IBM Products: Robotic Process Automation with Automation Anywhere Problem Types: File Manipulation Description: IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to upload arbitrary files to the system. IBM X-Force ID: 155008. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bi
IBM X-Force ID: 155008. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107122 - https://www.ibm.com/support/docview.wss?uid=ibm10794133 - https://exchange.xforce.ibmcloud.com/vulnerabilities/155008