Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-11549 State: PUBLISHED Published: 2018-05-29T21:00:00Z Last Updated: 2024-09-16T20:53:08.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member" via a QQ number, as demonstrated by a form[qq_10]= substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/139
CVE ID: CVE-2018-11550 State: REJECTED Published: 2018-05-30T04:00:00 Last Updated: 2018-05-30T01:57:01 Description: No description available.
CVE ID: CVE-2018-11551 State: PUBLISHED Published: 2018-06-01T17:00:00 Last Updated: 2024-08-05T08:10:14.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/69
CVE ID: CVE-2018-11552 State: PUBLISHED Published: 2018-06-01T17:00:00 Last Updated: 2024-08-05T08:10:14.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable application. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/70
CVE ID: CVE-2018-11553 State: PUBLISHED Published: 2018-06-06T03:00:00 Last Updated: 2024-08-05T08:10:14.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: SGIN.CN xiangyun platform V9.4.10 has XSS via the login_url parameter to /login.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/helloheary/SGIN.CN-V9.4.10-product-has-XSS-in-login-page/blob/master/README.md
CVE ID: CVE-2018-11554 State: PUBLISHED Published: 2018-06-05T11:00:00 Last Updated: 2024-08-05T08:10:14.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/littleheary/-YzmCMS-User-Traversal-Vulnerability/blob/master/README.md
CVE ID: CVE-2018-11555 State: PUBLISHED Published: 2018-05-30T04:00:00 Last Updated: 2024-08-05T08:10:14.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.” Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gi
the lcms2 library.” Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mm2/Little-CMS/issues/167 - https://github.com/xiaoqx/pocs/tree/master/cms
CVE ID: CVE-2018-11556 State: PUBLISHED Published: 2018-05-30T04:00:00 Last Updated: 2024-08-05T08:10:14.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.” Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mm2
eproduced on the lcms2 library.” Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mm2/Little-CMS/issues/167 - https://github.com/xiaoqx/pocs/tree/master/cms
CVE ID: CVE-2018-11557 State: PUBLISHED Published: 2018-05-30T04:00:00Z Last Updated: 2024-09-17T04:04:10.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/1aker/yiban1/blob/master/README.md
CVE ID: CVE-2018-11558 State: PUBLISHED Published: 2018-05-30T04:00:00Z Last Updated: 2024-09-16T23:21:37.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domainmod/domainmod/issues/66
CVE ID: CVE-2018-11559 State: PUBLISHED Published: 2018-05-30T04:00:00Z Last Updated: 2024-09-17T03:13:26.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domainmod/domainmod/issues/66
CVE ID: CVE-2018-11560 State: PUBLISHED Published: 2018-06-23T19:00:00 Last Updated: 2024-08-05T08:10:14.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/badnack/Insteon_2864-222
CVE ID: CVE-2018-11561 State: PUBLISHED Published: 2018-08-08T17:00:00 Last Updated: 2024-08-05T08:10:14.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER (EETHER), an Ethereum ERC20 token, will lead to an unauthorized increase of an attacker's digital assets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rootclay/Audit-of-smart-contracts/blob/master/0x00a0cbe98e4d110b0fa82646152d77babf2951d0/README.md
CVE ID: CVE-2018-11562 State: PUBLISHED Published: 2018-05-30T20:00:00Z Last Updated: 2024-09-16T19:15:16.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/10080096879d1076756f62760d6daf582b6db722
CVE ID: CVE-2018-11563 State: PUBLISHED Published: 2019-07-08T12:23:59 Last Updated: 2024-08-05T08:10:14.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application. Additional Analyst Notes: - CVE Program Container: References: - https://www.otrs.com/category/release-and-security-notes-en/ - https://lists.otrs.org/pipermail/announce/2018/000720.html - https://community.otrs.com/security-advisory-2018-02-security-upd
//lists.otrs.org/pipermail/announce/2018/000720.html - https://community.otrs.com/security-advisory-2018-02-security-update-for-otrs-framework/ - https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html
CVE ID: CVE-2018-11564 State: PUBLISHED Published: 2018-06-01T21:00:00 Last Updated: 2024-08-05T08:10:14.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/poc.svg" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack. Additional Analyst Notes: - CVE Pro
e/poc.svg. When a user comes along to click that link, it will trigger a XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44837/ - http://ruffsecurity.blogspot.com/2018/05/my-first-cve-found.html - https://packetstormsecurity.com/files/148001/PageKit-CMS-1.0.13-Cross-Site-Scripting.html
CVE ID: CVE-2018-11565 State: PUBLISHED Published: 2018-05-30T21:00:00 Last Updated: 2024-08-05T08:10:14.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information. Additional Analyst Notes: - CVE Program Container: References: - https://mahara.org/interaction/forum/topic.php?id=8271 - https://bugs.launchpad.net/mahara/+bug/1772774
CVE ID: CVE-2018-11567 State: PUBLISHED Published: 2018-05-30T22:00:00 Last Updated: 2024-08-05T08:10:14.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an
tom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device's hearing range. NOTE: The vendor states "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do. Customers do not need to take any action for these mitigations to work. Additional Analyst Notes: - CVE Program Container: References: - https://www.yahoo.com/news/amazon-alexa-bug-let-hackers-104609600.html - https://www
VE Program Container: References: - https://www.yahoo.com/news/amazon-alexa-bug-let-hackers-104609600.html - https://www.wired.com/story/amazon-echo-alexa-skill-spying/ - https://info.checkmarx.com/hubfs/Amazon_Echo_Research.pdf - https://www.checkmarx.com/2018/04/25/eavesdropping-with-amazon-alexa/
CVE ID: CVE-2018-11568 State: PUBLISHED Published: 2018-05-30T22:00:00Z Last Updated: 2024-09-16T22:14:30.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '<' and '>' characters have &lt; and &gt; representations. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/143666/WordPress-GamePlan-Event-And-Gym-Fitness-Theme-1.5.13.2-Cross-Site-Scripting.html
CVE ID: CVE-2018-11569 State: PUBLISHED Published: 2019-09-05T15:32:18 Last Updated: 2024-08-05T08:10:14.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Controller/ListController.php in Eventum 3.5.0 is vulnerable to Deserialization of Untrusted Data. Fixed in version 3.5.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-11571 State: PUBLISHED Published: 2018-05-31T00:00:00 Last Updated: 2024-08-05T08:10:14.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClipperCMS 1.3.3 allows Session Fixation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClipperCMS/ClipperCMS/issues/486
CVE ID: CVE-2018-11572 State: PUBLISHED Published: 2018-05-31T00:00:00 Last Updated: 2024-08-05T08:10:14.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClipperCMS/ClipperCMS/issues/485
CVE ID: CVE-2018-11574 State: PUBLISHED Published: 2018-06-14T20:00:00 Last Updated: 2024-08-05T08:10:14.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the `refuse-app` option are unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3810-1/ - http://www.openwall.com/lists/oss-security/2018/06/11/1
CVE ID: CVE-2018-11575 State: PUBLISHED Published: 2018-05-31T00:00:00 Last Updated: 2024-08-05T08:10:14.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/ngiflib/issues/4 - https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib
CVE ID: CVE-2018-11576 State: PUBLISHED Published: 2018-05-31T00:00:00 Last Updated: 2024-08-05T08:10:14.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/ngiflib/issues/6 - https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib
CVE ID: CVE-2018-11577 State: PUBLISHED Published: 2018-05-31T00:00:00 Last Updated: 2024-08-05T08:10:14.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Edward-L/fuzzing-pocs/tree/master/liblouis - https://usn.ubuntu.com/3669-1/ - https://github.com/liblouis/liblouis/issues/582 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html
CVE ID: CVE-2018-11578 State: PUBLISHED Published: 2018-05-31T00:00:00 Last Updated: 2024-08-05T08:10:14.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: GifIndexToTrueColor in ngiflib.c in MiniUPnP ngiflib 0.4 has a Segmentation fault. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/ngiflib/issues/5 - https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib
CVE ID: CVE-2018-11579 State: PUBLISHED Published: 2018-05-31T01:00:00Z Last Updated: 2024-09-16T22:03:03.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action. Additional Analyst Notes: - CVE Program Container: References: - http://labs.threatpress.com/unauthenticated-settings-change-vulnerability-in-woocommerce-category-banner-management-plugin/ - https://wordpre
ss.com/unauthenticated-settings-change-vulnerability-in-woocommerce-category-banner-management-plugin/ - https://wordpress.org/plugins/banner-management-for-woocommerce/#developers
CVE ID: CVE-2018-11580 State: PUBLISHED Published: 2018-05-31T01:00:00Z Last Updated: 2024-09-16T17:03:43.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/mass-pagesposts-creator/#developers - http://labs.threatpress.com/mass-pages
References: - https://wordpress.org/plugins/mass-pagesposts-creator/#developers - http://labs.threatpress.com/mass-pages-posts-creator/
CVE ID: CVE-2018-11581 State: PUBLISHED Published: 2018-06-01T17:00:00 Last Updated: 2024-08-05T08:10:14.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44839/ - https://support.brother.com/g/b/faqend.aspx?c=us_ot&lang=en&prod=group2&ftype3=100033&faqid=faq00100530_000
CVE ID: CVE-2018-11583 State: PUBLISHED Published: 2018-05-31T03:00:00Z Last Updated: 2024-09-16T16:17:33.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/alice19940905/88b194b89e83c5c0a394f7f297111e12
CVE ID: CVE-2018-11586 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T08:10:14.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148032/SearchBlox-8.6.7-XML-External-Entity-Injection.html - https://gurelahmet.com/searchblox-8-6-7-out-of-band-xml-external-entity-oob-xxe-cve-2018-11586/ - https://www.exploit-db.com/exploits/4482
.com/searchblox-8-6-7-out-of-band-xml-external-entity-oob-xxe-cve-2018-11586/ - https://www.exploit-db.com/exploits/44827/
CVE ID: CVE-2018-11587 State: PUBLISHED Published: 2018-06-25T18:00:00 Last Updated: 2024-08-05T08:10:14.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/6263 - https://github.com/centreon/centreon/releases - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
CVE ID: CVE-2018-11588 State: PUBLISHED Published: 2018-06-25T18:00:00 Last Updated: 2024-08-05T08:10:14.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/releases - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html - https://github.com
/documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html - https://github.com/centreon/centreon/pull/6260 - https://github.com/centreon/centreon/pull/6259
CVE ID: CVE-2018-11589 State: PUBLISHED Published: 2018-06-25T18:00:00 Last Updated: 2024-08-05T08:10:14.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/6250 - https://github.com/centreon/centreon/pull/6257 - https://github.com/centreon
://github.com/centreon/centreon/pull/6250 - https://github.com/centreon/centreon/pull/6257 - https://github.com/centreon/centreon/pull/6251 - https://github.com/centreon/centreon/pull/6256 - https://github.com/centreon/centreon/releases - https://github.com/centreon/centreon/pull/6255 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
CVE ID: CVE-2018-11590 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-16T20:06:17.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflow during syntax parsing. This was addressed by fixing stack size detection on Linux in jsutils.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/issues/1427 - https://github.com/espruino/Espruino/commit/a0d7f432abee692402c00e8b615ff5982dde9780 - https://github.com/espruino/Espruino/files/2019243/so_0.txt
CVE ID: CVE-2018-11591 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-16T23:41:10.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing. This was addressed by adding validation for a debug trace print statement in jsvar.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/issues/1420 - https://github.com/espruino/Espruino/commit/b6d362f6a1f2de0b3e7604848116efb509196bf4 - https://github.com/espruino/Espruino/files/2015612/test.txt
CVE ID: CVE-2018-11592 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-16T16:53:52.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via an Out-of-bounds Read during syntax parsing in which certain height validation is missing in libs/graphics/jswrap_graphics.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/issues/1421 - https://github.com/espruino/Espruino/files/2015630/test_0.txt - https://github.com/espruino/Espruino/commit/8a44b04b584b3d3ab1cb68fed410f7ecb165e50e