Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-15660 State: PUBLISHED Published: 2018-08-21T17:00:00Z Last Updated: 2024-09-16T22:40:58.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions, then the attacker can read certain Ola Money data such as a credit card number, expiration date, bank account number, and transaction history. NOTE: the vendor does not agree that this is a security issue requiring a fix Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/ma
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf
CVE ID: CVE-2018-15661 State: PUBLISHED Published: 2018-08-21T17:00:00Z Last Updated: 2024-09-16T23:45:59.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions and the ability to read SMS messages, then the Forgot Password screen can be used to bypass authentication. NOTE: the vendor does not agree that this is a security issue requiring a fix Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf
CVE ID: CVE-2018-15664 State: PUBLISHED Published: 2019-05-23T13:58:37 Last Updated: 2024-08-05T10:01:54.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1096726 - https://github.com/moby/moby/pull/39252 - http://www.openwall.co
: - https://bugzilla.suse.com/show_bug.cgi?id=1096726 - https://github.com/moby/moby/pull/39252 - http://www.openwall.com/lists/oss-security/2019/05/28/1 - http://www.securityfocus.com/bid/108507 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html - https://usn.ubuntu.com/4048-1/ - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664 - https://access.redhat.com/errata/RHSA-2019:1910 - http://www.openwall.com/lists/oss-security/2019/08/21/1 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
CVE ID: CVE-2018-15665 State: PUBLISHED Published: 2019-06-21T14:18:37 Last Updated: 2024-08-05T10:01:54.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.2.x through 1.4.0. Unauthenticated users can get a list of user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com - https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
CVE ID: CVE-2018-15667 State: PUBLISHED Published: 2018-08-21T23:00:00 Last Updated: 2024-08-05T10:01:54.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. It registers and uses the airmail:// URL scheme. The "send" command in the URL scheme allows an external application to send arbitrary emails from an active account without authentication. The handler has no restriction on who can use its functionality. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission
n email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an attacker crafted email from the target account. Additional Analyst Notes: - CVE Program Container: References: - https://versprite.com/advisories/airmail-3-for-mac/
CVE ID: CVE-2018-15668 State: PUBLISHED Published: 2018-08-21T23:00:00 Last Updated: 2024-08-05T10:01:54.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary emails from an active account. URL parameters for the "send" command with the "attachment_" prefix designate attachment parameters. If the value of an attachment parameter corresponds to an accessible file path, the file is attached to the outbound message. In addition, relative file paths are acceptable attachment parameter values. The handler can be invoked using any me
ge. In addition, relative file paths are acceptable attachment parameter values. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an email with designated attachments from the target account to a target address. Additional Analyst Notes: - CVE Program Container: References: - https://versprite.com/advisories/airmail-3-for-mac-2/
CVE ID: CVE-2018-15669 State: PUBLISHED Published: 2018-08-21T23:00:00 Last Updated: 2024-08-05T10:01:54.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are not forbidden by the policy. An attacker may abuse HTML plug-in elements within an email to trigger frame navigation requests that bypass this filter. Additional Analyst Notes: - CVE Program Container: References: - https://versprite.com/ad
uests that bypass this filter. Additional Analyst Notes: - CVE Program Container: References: - https://versprite.com/advisories/airmail-3-for-mac-3/
CVE ID: CVE-2018-15670 State: PUBLISHED Published: 2018-08-21T23:00:00 Last Updated: 2024-08-05T10:01:54.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. A navigation request is processed by the default URL handler only if the currentEvent is NX_LMOUSEUP or NX_OMOUSEUP. An attacker may abuse HTML elements with an EventHandler for a chance to validate navigation requests for URLs that are processed during the NX_LMOUSEUP event triggered by clicking an email. Add
alidate navigation requests for URLs that are processed during the NX_LMOUSEUP event triggered by clicking an email. Additional Analyst Notes: - CVE Program Container: References: - https://versprite.com/advisories/airmail-3-for-mac-4/
CVE ID: CVE-2018-15671 State: PUBLISHED Published: 2018-08-21T23:00:00 Last Updated: 2024-08-05T10:01:54.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.10.2 library. Excessive stack consumption has been detected in the function H5P__get_cb() in H5Pint.c during an attempted parse of a crafted HDF file. This results in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SegfaultMasters/covering360/tree/master/HDF5#stack-overflow---stackoverflow_h5p__get_cb
CVE ID: CVE-2018-15672 State: REJECTED Published: 2018-08-21T23:00:00 Last Updated: 2018-08-29T23:57:01 Description: No description available.
CVE ID: CVE-2018-15676 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints. Additional Analyst Notes: - CVE Program Container: References: - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15677 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/btiteam/xbtit/pull/58 - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15678 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/btiteam/xbtit/pull/58 - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15679 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/btiteam/xbtit/pull/58 - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15680 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15681 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie can efficiently brute-force it to retrieve the user's cleartext password. Additional Analyst Notes: - CVE Program Container: References: - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15682 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf. Additional Analyst Notes: - CVE Program Container: References: - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15683 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user is already logged in when accessing the page, they will be instantly redirected. Additional Analyst Notes: - CVE Program Container: References: - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15684 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:01:54.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (/include/logs) using predictable file names, which can lead to full path disclosure and leakage of sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-15685 State: PUBLISHED Published: 2018-08-23T05:00:00 Last Updated: 2024-08-05T10:01:54.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45272/ - https://electronjs.org/blog/web-preferences-fix
CVE ID: CVE-2018-15686 State: PUBLISHED Published: 2018-10-26T14:00:00.000Z Last Updated: 2025-06-09T15:50:48.760Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: systemd Products: systemd Problem Types: fgets() can be confused by overly-long input strings. The first read will return a partial string and subsequent reads will begin as if it were a new line. Description: A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and inc
e systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.gentoo.org/glsa/201810-10 - https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html - http://www.securityfocus.com/bid/105747 - https://www.exploit-db.com/exploits/45714/ - https://usn.ubuntu.com/3816-1/ - https://access.redhat.com/errata/RHSA-2019:2091 - https://access.redhat.com/errata/RHSA-2019:3222 - https://access.redhat.com/errata/RHSA-2020:0593 - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0
m/errata/RHSA-2020:0593 - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://github.com/systemd/systemd/pull/10519
CVE ID: CVE-2018-15687 State: PUBLISHED Published: 2018-10-26T14:00:00.000Z Last Updated: 2025-06-09T15:48:38.953Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: systemd Products: systemd Problem Types: There is a race condition between a stat(2) call and the fchmodat(2) call. Description: A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.gentoo.org/glsa/201810-10 - https://github.com/systemd/systemd/pull/10517/com
lnrichment: References: - https://security.gentoo.org/glsa/201810-10 - https://github.com/systemd/systemd/pull/10517/commits - http://www.securityfocus.com/bid/105748 - https://usn.ubuntu.com/3816-1/ - https://www.exploit-db.com/exploits/45715/
CVE ID: CVE-2018-15688 State: PUBLISHED Published: 2018-10-26T14:00:00.000Z Last Updated: 2025-06-09T15:55:41.023Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: systemd Products: systemd Problem Types: dhcp6_option_append_ia() contained an incorrect buffer size calculation. Description: A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.gentoo.org/glsa/201810-10 - https://lists.debian.org/debian-lts-a
CISA ADP Vulnrichment: References: - https://security.gentoo.org/glsa/201810-10 - https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html - https://usn.ubuntu.com/3807-1/ - https://usn.ubuntu.com/3806-1/ - https://access.redhat.com/errata/RHSA-2018:3665 - http://www.securityfocus.com/bid/105745 - https://github.com/systemd/systemd/pull/10518 - https://access.redhat.com/errata/RHSA-2019:0049 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2018-15689 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15690 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15691 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-16T17:59:09.670Z Vendors: CA Technologies Products: Release Automation Problem Types: Deserialization of Untrusted Data Description: Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041591 - https://www.exploit-db.com/exploits/45425/ - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-03--security-notice-for-ca-release-automation.html - http://www.
content/recommended-reading/security-notices/ca20180829-03--security-notice-for-ca-release-automation.html - http://www.securityfocus.com/bid/105197
CVE ID: CVE-2018-15692 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T10:01:54.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain functions. Additional Analyst Notes: - CVE Program Container: References: - https://www.kpmg.de/noindex/advisories/KPMG-2018-002.txt
CVE ID: CVE-2018-15693 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T10:01:54.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object reference. Additional Analyst Notes: - CVE Program Container: References: - https://www.kpmg.de/noindex/advisories/KPMG-2018-001.txt
CVE ID: CVE-2018-15694 State: PUBLISHED Published: 2018-08-27T14:00:00Z Last Updated: 2024-09-16T17:48:48.116Z Vendors: Tenable Products: ASUSTOR Data Master Problem Types: Arbitrary File Upload Description: ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a path traversal vulnerability. This could lead to code execution if the "Web Server" feature is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-22
CVE ID: CVE-2018-15695 State: PUBLISHED Published: 2018-08-27T14:00:00Z Last Updated: 2024-09-16T16:33:03.370Z Vendors: Tenable Products: ASUSTOR Data Master Problem Types: Path Traversal Description: ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerability in wallpaper.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-22
CVE ID: CVE-2018-15696 State: PUBLISHED Published: 2018-08-27T14:00:00Z Last Updated: 2024-09-16T16:28:09.003Z Vendors: Tenable Products: ASUSTOR Data Master Problem Types: Insufficient Protections Description: ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-22
CVE ID: CVE-2018-15697 State: PUBLISHED Published: 2018-08-27T14:00:00Z Last Updated: 2024-09-16T20:36:51.437Z Vendors: Tenable Products: ASUSTOR Data Master Problem Types: Insufficient Protections Description: ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full path. For example, /home/admin/.ash_history. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-22
CVE ID: CVE-2018-15698 State: PUBLISHED Published: 2018-08-27T14:00:00Z Last Updated: 2024-09-17T01:45:38.855Z Vendors: Tenable Products: ASUSTOR Data Master Problem Types: Insufficient Protections Description: ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing the full path to loginimage.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-22
CVE ID: CVE-2018-15699 State: PUBLISHED Published: 2018-08-27T14:00:00Z Last Updated: 2024-09-17T00:05:39.085Z Vendors: Tenable Products: ASUSTOR Data Master Problem Types: Cross Site Scripting Description: ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle can take advantage of this by inserting Javascript into the configuration files Version field. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-22
CVE ID: CVE-2018-15700 State: PUBLISHED Published: 2018-10-01T20:00:00Z Last Updated: 2024-09-16T22:45:37.808Z Vendors: TP-Link Products: TP-Link TL-WRN841N Problem Types: Denial of Service Description: The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header containing an unexpected Referer field. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-27
CVE ID: CVE-2018-15701 State: PUBLISHED Published: 2018-10-01T20:00:00Z Last Updated: 2024-09-17T00:16:43.051Z Vendors: TP-Link Products: TP-Link TL-WRN841N Problem Types: Denial of Service Description: The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header containing an unexpected Cookie field. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-27
CVE ID: CVE-2018-15702 State: PUBLISHED Published: 2018-10-01T20:00:00Z Last Updated: 2024-09-16T16:27:37.902Z Vendors: TP-Link Products: TP-Link TL-WRN841N Problem Types: Cross-Site Requrest Forgery Description: The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-27
CVE ID: CVE-2018-15703 State: PUBLISHED Published: 2018-10-22T19:00:00Z Last Updated: 2024-09-16T19:57:33.496Z Vendors: Advantech Products: Advantech WebAccess Problem Types: Reflected Cross Site Scripting Description: Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim to supply malicious HTML or JavaScript code to WebAccess, which is then reflected back to the victim and executed by the web browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-33