Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
12 - https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc - https://security.netapp.com/advisory/ntap-20180626-0001/ - http://www.securityfocus.com/archive/1/541824/100/0/threaded - http://support.ntp.org/bin/view/Main/NtpBug3412 - https://usn.ubuntu.com/3707-1/ - https://www.exploit-db.com/exploits/45846/ - https://www.synology.com/support/security/Synology_SA_18_13 - http://www.securityfocus.com/bid/103191 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
CVE ID: CVE-2018-7183 State: PUBLISHED Published: 2018-03-08T20:00:00 Last Updated: 2024-08-05T06:24:11.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201805-12 - https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc - https://usn.ubuntu.com/3707-2/ - https://usn.ubuntu.com/3707-1/ - http://www.securityfocus.com/bid/103351 - https://www.oracle.com//security-alerts/cp
- https://usn.ubuntu.com/3707-1/ - http://www.securityfocus.com/bid/103351 - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20180626-0001/ - http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S - https://www.synology.com/support/security/Synology_SA_18_13 - http://support.ntp.org/bin/view/Main/NtpBug3414 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
CVE ID: CVE-2018-7184 State: PUBLISHED Published: 2018-03-06T20:00:00 Last Updated: 2024-08-05T06:24:11.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.h
E Program Container: References: - http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html - http://www.securityfocus.com/bid/103192 - https://security.gentoo.org/glsa/201805-12 - https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc - https://security.netapp.com/advisory/ntap-20180626-0001/ - http://www.securityfocus.com/archive/1/541824/100/0/threaded - http://support.ntp.org/bin/view/Main/NtpBug3453 - https://usn.ubuntu.com/3707-1/ - https://www.synology.com/support/security/Synology_SA_18_13 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
CVE ID: CVE-2018-7185 State: PUBLISHED Published: 2018-03-06T20:00:00 Last Updated: 2024-08-05T06:24:11.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html - https://security.gentoo.org/glsa/201805-12 - https://security.FreeBSD.org/ad
ckware-Security-Advisory-ntp-Updates.html - https://security.gentoo.org/glsa/201805-12 - https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc - https://usn.ubuntu.com/3707-2/ - https://security.netapp.com/advisory/ntap-20180626-0001/ - http://www.securityfocus.com/bid/103339 - http://www.securityfocus.com/archive/1/541824/100/0/threaded - http://support.ntp.org/bin/view/Main/NtpBug3454 - https://usn.ubuntu.com/3707-1/ - https://www.synology.com/support/security/Synology_SA_18_13 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
CVE ID: CVE-2018-7186 State: PUBLISHED Published: 2018-02-16T00:00:00 Last Updated: 2024-08-05T06:24:11.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00005.html - https://github.com/DanBloomberg/leptonica/commit/ee301cb2029db8a6289c5295daa4
ebian-lts-announce/2018/03/msg00005.html - https://github.com/DanBloomberg/leptonica/commit/ee301cb2029db8a6289c5295daa42bba7715e99a - https://bugs.debian.org/890548 - https://lists.debian.org/debian-lts/2018/02/msg00054.html - https://security.gentoo.org/glsa/202312-01
CVE ID: CVE-2018-7187 State: PUBLISHED Published: 2018-02-16T17:00:00 Last Updated: 2024-08-05T06:24:10.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/02/msg00029.html - https://www.debian.org/security/2019/dsa-4380 - https://security.gentoo.org/glsa/201804-12 - https://www.debian.org/security/2019
ww.debian.org/security/2019/dsa-4380 - https://security.gentoo.org/glsa/201804-12 - https://www.debian.org/security/2019/dsa-4379 - https://github.com/golang/go/issues/23867 - https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc
CVE ID: CVE-2018-7188 State: PUBLISHED Published: 2018-02-16T18:00:00Z Last Updated: 2024-09-16T19:56:07.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/tikiwiki/code/65327 - http://openwall.com/lists/oss-security/2018/02/16/1
CVE ID: CVE-2018-7191 State: PUBLISHED Published: 2019-05-17T04:27:00 Last Updated: 2024-08-05T06:24:10.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1743792 - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1748846 - https://github.com/torvalds/l
source/linux/+bug/1743792 - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1748846 - https://github.com/torvalds/linux/commit/0ad646c81b2182f7fa67ec0c8c825e0ee165696d - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0ad646c81b2182f7fa67ec0c8c825e0ee165696d - https://github.com/torvalds/linux/commit/5c25f65fd1e42685f7ccd80e0621829c105785d9 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5c25f65fd1e42685f7ccd80e0621829c105785d9 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.14 - http://www.securityfocus.com/bid/108380 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html - http://lists.opensuse
ocus.com/bid/108380 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
CVE ID: CVE-2018-7192 State: PUBLISHED Published: 2018-03-27T17:00:00 Last Updated: 2024-08-05T06:24:10.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c
CVE ID: CVE-2018-7193 State: PUBLISHED Published: 2018-03-27T17:00:00 Last Updated: 2024-08-05T06:24:10.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c
CVE ID: CVE-2018-7194 State: PUBLISHED Published: 2018-03-27T17:00:00 Last Updated: 2024-08-05T06:24:11.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c
CVE ID: CVE-2018-7195 State: PUBLISHED Published: 2018-03-27T17:00:00 Last Updated: 2024-08-05T06:24:11.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c
CVE ID: CVE-2018-7196 State: PUBLISHED Published: 2018-03-27T17:00:00 Last Updated: 2024-08-05T06:24:11.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c
CVE ID: CVE-2018-7197 State: PUBLISHED Published: 2018-02-18T03:00:00 Last Updated: 2024-08-05T06:24:11.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/47
CVE ID: CVE-2018-7198 State: PUBLISHED Published: 2018-02-18T03:00:00 Last Updated: 2024-08-05T06:24:11.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44144/ - http://securitywarrior9.blogspot.com/2018/02/html-injection-october-cms.html
CVE ID: CVE-2018-7201 State: PUBLISHED Published: 2019-05-22T20:03:12 Last Updated: 2024-08-05T06:24:11.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel. Additional Analyst Notes: - CVE Program Container: References: - https://www.projectsend.org/change-log-detail/r1053/
CVE ID: CVE-2018-7202 State: PUBLISHED Published: 2019-05-22T17:31:50 Last Updated: 2024-08-05T06:24:11.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page. Additional Analyst Notes: - CVE Program Container: References: - https://www.projectsend.org/change-log-detail/r1053/
CVE ID: CVE-2018-7203 State: PUBLISHED Published: 2018-03-30T21:00:00 Last Updated: 2024-08-05T06:24:11.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/set_all. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/146939/TwonkyMedia-Server-7.0.11-8.5-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/44351/
CVE ID: CVE-2018-7204 State: PUBLISHED Published: 2018-03-07T20:00:00 Last Updated: 2024-08-05T06:24:11.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/file-manager/#de
d sites. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/file-manager/#developers - https://wpvulndb.com/vulnerabilities/9036 - https://plugins.trac.wordpress.org/changeset/1823035/file-manager
CVE ID: CVE-2018-7205 State: PUBLISHED Published: 2018-02-20T15:00:00 Last Updated: 2024-08-05T06:24:11.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages -> Edit template properties -> Device Layouts -> Create device layout (and edit created device layout) -> Design" screens. NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout Additional Analyst Notes: - CVE Program Conta
ded functionality for authorized users to edit and update ascx code layout Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/541792/100/0/threaded
CVE ID: CVE-2018-7206 State: PUBLISHED Published: 2018-02-18T03:00:00 Last Updated: 2024-08-05T06:24:11.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authentica
inked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyterhub/oauthenticator/blob/8499dc2/CHANGELOG.md#073---2018-02-16 - https://github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2 - https://blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76
CVE ID: CVE-2018-7207 State: REJECTED Published: 2018-02-18T04:00:00 Last Updated: 2018-02-20T14:57:01 Description: No description available.
CVE ID: CVE-2018-7208 State: PUBLISHED Published: 2018-02-18T04:00:00 Last Updated: 2024-08-05T06:24:11.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22741 - https://access.redhat.com/errata/RHSA-2018:3032 - htt
erences: - https://sourceware.org/bugzilla/show_bug.cgi?id=22741 - https://access.redhat.com/errata/RHSA-2018:3032 - https://security.gentoo.org/glsa/201811-17 - http://www.securityfocus.com/bid/103077 - https://access.redhat.com/errata/RHBA-2019:0327 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
CVE ID: CVE-2018-7209 State: PUBLISHED Published: 2018-02-18T04:00:00Z Last Updated: 2024-09-16T16:38:47.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idashboards/config.xml URI, as demonstrated by intranet URLs for reports. Additional Analyst Notes: - CVE Program Container: References: - https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/
CVE ID: CVE-2018-7210 State: PUBLISHED Published: 2018-02-18T04:00:00Z Last Updated: 2024-09-17T00:30:28.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idb/config?CMD=installLicense URI, as demonstrated by intranet IP addresses and names of guest accounts. Additional Analyst Notes: - CVE Program Container: References: - https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/
CVE ID: CVE-2018-7211 State: PUBLISHED Published: 2018-02-18T04:00:00Z Last Updated: 2024-09-17T00:51:43.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials. Additional Analyst Notes: - CVE Program Container: References: - https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/
CVE ID: CVE-2018-7212 State: PUBLISHED Published: 2018-02-18T06:00:00 Last Updated: 2024-08-05T06:24:11.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c - https://github.com/sinatra/sinatra/pull/1379
CVE ID: CVE-2018-7213 State: PUBLISHED Published: 2018-03-11T05:00:00 Last Updated: 2024-08-05T06:24:11.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Password Manager Extension in Abine Blur 7.8.242* before 7.8.2428 allows attackers to bypass the Multi-Factor Authentication and macOS disk-encryption protection mechanisms, and consequently exfiltrate secured data, because the right-click context menu is not secured. Additional Analyst Notes: - CVE Program Container: References: - https://addons.mozilla.org/en-US/firefox/addon/donottrackplus/versions/?page=1#version-7.8.2428 - https://redcoded.com/2018/CVE/ - http://seclists.org/fulldisclosure/2019/Mar/33 - http://packets
ge=1#version-7.8.2428 - https://redcoded.com/2018/CVE/ - http://seclists.org/fulldisclosure/2019/Mar/33 - http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html
CVE ID: CVE-2018-7216 State: PUBLISHED Published: 2018-02-18T06:00:00 Last Updated: 2024-08-05T06:24:11.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal allows remote authenticated users to hijack the authentication of application users for requests that modify their personal data by leveraging lack of anti-CSRF tokens. Additional Analyst Notes: - CVE Program Container: References: - https://www.securityfocus.com/archive/1/541782/30/0/threaded - https://www.exploit-db.com/exploits/44256/ - http://seclists.org/fulldisclosure/2018/Feb/44 - https://packetstormsecu
- https://www.exploit-db.com/exploits/44256/ - http://seclists.org/fulldisclosure/2018/Feb/44 - https://packetstormsecurity.com/files/146409/Tejari-Cross-Site-Request-Forgery.html
CVE ID: CVE-2018-7217 State: PUBLISHED Published: 2018-02-18T06:00:00 Last Updated: 2024-08-05T06:24:11.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bravo Tejari Procurement Portal, uploaded files are not properly validated by the application either on the client or the server side. An attacker can take advantage of this vulnerability and upload malicious executable files to compromise the application, as demonstrated by an esop/evm/OPPreliminaryForms.do?formId=857 request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2018/Feb/38 - https://packetstormsecurity.com/files/146425/Tejari-Arbitrary-File-Upload.html
CVE ID: CVE-2018-7218 State: PUBLISHED Published: 2018-05-17T19:00:00 Last Updated: 2024-08-05T06:24:11.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AppFirewall functionality in Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5 before Build 68.7, 11.0 before Build 71.24, 11.1 before Build 58.13, and 12.0 before Build 57.24 allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX234869 - http://www.securitytracker.com/id/1040921
CVE ID: CVE-2018-7219 State: PUBLISHED Published: 2018-02-19T14:00:00 Last Updated: 2024-08-05T06:24:11.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request. Additional Analyst Notes: - CVE Program Container: References: - http://foreversong.cn/archives/1081
CVE ID: CVE-2018-7225 State: PUBLISHED Published: 2018-02-19T15:00:00 Last Updated: 2024-08-05T06:24:11.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4221 - https://usn.ubuntu.com/3618-1/ - https://github.com/LibVNC/libvncserver/issues/218 - https://lists.debian.org/debian