Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-20199 State: PUBLISHED Published: 2018-12-18T01:00:00 Last Updated: 2024-08-05T11:58:18.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faad2/issues/24 - https://lists.debian.org/debian-lts-announce/2019/08/msg00033.html - https://security.gentoo.org/glsa/202006-
ssues/24 - https://lists.debian.org/debian-lts-announce/2019/08/msg00033.html - https://security.gentoo.org/glsa/202006-17 - https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html - https://www.debian.org/security/2022/dsa-5109
CVE ID: CVE-2018-20200 State: PUBLISHED Published: 2019-04-18T18:31:52 Last Updated: 2024-08-05T11:58:19.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967 Additional Analyst Notes: - CVE Program Container: References: - https://square.github.io/okhttp/3.x/okhttp/ - https://github.com/square/okhttp/releases - https://github.com
ferences: - https://square.github.io/okhttp/3.x/okhttp/ - https://github.com/square/okhttp/releases - https://github.com/square/okhttp/commits/master - https://cxsecurity.com/issue/WLB-2018120252 - https://github.com/square/okhttp/issues/4967 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1
798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a%40%3Cuser.flink.apache.org%3E - https://lists.apache.org/thread.html/r71100f23778d72fbd8be8baa6baffc159b9c4f3fae3db4826bdc8ab8%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/rc436d58531754ac8fe20340044566518ea4dce66aeff9193356a225d%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/recce57e195fbdd856dcf1933c136a8a66d7b02e05e3580f44d75a640%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/rfd1eed12ba2a5dff37229edd60fc84a25517815d848994146a15af91%40%3Cissues.flink.apache.org%3E - https://lists.
g/thread.html/rfd1eed12ba2a5dff37229edd60fc84a25517815d848994146a15af91%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r78bfce980843be61a55615a7680bbf7ac751a9b3515231eab2d32068%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2018-20201 State: PUBLISHED Published: 2018-12-18T09:00:00Z Last Updated: 2024-09-16T20:58:24.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/issues/1587
CVE ID: CVE-2018-20211 State: PUBLISHED Published: 2019-01-02T18:00:00 Last Updated: 2024-08-05T11:58:18.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws32_32.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 (9.x was released starting in 2012, and 10.x was released starting in 2015). Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Dec/44 - http://packetstormsecurity.com/files/150892/Exiftool-8.3.2.0-DLL-
es: - http://seclists.org/fulldisclosure/2018/Dec/44 - http://packetstormsecurity.com/files/150892/Exiftool-8.3.2.0-DLL-Hijacking.html
CVE ID: CVE-2018-20212 State: PUBLISHED Published: 2019-03-17T20:30:20 Last Updated: 2024-08-05T11:58:18.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151028/TWiki-6.0.2-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2019/Jan/7 - http://twiki.org/cgi-bin/view/Codev/DownloadTWiki
CVE ID: CVE-2018-20213 State: PUBLISHED Published: 2018-12-18T19:00:00Z Last Updated: 2024-09-16T21:07:46.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long name. NOTE: this is not a Microsoft product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/devinsmith/libexcel/issues/8
CVE ID: CVE-2018-20216 State: PUBLISHED Published: 2018-12-20T21:00:00 Last Updated: 2024-08-05T11:58:19.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled). Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/12/19/2 - https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg03052.html - http://www.securityfocus.com/bid/106291 - https://usn.ubuntu.com/3923-1/
CVE ID: CVE-2018-20217 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T11:58:19.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KNHELH4YHNT6H2ESJWX2UIDXLBNGB2O/ - http://krbdev.mit.edu/rt/Ticket/Display.html?id=8763 - https://githu
ect.org/message/2KNHELH4YHNT6H2ESJWX2UIDXLBNGB2O/ - http://krbdev.mit.edu/rt/Ticket/Display.html?id=8763 - https://github.com/krb5/krb5/commit/5e6d1796106df8ba6bc1973ee0917c170d929086 - https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html - https://security.netapp.com/advisory/ntap-20190416-0006/ - https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html
CVE ID: CVE-2018-20218 State: PUBLISHED Published: 2019-03-17T20:41:55 Last Updated: 2024-08-05T11:58:19.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the "password" parameter in the login form. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Feb/48 - https://zxsecurity.co.nz/research.html
CVE ID: CVE-2018-20219 State: PUBLISHED Published: 2019-03-17T20:47:53 Last Updated: 2024-08-05T11:58:18.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication cookie to the end user such that they can access the devices web administration panel. This token is hard-coded to a string in the source code (/usr/share/www/check.lp file). By setting this cookie in a browser, an attacker is able to maintain access to every ENC-400 device without knowing the password, which results in authentication bypass. Even if a user changes the password o
C-400 device without knowing the password, which results in authentication bypass. Even if a user changes the password on the device, this token is static and unchanged. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151802/Teracue-ENC-400-Command-Injection-Missing-Authentication.html - http://seclists.org/fulldisclosure/2019/Feb/48 - https://zxsecurity.co.nz/research.html
CVE ID: CVE-2018-20220 State: PUBLISHED Published: 2019-03-17T20:51:20 Last Updated: 2024-08-05T11:58:18.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated, and some of these pages may disclose sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151802/Teracue-ENC-400-Command-Injection-Missing-Authentication.html - h
erences: - http://packetstormsecurity.com/files/151802/Teracue-ENC-400-Command-Injection-Missing-Authentication.html - http://seclists.org/fulldisclosure/2019/Feb/48 - https://zxsecurity.co.nz/research.html
CVE ID: CVE-2018-20221 State: PUBLISHED Published: 2019-03-17T20:54:40 Last Updated: 2024-08-05T11:58:18.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151035/Ajera-Timesheets-9.10.16-Deserialization.html - https://www.exploit-db.com/exploits/46086/
CVE ID: CVE-2018-20222 State: PUBLISHED Published: 2019-04-04T15:48:24 Last Updated: 2024-08-05T11:58:18.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXE issue in Airsonic before 10.1.2 during parse. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/airsonic/airsonic/blob/master/CHANGELOG.md - https://github.com/airsonic/airsonic/releases/tag/v10.2.1
CVE ID: CVE-2018-20225 State: PUBLISHED Published: 2020-05-08T17:29:12 Last Updated: 2024-08-05T11:58:18.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-
er). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely Additional Analyst Notes: - CVE Program Container: References: - https://pip.pypa.io/en/stable/news/ - https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html - https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arrow.apache.org%3E - https://bugzilla.redhat.com/show_bug.cgi?id=1835736
CVE ID: CVE-2018-20226 State: PUBLISHED Published: 2018-12-21T22:00:00 Last Updated: 2024-08-05T11:58:18.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TheHive-Project/Cortex/commit/1aaf2182a6b722ad539e2717bc11967d1bde723a - https://github.com/TheHive-Project/Cortex/issues/158 - https://github.com/TheHive-Project/Cortex/blob/2.1.3/CHANGELOG.md
CVE ID: CVE-2018-20227 State: PUBLISHED Published: 2018-12-19T11:00:00 Last Updated: 2024-08-05T11:58:19.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/rdf4j/pull/1211/commits/df15a4d7a8f2789c043b27c9eafe1b30316cfa79 - https://github.com/eclipse/rdf4j/issues/1210
CVE ID: CVE-2018-20228 State: PUBLISHED Published: 2018-12-19T11:00:00 Last Updated: 2024-08-05T11:58:18.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2175
CVE ID: CVE-2018-20229 State: PUBLISHED Published: 2019-04-04T16:54:07 Last Updated: 2024-08-05T11:58:18.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/ - https://about.gitlab.com/blog/categories/releases/
CVE ID: CVE-2018-20230 State: PUBLISHED Published: 2018-12-19T11:00:00Z Last Updated: 2024-09-16T22:45:37.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1660318
CVE ID: CVE-2018-20231 State: PUBLISHED Published: 2018-12-19T11:00:00 Last Updated: 2024-08-05T11:58:18.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.privacy-wise.com/two-factor-authentication-cross-site-request-forgery-csrf-vulnerability-cve-2018-20231/ - https://wpvulndb.com/vulnerabilities/9187 - https://wordpress.org/plugins/two-factor-authentication/#developers
CVE ID: CVE-2018-20232 State: PUBLISHED Published: 2019-02-13T18:00:00Z Last Updated: 2024-09-16T23:25:54.494Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-68614 - http://www.securityfocus.com/bid
VE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-68614 - http://www.securityfocus.com/bid/107023
CVE ID: CVE-2018-20233 State: PUBLISHED Published: 2019-01-18T21:00:00Z Last Updated: 2024-09-16T22:09:10.800Z Vendors: Atlassian Products: Universal Plugin Manager Problem Types: Improper Restriction of XML External Entity Reference ('XXE') Description: The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106661 - htt
aded JAR. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106661 - https://ecosystem.atlassian.net/browse/UPM-5964
CVE ID: CVE-2018-20234 State: PUBLISHED Published: 2019-03-08T18:00:00Z Last Updated: 2024-09-16T23:30:34.058Z Vendors: Atlassian Products: Sourcetree for macOS Problem Types: Argument Injection Description: There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/SRCTREE-6391 - http://www.securityfocus.com/bid/107414 - https://
ainer: References: - https://jira.atlassian.com/browse/SRCTREE-6391 - http://www.securityfocus.com/bid/107414 - https://seclists.org/bugtraq/2019/Mar/30 - http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html
CVE ID: CVE-2018-20235 State: PUBLISHED Published: 2019-03-08T18:00:00Z Last Updated: 2024-09-16T23:56:51.778Z Vendors: Atlassian Products: Sourcetree for Windows Problem Types: Argument Injection Description: There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/SRCTREEWIN-11289 - http://www.securityfocus.com/bid/10740
ram Container: References: - https://jira.atlassian.com/browse/SRCTREEWIN-11289 - http://www.securityfocus.com/bid/107407 - https://seclists.org/bugtraq/2019/Mar/30 - http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html
CVE ID: CVE-2018-20236 State: PUBLISHED Published: 2019-03-08T18:00:00Z Last Updated: 2024-09-16T19:10:38.203Z Vendors: Atlassian Products: Sourcetree for Windows Problem Types: Command Injection Description: There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107401 - https://jira.atlassian.com/browse/SRCTREEWIN-11291 - https://seclists.org/bugtraq/2019/Mar/30 - http://packet
d/107401 - https://jira.atlassian.com/browse/SRCTREEWIN-11291 - https://seclists.org/bugtraq/2019/Mar/30 - http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html
CVE ID: CVE-2018-20237 State: PUBLISHED Published: 2019-02-13T18:00:00Z Last Updated: 2024-09-16T21:02:16.888Z Vendors: Atlassian Products: Confluence Server, Confluence Data Center Problem Types: Indirect Object Reference Description: Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-57814 - http://www.securityfocus.com/bid/107041 - https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20237/
CVE ID: CVE-2018-20238 State: PUBLISHED Published: 2019-02-13T18:00:00Z Last Updated: 2024-09-16T20:41:48.136Z Vendors: Atlassian Products: Crowd Problem Types: Insufficient Session Expiration Description: Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5361 - http://www.securityfocus.com/bid/107036
CVE ID: CVE-2018-20239 State: PUBLISHED Published: 2019-04-30T15:28:27.775475Z Last Updated: 2024-09-16T20:01:43.685Z Vendors: Atlassian Products: Atlassian Application Links Problem Types: Cross Site Scripting (XSS) Description: Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before
plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://ecosystem.atlassian.net/browse/APL-1373 - https://jira.atlassian.com/browse/CRUC-8379 - https://jira.atlassian.com/browse/FE-7161 - https://jira.atlassian.com/browse/CONFSERVER-58208 - https://jira.atlassian.com/browse/CWD-5362 - https://jira.atlassian.com/browse/JRASERVER-68855
CVE ID: CVE-2018-20240 State: PUBLISHED Published: 2019-02-20T15:00:00Z Last Updated: 2024-09-17T00:15:39.095Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7163 - http://www.securityfocus.com/bid/107128 - https://jira.atlassian.com/browse/CRUC-8381
CVE ID: CVE-2018-20241 State: PUBLISHED Published: 2019-02-20T15:00:00Z Last Updated: 2024-09-17T00:31:10.796Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107128 - https://jira.atlassian.com/browse/CRUC-8380 - https://jira.atlassian.com/browse/FE-7162
CVE ID: CVE-2018-20242 State: PUBLISHED Published: 2019-02-11T21:00:00Z Last Updated: 2024-09-17T01:47:05.525Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: n/a Description: A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106804 - https://lists.apache.org/thread.html/8ee4644432c0a433c5c514a57d940cf6dcb0a0094acd97b36290f0b4%40%3Cuser.jspwiki.apache.org%3E - https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1%40%3Ccommits.jspwiki.a