Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-10124 State: PUBLISHED Published: 2018-04-16T13:00:00 Last Updated: 2024-08-05T07:32:01.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3696-1/ - https://news.ycombinator.com/item?id=2972021 - https://usn.ubuntu.com/3754-1/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ea77014af0d6205b05503d1c7aac6eace11d473 - https://lists.debi
el.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ea77014af0d6205b05503d1c7aac6eace11d473 - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://github.com/torvalds/linux/commit/4ea77014af0d6205b05503d1c7aac6eace11d473 - http://www.securitytracker.com/id/1040684 - https://usn.ubuntu.com/3696-2/
CVE ID: CVE-2018-10125 State: PUBLISHED Published: 2020-03-16T14:40:15 Last Updated: 2024-08-05T07:32:01.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao before 4.5.7 has XSS in the system log. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log.html
CVE ID: CVE-2018-10126 State: PUBLISHED Published: 2018-04-21T21:00:00 Last Updated: 2024-08-20T04:17:24.678828 Vendors: n/a Products: n/a Problem Types: n/a Description: ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2786 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://gitlab.com/libtiff/libtiff/-/issues/128
CVE ID: CVE-2018-10127 State: PUBLISHED Published: 2018-04-16T14:00:00Z Last Updated: 2024-09-17T01:42:02.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gosea/xyhcms/issues/1
CVE ID: CVE-2018-10128 State: PUBLISHED Published: 2018-04-16T14:00:00Z Last Updated: 2024-09-16T23:32:05.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gosea/xyhcms/issues/2
CVE ID: CVE-2018-10132 State: PUBLISHED Published: 2018-04-16T14:00:00Z Last Updated: 2024-09-16T18:56:06.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vQAQv/Request-CVE-ID-PoC/blob/master/PbootCMS/v0.9.8/CSRF.md
CVE ID: CVE-2018-10133 State: PUBLISHED Published: 2018-04-16T14:00:00Z Last Updated: 2024-09-17T01:20:29.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vQAQv/Request-CVE-ID-PoC/blob/master/PbootCMS/v0.9.8/Getshll.md
CVE ID: CVE-2018-10135 State: PUBLISHED Published: 2018-04-16T17:00:00Z Last Updated: 2024-09-17T03:38:53.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/vVN00qRh
CVE ID: CVE-2018-10136 State: PUBLISHED Published: 2018-04-16T17:00:00Z Last Updated: 2024-09-16T17:22:40.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settings&action=edit URI. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/TCEWRZEd
CVE ID: CVE-2018-10137 State: PUBLISHED Published: 2018-04-16T17:00:00Z Last Updated: 2024-09-16T22:21:05.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage_settings&action=edit URI. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/TCEWRZEd
CVE ID: CVE-2018-10138 State: PUBLISHED Published: 2018-04-16T19:00:00Z Last Updated: 2024-09-16T18:02:46.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2018040120
CVE ID: CVE-2018-10139 State: PUBLISHED Published: 2018-08-16T18:00:00Z Last Updated: 2024-09-17T01:25:36.726Z Vendors: Palo Alto Networks Products: PAN-OS Problem Types: Cross-site scripting Description: The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105111 - http://www.securitytracker.com/id/1041544 - https://security.paloaltonetworks.com/CVE-2018-10139
CVE ID: CVE-2018-10140 State: PUBLISHED Published: 2018-08-16T18:00:00Z Last Updated: 2024-09-16T18:39:24.873Z Vendors: Palo Alto Networks Products: PAN-OS Problem Types: Denial of Service Description: The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105107 - http://www.securitytracker.com/id/1041545 - https://security.paloaltonetworks.com/CVE-2018-10140
CVE ID: CVE-2018-10141 State: PUBLISHED Published: 2018-10-12T22:00:00Z Last Updated: 2024-09-16T16:12:42.274Z Vendors: Palo Alto Networks Products: Palo Alto Networks Problem Types: Cross-Site Scripting (XSS) Description: GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2018-10141
CVE ID: CVE-2018-10142 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T07:32:01.490Z Vendors: Palo Alto Networks Products: Palo Alto Networks Expedition Problem Types: Information Disclosure Description: The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106069 - https://security.paloaltonetworks.com/CVE-2018-10142
CVE ID: CVE-2018-10143 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:32:01.467Z Vendors: Palo Alto Networks Products: Palo Alto Networks Expedition Problem Types: Remote Code Execution Description: The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting this service/application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106174 - https://doddsecurity.com/234/command-injection-on-palo-alto-networks-expedition/ - https://security.paloaltonetworks.com/CVE-2018-10143
CVE ID: CVE-2018-10144 State: REJECTED Published: 2019-01-17T15:00:00 Last Updated: 2019-01-17T14:57:01 Description: No description available.
CVE ID: CVE-2018-10145 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10146 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10147 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10148 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10149 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10150 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10151 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10152 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10153 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10154 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10155 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10156 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10157 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10158 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10159 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10160 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10161 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10162 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10163 State: REJECTED Published: 2018-12-06T14:00:00 Last Updated: 2018-12-06T13:57:01 Description: No description available.
CVE ID: CVE-2018-10164 State: PUBLISHED Published: 2018-05-03T18:00:00 Last Updated: 2024-08-05T07:32:01.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the implementation of portalPictureUpload functionality. This is fixed in version 2.6.1_Windows. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104094 - https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
CVE ID: CVE-2018-10165 State: PUBLISHED Published: 2018-05-03T18:00:00 Last Updated: 2024-08-05T07:32:01.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version 2.6.1_Windows. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104094 - https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
CVE ID: CVE-2018-10166 State: PUBLISHED Published: 2018-05-03T18:00:00 Last Updated: 2024-08-05T07:32:01.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain. This is fixed in version 2.6.1_Windows. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104094 - https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
CVE ID: CVE-2018-10167 State: PUBLISHED Published: 2018-05-03T18:00:00 Last Updated: 2024-08-05T07:32:01.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key and the algorithm can decrypt it. A low-privilege user could decrypt and modify the backup file in order to elevate their privileges. This is fixed in version 2.6.1_Windows. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104094 - https://www.coresecurity.com/advisories/tp-link-eap
m Container: References: - http://www.securityfocus.com/bid/104094 - https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
CVE ID: CVE-2018-10168 State: PUBLISHED Published: 2018-05-03T18:00:00 Last Updated: 2024-08-05T07:32:01.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104094 - https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
CVE ID: CVE-2018-10169 State: PUBLISHED Published: 2018-04-16T21:00:00Z Last Updated: 2024-09-16T18:19:08.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "ProtonVPN Service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a class instance argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection. This plugin will execute code in the context of the S
namic library plugin that should run for every new VPN connection. This plugin will execute code in the context of the SYSTEM user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2018-017.md
CVE ID: CVE-2018-10170 State: PUBLISHED Published: 2018-04-16T21:00:00Z Last Updated: 2024-09-17T00:26:03.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "Connect" method accepts a class instance argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context o
amic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2018-018.md
CVE ID: CVE-2018-10171 State: PUBLISHED Published: 2019-06-05T21:52:43 Last Updated: 2024-08-05T07:32:01.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its `com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper` component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to connect and execute shell scripts as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://versprite.com/advisories/mackeeper/
CVE ID: CVE-2018-10172 State: PUBLISHED Published: 2018-04-16T22:00:00 Last Updated: 2024-08-05T07:32:01.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: 7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemoryPrivilege privilege to the user's account, which makes it easier for attackers to bypass intended access restrictions by using this privilege in the context of a sandboxed process. Note: This has been disputed by 3rd parties who argue this is a valid feature of Windows. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/sevenzip/discussion/45797/th
Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/sevenzip/discussion/45797/thread/e730c709/?limit=25&page=1#b240
CVE ID: CVE-2018-10173 State: PUBLISHED Published: 2018-04-20T21:00:00 Last Updated: 2024-08-05T07:32:01.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147244/Digital-Guardian-Management-Console-7.1.2.0015-Shell-Upload.html
CVE ID: CVE-2018-10174 State: PUBLISHED Published: 2018-04-20T21:00:00 Last Updated: 2024-08-05T07:32:01.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files via file:// URLs, send TCP traffic to intranet hosts, or obtain an NTLM hash. This can occur even if the logged-in user has a read-only role. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147260/Digital-Guardian-Management-Console-7.1.2.0015-Server-Side-Request-Forgery.html
CVE ID: CVE-2018-10175 State: PUBLISHED Published: 2018-04-20T21:00:00 Last Updated: 2024-08-05T07:32:01.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Digital Guardian Management Console 7.1.2.0015 has an XXE issue. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147261/Digital-Guardian-Management-Console-7.1.2.0015-XXE-Injection.html
CVE ID: CVE-2018-10176 State: PUBLISHED Published: 2018-04-20T21:00:00 Last Updated: 2024-08-05T07:32:01.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Digital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147242/Digital-Guardian-Management-Console-7.1.2.0015-Arbitrary-File-Read.html
CVE ID: CVE-2018-10177 State: PUBLISHED Published: 2018-04-16T23:00:00 Last Updated: 2024-08-05T07:32:01.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/1095 - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2018-10178 State: PUBLISHED Published: 2018-04-17T03:00:00 Last Updated: 2024-08-05T07:32:01.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FromDocToPDF extension before 13.611.13.2303 for Chrome allows remote attackers to discover visited web sites via vectors involving a mostVisitedSites command. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1557
CVE ID: CVE-2018-10183 State: PUBLISHED Published: 2018-04-17T14:00:00 Last Updated: 2024-08-05T07:32:01.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib/less.php/test/index.php because of a $_SERVER['REQUEST_URI'] echo, as demonstrated by the dir parameter in a file=charsets action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/333
CVE ID: CVE-2018-10184 State: PUBLISHED Published: 2018-05-09T07:00:00 Last Updated: 2024-08-05T07:32:01.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffer
ay overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain. Additional Analyst Notes: - CVE Program Container: References: - http://git.haproxy.org/?p=haproxy-1.8.git%3Ba=commit%3Bh=cd117685f0cff4f2f5577ef6a21eaae96ebd9f28 - https://access.redhat.com/errata/RHSA-2018:1372 - http://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=3f0e1ec70173593f4c2b3681b26c04a4ed5fc588
CVE ID: CVE-2018-10185 State: PUBLISHED Published: 2018-04-17T19:00:00Z Last Updated: 2024-09-17T00:50:28.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yeyinshi/tuzicms/issues/1
CVE ID: CVE-2018-10186 State: PUBLISHED Published: 2018-04-17T20:00:00 Last Updated: 2024-08-05T07:32:01.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/hex.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. This issue is different from CVE-2017-15368. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/9915