Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-20178 State: PUBLISHED Published: 2023-02-21T17:31:04.561Z Last Updated: 2024-08-05T21:45:26.020Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Codiad Problem Types: CWE-200 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.8.1 is able to address this is
attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.8.1 is able to address this issue. The patch is identified as 517119de673e62547ee472a730be0604f44342b5. It is recommended to upgrade the affected component. VDB-221498 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221498 - https://vuldb.com/?ctiid.221498 - https://github.com/Codiad/Codiad/pull/974 - https://github.com/Codiad/Codiad/commit/517119de673e62547ee472a730be0604f44342b5 - https://github.com/Codiad/Codiad/release
ps://github.com/Codiad/Codiad/commit/517119de673e62547ee472a730be0604f44342b5 - https://github.com/Codiad/Codiad/releases/tag/v.2.8.1
CVE ID: CVE-2017-20179 State: PUBLISHED Published: 2023-02-21T20:31:03.420Z Last Updated: 2024-08-05T21:45:25.998Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: InSTEDD Products: Pollit Problem Types: Privilege Escalation Description: A vulnerability was found in InSTEDD Pollit 2.3.1. It has been rated as critical. This issue affects the function TourController of the file app/controllers/tour_controller.rb. The manipulation leads to an unknown weakness. The attack may be initiated remotely. Upgrading to version 2.3.2 is able to address this issue. The patch is named 6ef04f8b5972d5f16f8b86f8b53f62fac68d5498. It is recommended to upgrade the affected component. The associated i
is named 6ef04f8b5972d5f16f8b86f8b53f62fac68d5498. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221507. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.221507 - https://vuldb.com/?ctiid.221507 - https://github.com/instedd/pollit/commit/6ef04f8b5972d5f16f8b86f8b53f62fac68d5498 - https://github.com/instedd/pollit/releases/tag/2.3.2
CVE ID: CVE-2017-20180 State: PUBLISHED Published: 2023-03-06T10:31:04.599Z Last Updated: 2024-08-05T21:45:25.995Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Zerocoin Products: libzerocoin Problem Types: CWE-345 Description: A vulnerability classified as critical has been found in Zerocoin libzerocoin. Affected is the function CoinSpend::CoinSpend of the file CoinSpend.cpp of the component Proof Handler. The manipulation leads to insufficient verification of data authenticity. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as ce103a0
roduct. Therefore, no version details of affected nor updated releases are available. The patch is identified as ce103a09ec079d0a0ed95475992348bed6e860de. It is recommended to apply a patch to fix this issue. VDB-222318 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222318 - https://vuldb.com/?ctiid.222318 - https://github.com/Zerocoin/libzerocoin/pull/16 - https://github.com/Zerocoin/libzerocoin/commit/ce103a09ec079d0a0ed95475992348bed6e860de
CVE ID: CVE-2017-20181 State: PUBLISHED Published: 2023-03-06T23:31:04.228Z Last Updated: 2025-03-05T19:39:46.551Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: hgzojer Products: Vocable Trainer Problem Types: CWE-22 Description: A vulnerability classified as critical was found in hgzojer Vocable Trainer up to 1.3.0 on Android. This vulnerability affects unknown code of the file src/at/hgz/vocabletrainer/VocableTrainerProvider.java. The manipulation leads to path traversal. Attacking locally is a requirement. Upgrading to version 1.3.1 is able to address this issue. The name of the patch is accf6838078f8eb105cfc7865aba5c705fb68426. It is recommended to upg
able to address this issue. The name of the patch is accf6838078f8eb105cfc7865aba5c705fb68426. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222328. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222328 - https://vuldb.com/?ctiid.222328 - https://github.com/hgzojer/vocabletrainer/commit/accf6838078f8eb105cfc7865aba5c705fb68426 - https://github.com/hgzojer/vocabletrainer/releases/tag/v1.3.1
CVE ID: CVE-2017-20182 State: PUBLISHED Published: 2023-03-10T02:00:05.899Z Last Updated: 2024-11-22T21:52:20.108Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Mobile Vikings Products: Django AJAX Utilities Problem Types: CWE-79 Description: A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file django_ajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The patch is named 329eb1dd1580ca1f9d4f95bc69939833226515c9. It is recommended to apply
ttack may be initiated remotely. The patch is named 329eb1dd1580ca1f9d4f95bc69939833226515c9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222611. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222611 - https://vuldb.com/?ctiid.222611 - https://github.com/mvpoland/django-ajax-utilities/commit/329eb1dd1580ca1f9d4f95bc69939833226515c9
CVE ID: CVE-2017-20183 State: PUBLISHED Published: 2023-05-05T01:00:04.890Z Last Updated: 2024-08-05T21:45:26.255Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: External Media without Import Plugin Problem Types: CWE-79 Description: A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of the argument url/error/width/height/mime-type leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The patch
ite scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The patch is identified as 9d2ecd159a6e2e3f710b4f1c28e2714f66502746. It is recommended to upgrade the affected component. VDB-227950 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227950 - https://vuldb.com/?ctiid.227950 - https://github.com/zzxiang/external-media-without-import/commit/9d2ecd159a6e2e3f710b4f1c28e2714f66502746 - https://github.com/zzxiang/external-media-without-import/releases/tag/v1.0.1
CVE ID: CVE-2017-20184 State: PUBLISHED Published: 2023-05-04T09:17:54.302Z Last Updated: 2025-01-31T17:10:06.660Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Carlo Gavazzi Products: Powersoft Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Carlo Gavazzi Powersoft up to version 2.1.1.1 allows an unauthenticated, remote attacker to download any file from the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/42705
CVE ID: CVE-2017-20185 State: PUBLISHED Published: 2023-06-06T02:00:05.164Z Last Updated: 2024-08-05T21:45:26.235Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Fuzzy Products: SWMP Problem Types: CWE-79 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Fuzzy SWMP. It has been rated as problematic. This issue affects some unknown processing of the file swmp.php of the component GET Parameter Handler. The manipulation of the argument theme leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. There
to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 792bcab637cb8c3bd251d8fc8771512c5329a93e. It is recommended to apply a patch to fix this issue. The identifier VDB-230669 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230669 - https://vuldb.com/?ctiid.230669 - https://github.com/fuzzymannerz/swmp/pull/12 - https://github.com/fuzzymannerz/swmp/commit/
://vuldb.com/?ctiid.230669 - https://github.com/fuzzymannerz/swmp/pull/12 - https://github.com/fuzzymannerz/swmp/commit/792bcab637cb8c3bd251d8fc8771512c5329a93e
CVE ID: CVE-2017-20186 State: PUBLISHED Published: 2023-08-28T12:31:03.799Z Last Updated: 2025-07-01T13:49:40.758Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: nikooo777 Products: ckSurf Problem Types: CWE-404 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in nikooo777 ckSurf up to 1.19.2. It has been declared as problematic. This vulnerability affects the function SpecListMenuDead of the file csgo/addons/sourcemod/scripting/ckSurf/misc.sp of the component Spectator List Name Handler. The manipulation of the argument cleanName leads to denial of service. Upgrading to version 1.21.0 is able to address this issue. The name of the patch
cleanName leads to denial of service. Upgrading to version 1.21.0 is able to address this issue. The name of the patch is fd6318d99083a06363091441a0614bd2f21068e6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-238156. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238156 - https://vuldb.com/?ctiid.238156 - https://forums.alliedmods.net/showthread.php?t=297179 - https://github.com/nikooo777/ckSurf/commit/fd6318d99083a06363091441a0614bd2f21068e6 - https://github.com/nikooo777/ckSurf/re
s://github.com/nikooo777/ckSurf/commit/fd6318d99083a06363091441a0614bd2f21068e6 - https://github.com/nikooo777/ckSurf/releases/tag/1.21.0
CVE ID: CVE-2017-20187 State: PUBLISHED Published: 2023-11-05T20:31:03.149Z Last Updated: 2024-08-05T21:45:26.155Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: Magnesium-PHP Problem Types: CWE-74 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affec
this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.244482 - https://vuldb.com/?ctiid.244482 - https://github.com/floriangaerber/Magnesium-PHP/commit/500d340e1f6421007413cc08a8383475221c2604 - https://github.com/floriangaerber/Magnesium-PHP/releases/tag/v0.3.1
CVE ID: CVE-2017-20188 State: PUBLISHED Published: 2024-01-02T14:31:02.916Z Last Updated: 2025-06-03T14:45:46.867Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Zimbra Products: zm-ajax Problem Types: CWE-79 Description: A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is
ly. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is 8d039d6efe80780adc40c6f670c06d21de272105. It is recommended to upgrade the affected component. The identifier VDB-249421 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249421 - https://vuldb.com/?ctiid.249421 - https://github.com/Zimbra/zm-ajax/commit/8d039d6efe80780adc40c6f670c06d21de272105 - https://github.com/Zimbra/zm-ajax/releases/tag/8.8.2
CVE ID: CVE-2017-20189 State: PUBLISHED Published: 2024-01-22T00:00:00.000Z Last Updated: 2025-11-03T21:44:02.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackmd.io/%40fe1w0/HyefvRQKp - https://clojure.atlassian.net/browse/CLJ-2204 - https://github.com/frohoff/ysoserial/pull/68/files - https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3 - https://security.snyk
ll/68/files - https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3 - https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378
CVE ID: CVE-2017-20190 State: PUBLISHED Published: 2024-03-26T00:00:00 Last Updated: 2024-08-08T18:54:20.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiple Unicode combining characters, aka a "Zalgo text" attack. NOTE: third parties dispute whether the computational cost of interpreting Unicode data should be considered a vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talk.dynalist.io/t/dynalist-is-vulnerable-to-zalgo/1234 - https://en.wikipedia.org/wiki/Zalgo_text - https
es: - https://talk.dynalist.io/t/dynalist-is-vulnerable-to-zalgo/1234 - https://en.wikipedia.org/wiki/Zalgo_text - https://aka.ms/windowsbugbar
CVE ID: CVE-2017-20191 State: PUBLISHED Published: 2024-03-31T08:31:04.275Z Last Updated: 2024-08-05T21:45:25.966Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Zimbra Products: zm-admin-ajax Problem Types: CWE-79 Description: A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 8.8.2 is able to address this issue. The identifier of the
ssible to initiate the attack remotely. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is bb240ce0c71c01caabaa43eed30c78ba8d7d3591. It is recommended to upgrade the affected component. The identifier VDB-258621 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258621 - https://vuldb.com/?ctiid.258621 - https://github.com/Zimbra/zm-admin-ajax/commit/bb240ce0c71c01caabaa43eed30c78ba8d7d3591 - https://github.com/Zimbra/zm-admin-ajax/releases/tag/8.8.2
CVE ID: CVE-2017-20192 State: PUBLISHED Published: 2024-10-16T06:43:36.437Z Last Updated: 2024-10-16T18:03:37.388Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: strategy11team Products: Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Problem Types: CWE-79 Description: The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that e
ization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/900fcaab-2424-4ae8-af18-95659db0dbe3?source=cve - https://klikki.fi/adv/formidable.html - https://wordpress.org/plugins/formidable/#developers
CVE ID: CVE-2017-20193 State: PUBLISHED Published: 2024-10-16T07:31:51.171Z Last Updated: 2024-10-16T12:58:55.215Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: WooCommerce Products: Product Vendors Problem Types: CWE-79 Description: The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Note
cute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a224e745-f9c7-4ca6-b656-e94862b1dc57?source=cve - https://hackerone.com/reports/253313 - https://woocommerce.com/products/product-vendors/ - https://threatpost.com/reflected-xss-bug-patched-in-popular-woocommerce-wordpress-plugin/127744/ - https://www.majemedia.com/2017/09/xss-vulnerability-in-woocommerce-product-vendors-plugin/
CVE ID: CVE-2017-20194 State: PUBLISHED Published: 2024-10-16T07:31:52.606Z Last Updated: 2024-10-16T17:26:14.837Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: strategy11team Products: Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Problem Types: CWE-200 Description: The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
rs to export all of the form entries for a given form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7600fe1-94e4-4e3e-a9a6-ff3589813715?source=cve - https://klikki.fi/formidable-forms-vulnerabilities/
CVE ID: CVE-2017-20195 State: PUBLISHED Published: 2024-10-29T12:00:10.063Z Last Updated: 2024-10-29T14:49:27.094Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: LUNAD3v Products: AreaLoad Problem Types: CWE-89 Description: A vulnerability was found in LUNAD3v AreaLoad up to 1a1103182ed63a06dde63d1712f3262eda19c3ec. It has been rated as critical. This issue affects some unknown processing of the file request.php. The manipulation of the argument phone leads to sql injection. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 264813c546dba03989ac0fc365f2022bf65e3be2. It is
ut affected and unaffected releases are unavailable. The patch is named 264813c546dba03989ac0fc365f2022bf65e3be2. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281987 - https://vuldb.com/?ctiid.281987 - https://github.com/LUNAD3v/areaload/commit/264813c546dba03989ac0fc365f2022bf65e3be2
CVE ID: CVE-2017-20196 State: PUBLISHED Published: 2025-01-26T18:00:08.815Z Last Updated: 2025-01-28T14:41:05.670Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Itechscripts Products: School Management Software Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Itechscripts School Management Software 2.75. It has been classified as critical. This affects an unknown part of the file /notice-edit.php. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.95307 - https://vuldb.com/?ctiid.95307 - https://www.exploit-db.com/exploits/41034/ - https://www.exploit-db.com/exploits/41034
CVE ID: CVE-2017-20197 State: PUBLISHED Published: 2025-04-09T11:00:16.705Z Last Updated: 2025-04-09T13:17:18.497Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: propanetank Products: Roommate-Bill-Tracking Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in propanetank Roommate-Bill-Tracking up to 288437f658fc9ee7d4b92a9da12557024d8bc55c. It has been declared as critical. This vulnerability affects unknown code of the file /includes/login.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The name of the patch is b32bb1b940f82d38fb9310cd66ebe349e20a1d0a. It is recommended to apply a patch to fix this
otely. The name of the patch is b32bb1b940f82d38fb9310cd66ebe349e20a1d0a. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303640 - https://vuldb.com/?ctiid.303640 - https://github.com/propanetank/Roommate-Bill-Tracking/commit/b32bb1b940f82d38fb9310cd66ebe349e20a1d0a
CVE ID: CVE-2017-20198 State: PUBLISHED Published: 2025-07-23T13:50:52.047Z Last Updated: 2025-07-23T14:51:09.733Z Vendors: D2iQ, Inc. Products: DC/OS Marathon Problem Types: CWE-732 Description: The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations with