Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-12494 State: PUBLISHED Published: 2018-06-15T18:00:00 Last Updated: 2024-08-05T08:38:06.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsTemplate/content.html?path=../ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sanluan/PublicCMS/issues/12
CVE ID: CVE-2018-12495 State: PUBLISHED Published: 2018-06-15T18:00:00 Last Updated: 2024-08-05T08:38:05.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Orc/discount/issues/189#issuecomment-397541501 - https://lists.debian.org/debian-lts-announce/2018/09/msg00009.html - https://www.debian.org/security/2018/dsa-4293
CVE ID: CVE-2018-12498 State: PUBLISHED Published: 2018-06-15T19:00:00Z Last Updated: 2024-09-17T02:58:15.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/26
CVE ID: CVE-2018-12499 State: PUBLISHED Published: 2018-07-02T16:00:00 Last Updated: 2024-08-05T08:38:06.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Motorola MBP853 firmware does not correctly validate server certificates. This allows for a Man in The Middle (MiTM) attack to take place between a Motorola MBP853 camera and the servers it communicates with. In one such instance, it was identified that the device was downloading what appeared to be a client certificate. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sean-wright.com/cve-2018-12499/
CVE ID: CVE-2018-12501 State: PUBLISHED Published: 2018-06-16T13:00:00Z Last Updated: 2024-09-17T02:32:18.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios Fusion before 4.1.4 has XSS, aka TPS#13332-13335. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-fusion/change-log/
CVE ID: CVE-2018-12503 State: PUBLISHED Published: 2018-06-16T15:00:00Z Last Updated: 2024-09-16T19:15:13.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: tinyexr 0.9.5 has a heap-based buffer over-read in LoadEXRImageFromMemory in tinyexr.h. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_b53a457 - https://github.com/syoyo/tinyexr/issues/81
CVE ID: CVE-2018-12504 State: PUBLISHED Published: 2018-06-16T15:00:00Z Last Updated: 2024-09-16T18:34:53.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_b53a457 - https://github.com/syoyo/tinyexr/issues/82
CVE ID: CVE-2018-12511 State: PUBLISHED Published: 2018-09-21T17:00:00 Last Updated: 2024-08-05T08:38:06.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the mintToken function of a smart contract implementation for Substratum (SUB), an Ethereum ERC20 token, the administrator can control mintedAmount, leverage an integer overflow, and modify a user account's balance arbitrarily. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/n0pn0pn0p/smart_contract_-vulnerability/blob/master/PolyAi.md
CVE ID: CVE-2018-12519 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:38:06.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious file to a Node.js application. An attacker can upload a malicious HTML file that contains a JavaScript payload to steal a user's credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44978/ - https://cxsecurity.com/issue/WLB-2018060185
CVE ID: CVE-2018-12520 State: PUBLISHED Published: 2018-07-05T20:00:00 Last Updated: 2024-08-05T08:38:05.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access. Additio
the deterministic random number generation in order to hijack the user's session, thus escalating their access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ntop/ntopng/commit/30610bda60cbfc058f90a1c0a17d0e8f4516221a - https://www.exploit-db.com/exploits/44973/ - http://seclists.org/fulldisclosure/2018/Jul/14 - https://gist.github.com/Psychotropos/3e8c047cada9b1fb716e6a014a428b7f
CVE ID: CVE-2018-12522 State: PUBLISHED Published: 2018-06-18T11:00:00 Last Updated: 2024-08-05T08:38:06.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ provides a directory listing. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/eA5tGKf0 - https://www.exploit-db.com/exploits/44910/
CVE ID: CVE-2018-12523 State: PUBLISHED Published: 2018-06-18T11:00:00 Last Updated: 2024-08-05T08:38:06.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /etc/ provides a directory listing. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/eA5tGKf0 - https://www.exploit-db.com/exploits/44910/
CVE ID: CVE-2018-12524 State: PUBLISHED Published: 2018-06-18T11:00:00 Last Updated: 2024-08-05T08:38:06.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provides a directory listing. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/eA5tGKf0 - https://www.exploit-db.com/exploits/44910/
CVE ID: CVE-2018-12525 State: PUBLISHED Published: 2018-06-18T11:00:00 Last Updated: 2024-08-05T08:38:06.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /images/ provides a directory listing. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/eA5tGKf0 - https://www.exploit-db.com/exploits/44910/
CVE ID: CVE-2018-12526 State: PUBLISHED Published: 2018-06-21T15:00:00 Last Updated: 2024-08-05T08:38:06.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare SDT-CS3B1 and SDT-CW3B1 devices through 1.2.0 have a default factory account. Remote attackers can obtain access to the device via TELNET using a hardcoded account. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/data/secNoticeView.do?bulletin_writing_sequence=27284 - https://www.fortiguard.com/zeroday/FG-VD-18-106
CVE ID: CVE-2018-12528 State: PUBLISHED Published: 2018-07-02T16:00:00 Last Updated: 2024-08-05T08:38:06.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Intex N150 devices. The backup/restore option does not check the file extension uploaded for importing a configuration files backup, which can lead to corrupting the router firmware settings or even the uploading of malicious files. In order to exploit the vulnerability, an attacker can upload any malicious file and force reboot the router with it. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44933/ - http://securitywarrior9.blogspot.com/2018/0
rogram Container: References: - https://www.exploit-db.com/exploits/44933/ - http://securitywarrior9.blogspot.com/2018/06/malicious-file-upload-intex-router-n.html
CVE ID: CVE-2018-12529 State: PUBLISHED Published: 2018-07-02T16:00:00 Last Updated: 2024-08-05T08:38:06.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Intex N150 devices. The router firmware suffers from multiple CSRF injection point vulnerabilities including changing user passwords and router settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44939/ - http://securitywarrior9.blogspot.com/2018/06/cross-site-request-forgery-intex-router.html
CVE ID: CVE-2018-12530 State: PUBLISHED Published: 2018-06-18T14:00:00 Last Updated: 2024-08-05T08:38:06.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/summ3rf/Vulner/blob/master/Metinfo.md
CVE ID: CVE-2018-12531 State: PUBLISHED Published: 2018-06-18T14:00:00 Last Updated: 2024-08-05T08:38:06.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/summ3rf/Vulner/blob/master/Metinfo.md
CVE ID: CVE-2018-12532 State: PUBLISHED Published: 2018-06-18T12:00:00 Last Updated: 2024-08-05T08:38:05.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104503 - https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html - http://seclists.org/fulldisclosure/2020/Mar/21
CVE ID: CVE-2018-12533 State: PUBLISHED Published: 2018-06-18T12:00:00 Last Updated: 2024-08-05T08:38:06.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2664 - http://www.securitytracker.com/id/1041617 - https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html - https://access.redhat.com/errata/RH
ker.com/id/1041617 - https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html - https://access.redhat.com/errata/RHSA-2018:2663 - http://www.securityfocus.com/bid/104502 - https://access.redhat.com/errata/RHSA-2018:2930 - http://seclists.org/fulldisclosure/2020/Mar/21
CVE ID: CVE-2018-12534 State: PUBLISHED Published: 2018-06-18T14:00:00Z Last Updated: 2024-09-16T16:27:26.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/quick-chat/#developers
CVE ID: CVE-2018-12536 State: PUBLISHED Published: 2018-06-27T17:00:00 Last Updated: 2024-08-05T08:38:06.220Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-209 Description: In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, t
the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041194 - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181014-0001/ - https://support.hpe.c
e.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181014-0001/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us - https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670 - https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html
CVE ID: CVE-2018-12537 State: PUBLISHED Published: 2018-08-14T19:00:00 Last Updated: 2024-08-05T08:38:06.072Z Vendors: The Eclipse Foundation Products: Eclipse Vert.x Problem Types: CWE-93 Description: In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/vert.x/commit/1bb6445226c39a95e7d07ce3caaf56828e8aab72 - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC
it/1bb6445226c39a95e7d07ce3caaf56828e8aab72 - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txt - https://access.redhat.com/errata/RHSA-2018:2371 - https://github.com/eclipse/vert.x/issues/2470 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038 - https://access.redhat.com/errata/RHSA-2018:3768 - https://bugzilla.redhat.com/show_bug.cgi?id=1591072
CVE ID: CVE-2018-12538 State: PUBLISHED Published: 2018-06-22T19:00:00 Last Updated: 2024-08-05T08:38:06.131Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-6 Description: In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041194 - https://www.oracle.com/technetwork/security-advisory/cpuoct2
: References: - http://www.securitytracker.com/id/1041194 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181014-0001/ - https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018
CVE ID: CVE-2018-12539 State: PUBLISHED Published: 2018-08-14T19:00:00 Last Updated: 2024-08-05T08:38:06.190Z Vendors: The Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-419 Description: In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/er
bm.tools.attach.enable=no. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2713 - https://access.redhat.com/errata/RHSA-2018:2575 - https://access.redhat.com/errata/RHSA-2018:2576 - https://access.redhat.com/errata/RHSA-2018:2568 - https://access.redhat.com/errata/RHSA-2018:2569 - https://access.redhat.com/errata/RHSA-2018:2712 - http://www.securitytracker.com/id/1041765 - http://www.securityfocus.com/bid/105126 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=534589 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
CVE ID: CVE-2018-12540 State: PUBLISHED Published: 2018-07-12T14:00:00 Last Updated: 2024-08-05T08:38:05.970Z Vendors: The Eclipse Foundation Products: Eclipse Vert.x Problem Types: CWE-352 Description: In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=536948 - https://access.redhat.com/errata/RHSA-2018:2371 - https://lists.apache.org/thread.html/r59482ebed302aa49ac7e0c51737499746b0d086fcdeb8f90e705951
om/errata/RHSA-2018:2371 - https://lists.apache.org/thread.html/r59482ebed302aa49ac7e0c51737499746b0d086fcdeb8f90e705951f%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r3fffda8e947edaa359152c8dc4c4ea9c96fd8ced1999bbce92bc6b25%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rc5b4ae8a7caae6d3d5b3266cb050823b96dd62b30718b90b778d3d8b%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r10aef585c521f8ef603f5831f9d97a27d920624025131da950e0c62f%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2018-12541 State: PUBLISHED Published: 2018-10-10T20:00:00 Last Updated: 2024-08-05T08:38:06.089Z Vendors: The Eclipse Foundation Products: Eclipse Vert.x Problem Types: CWE-789 Description: In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=539170 - https://github.com/eclipse-ver
E Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=539170 - https://github.com/eclipse-vertx/vert.x/issues/2648 - https://access.redhat.com/errata/RHSA-2018:2946 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r344235b1aea2f7fa2381495df1d77d02b595e3d7e4626e701f7c1062%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r362835e6c7f34324ed24e318b363fcdd20cea91d0cea0b2e1164f73e%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/re5ddabee26fbcadc7254d03a5a073d64080a9389adc9e452529664ed%40%3Ccommits.pu
.org%3E - https://lists.apache.org/thread.html/re5ddabee26fbcadc7254d03a5a073d64080a9389adc9e452529664ed%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r8db0431ecf93f2dd2128db5ddca897b33ba883b7f126648d6a9e4c47%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r3da899890536af744dec897fbc561fd9810ac45e79a16164b53c31b2%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r11789cd6d67ecca2d6f6bbb11e34495e68ee99287b6c59edf5b1a09c%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rbdc279ecdb7ac496a03befb05a53605c4ce2b67e14f8f4df4cfa1203%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.
db7ac496a03befb05a53605c4ce2b67e14f8f4df4cfa1203%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r1af71105539fe01fcecb92d2ecd8eea56c515fb1c80ecab4df424553%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r79789a0afb184abd13a2c07016e6e7ab8e64331f332b630bf82a2eed%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/reb3cc4f3e10264896a541813c0030ec9d9466ba9b722fe5d4adc91cd%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r01123837ffbfdf5809e0a4ac354ad546e4ca8f18df89ee5a10eeb81b%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r98dc06e2b1c498d0e9eb5038d8e1aefd24e411e50
b%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r98dc06e2b1c498d0e9eb5038d8e1aefd24e411e50522e7082dd9e0b7%40%3Ccommits.bookkeeper.apache.org%3E
CVE ID: CVE-2018-12542 State: PUBLISHED Published: 2018-10-10T20:00:00 Last Updated: 2024-08-05T08:38:06.140Z Vendors: The Eclipse Foundation Products: Eclipse Vert.x Problem Types: n/a Description: In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Cco
er: References: - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://github.com/vert-x3/vertx-web/issues/1025 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=539171
CVE ID: CVE-2018-12543 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T08:38:06.301Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-617 Description: In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=539295
CVE ID: CVE-2018-12544 State: PUBLISHED Published: 2018-10-10T20:00:00 Last Updated: 2024-08-05T08:38:06.199Z Vendors: The Eclipse Foundation Products: Eclipse Vert.x Problem Types: CWE-611 Description: In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2946 - https://github.com/vert-x3/vertx-web/issues/1021 - https://bugs.eclipse.org/bugs/show_bug.
t.com/errata/RHSA-2018:2946 - https://github.com/vert-x3/vertx-web/issues/1021 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E