Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
45742/ - https://lists.x.org/archives/xorg-announce/2018-October/002927.html - https://www.exploit-db.com/exploits/45922/ - https://usn.ubuntu.com/3802-1/ - https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e - https://www.exploit-db.com/exploits/45697/ - https://access.redhat.com/errata/RHSA-2018:3410 - http://www.securityfocus.com/bid/105741 - https://www.exploit-db.com/exploits/45908/ - https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html - https://www.exploit-db.com/exploits/46142/ - https://security.gentoo.org/glsa/201810-09 - http://www.securitytracker.com/id/1041948 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665
/glsa/201810-09 - http://www.securitytracker.com/id/1041948 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665 - https://www.exploit-db.com/exploits/45832/ - https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170 - https://www.exploit-db.com/exploits/45938/ - https://www.debian.org/security/2018/dsa-4328 - http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html - http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html
CVE ID: CVE-2018-14666 State: PUBLISHED Published: 2019-01-22T15:00:00 Last Updated: 2024-08-05T09:38:13.123Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: Satellite Problem Types: CWE-285 Description: An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106490 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14666
CVE ID: CVE-2018-14667 State: PUBLISHED Published: 2018-11-06T22:00:00.000Z Last Updated: 2025-10-21T23:45:47.440Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: RichFaces Problem Types: CWE-94 Description: The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667 - https://access.redhat.com/errata/RHSA-2018:3519 - https://access.redhat.com/errata/RHSA-2018:3581 - https://access.redhat.com/errata/RHSA-2018:3518 - https://access.redhat.com/errata/RHSA-2018:3517 - http://www.securitytracker.com/id/1042037 - http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html - http://seclists.org/fulldisclosure/2020/Mar/21
CVE ID: CVE-2018-14668 State: PUBLISHED Published: 2019-08-15T17:31:24 Last Updated: 2024-08-05T09:38:12.930Z Vendors: n/a Products: ClickHouse Problem Types: Cross Protocol Request Forgery Description: In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks. Additional Analyst Notes: - CVE Program Container: References: - https://clickhouse.yandex/docs/en/security_changelog/
CVE ID: CVE-2018-14669 State: PUBLISHED Published: 2019-08-15T17:39:30 Last Updated: 2024-08-05T09:38:12.908Z Vendors: n/a Products: ClickHouse Problem Types: Local File Disclosure Description: ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server. Additional Analyst Notes: - CVE Program Container: References: - https://clickhouse.yandex/docs/en/security_changelog/
CVE ID: CVE-2018-14670 State: PUBLISHED Published: 2019-08-15T17:13:39 Last Updated: 2024-08-05T09:38:13.009Z Vendors: ClickHouse Products: ClickHouse Problem Types: Execution with Unnecessary Privileges Description: Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. Additional Analyst Notes: - CVE Program Container: References: - https://clickhouse.yandex/docs/en/security_changelog/
CVE ID: CVE-2018-14671 State: PUBLISHED Published: 2019-08-15T17:46:03 Last Updated: 2024-08-05T09:38:12.939Z Vendors: ClickHouse Products: ClickHouse Problem Types: Remote Code Execution Description: In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://clickhouse.yandex/docs/en/security_changelog/
CVE ID: CVE-2018-14672 State: PUBLISHED Published: 2019-08-15T17:54:05 Last Updated: 2024-08-05T09:38:13.336Z Vendors: n/a Products: ClickHouse Problem Types: Path Traversal Description: In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages. Additional Analyst Notes: - CVE Program Container: References: - https://clickhouse.yandex/docs/en/security_changelog/
CVE ID: CVE-2018-14678 State: PUBLISHED Published: 2018-07-28T18:00:00 Last Updated: 2024-08-05T09:38:13.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041397 - https://lists.debian.org/
lyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041397 - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://xenbits.xen.org/xsa/advisory-274.html - http://www.securityfocus.com/bid/104924 - https://www.debian.org/security/2018/dsa-4308 - https://usn.ubuntu.com/3931-1/ - https://usn.ubuntu.com/3931-2/
CVE ID: CVE-2018-14679 State: PUBLISHED Published: 2018-07-28T23:00:00 Last Updated: 2024-08-05T09:38:13.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash). Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3728-3/ - https://www.debian.org/security/2018/dsa-4260 - https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html - https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b307
.org/debian-lts-announce/2018/08/msg00007.html - https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b30784e1d312a - https://bugs.debian.org/904802 - http://www.openwall.com/lists/oss-security/2018/07/26/1 - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3789-2/ - https://usn.ubuntu.com/3728-2/ - http://www.securitytracker.com/id/1041410 - https://usn.ubuntu.com/3728-1/ - https://access.redhat.com/errata/RHSA-2018:3327 - https://security.gentoo.org/glsa/201903-20
CVE ID: CVE-2018-14680 State: PUBLISHED Published: 2018-07-28T23:00:00 Last Updated: 2024-08-05T09:38:13.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3728-3/ - https://www.debian.org/security/2018/dsa-4260 - https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html - https://bugs.debian.org/904801 - https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b30784e1d312a - http://www.openwall.com/lists/oss-security/2018/07/26/1 - https://access.redhat.com/errat
07fee748aec2274b30784e1d312a - http://www.openwall.com/lists/oss-security/2018/07/26/1 - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3789-2/ - https://usn.ubuntu.com/3728-2/ - http://www.securitytracker.com/id/1041410 - https://usn.ubuntu.com/3728-1/ - https://access.redhat.com/errata/RHSA-2018:3327 - https://security.gentoo.org/glsa/201903-20
CVE ID: CVE-2018-14681 State: PUBLISHED Published: 2018-07-28T23:00:00 Last Updated: 2024-08-05T09:38:13.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3728-3/ - https://www.debian.org/security/2018/dsa-4260 - https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html - https://bugs.debian.org/904799 - http://www.openwall.com/lists/oss-security/2018/07/26/1 - https://access.redhat.com/errata/RHSA-2018:3505 - https://
9 - http://www.openwall.com/lists/oss-security/2018/07/26/1 - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3789-2/ - https://usn.ubuntu.com/3728-2/ - https://github.com/kyz/libmspack/commit/0b0ef9344255ff5acfac6b7af09198ac9c9756c8 - http://www.securitytracker.com/id/1041410 - https://usn.ubuntu.com/3728-1/ - https://access.redhat.com/errata/RHSA-2018:3327 - https://security.gentoo.org/glsa/201903-20
CVE ID: CVE-2018-14682 State: PUBLISHED Published: 2018-07-28T23:00:00 Last Updated: 2024-08-05T09:38:12.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3728-3/ - https://www.debian.org/security/2018/dsa-4260 - https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html - https://bugs.debian.org/904800 - http://www.openwall.com/lists/oss-security/2018/07/26/1 - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3789-2
ll.com/lists/oss-security/2018/07/26/1 - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3789-2/ - https://usn.ubuntu.com/3728-2/ - http://www.securitytracker.com/id/1041410 - https://github.com/kyz/libmspack/commit/4fd9ccaa54e1aebde1e4b95fb0163b699fd7bcc8 - https://usn.ubuntu.com/3728-1/ - https://access.redhat.com/errata/RHSA-2018:3327 - https://security.gentoo.org/glsa/201903-20
CVE ID: CVE-2018-14683 State: PUBLISHED Published: 2019-04-10T21:32:32 Last Updated: 2024-08-05T09:38:12.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI. Additional Analyst Notes: - CVE Program Container: References: - https://www.paessler.com/prtg/history/stable
CVE ID: CVE-2018-14685 State: PUBLISHED Published: 2018-07-28T23:00:00 Last Updated: 2024-08-05T09:38:13.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TonyKentClark/MyCodeAudit/blob/master/gxlcms1.1.4
CVE ID: CVE-2018-14686 State: PUBLISHED Published: 2018-07-28T23:00:00 Last Updated: 2024-08-05T09:38:12.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: system/edit_book.php in XYCMS 1.7 has stored XSS via a crafted add_do.php request, related to add_book.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TonyKentClark/MyCodeAudit/blob/master/xycms%20%20v1.7
CVE ID: CVE-2018-14688 State: PUBLISHED Published: 2018-09-21T16:00:00 Last Updated: 2024-08-05T09:38:13.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Subsonic 6.1.1. The radio settings are affected by three stored cross-site scripting vulnerabilities in the name[x], streamUrl[x], homepageUrl[x] parameters (where x is an integer) to internetRadioSettings.view that could be used to steal session information of a victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/09/subsonic-6-1-1-multiple-vulnerabilities/
CVE ID: CVE-2018-14689 State: PUBLISHED Published: 2018-09-21T16:00:00 Last Updated: 2024-08-05T09:38:13.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vulnerabilities in the name[x], sourceformats[x], targetFormat[x], step1[x], and step2[x] parameters (where x is an integer) to transcodingSettings.view that could be used to steal session information of a victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/09/subsonic-6-1-1-multiple-vulnerabilities/
CVE ID: CVE-2018-14690 State: PUBLISHED Published: 2018-09-21T16:00:00 Last Updated: 2024-08-05T09:38:13.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnerabilities in the title and subtitle parameters to generalSettings.view that could be used to steal session information of a victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/09/subsonic-6-1-1-multiple-vulnerabilities/
CVE ID: CVE-2018-14691 State: PUBLISHED Published: 2018-09-21T16:00:00 Last Updated: 2024-08-05T09:38:13.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0-param2, c0-param3, and c0-param4 parameters to dwr/call/plaincall/tagService.setTags.dwr that could be used to steal session information of a victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/09/subsonic-6-1-1-multiple-vulnerabilities/
CVE ID: CVE-2018-14695 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14696 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14697 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the username URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14698 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14699 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14700 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14701 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc - http://packetstormsecurity.com/files/156710/Drobo-5N2-4.1.1-Remote-Command-Injection.html
CVE ID: CVE-2018-14702 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14703 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14704 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14705 State: PUBLISHED Published: 2020-02-24T18:16:20 Last Updated: 2024-08-05T09:38:13.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these applications, but also poses severe risks to the confidentiality and integrity of data stored within the applications and the device itself. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/c
he device itself. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc - https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE ID: CVE-2018-14706 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14707 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14708 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
CVE ID: CVE-2018-14709 State: PUBLISHED Published: 2018-12-03T22:00:00 Last Updated: 2024-08-05T09:38:13.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc - http://packetstormsecurity.com/files/156710/Drobo-5N2-4.1.1-Remote-Command-Injection.html
CVE ID: CVE-2018-14710 State: PUBLISHED Published: 2019-05-13T12:19:24 Last Updated: 2024-08-05T09:38:13.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the "hook" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8
CVE ID: CVE-2018-14711 State: PUBLISHED Published: 2019-05-13T12:20:19 Last Updated: 2024-08-05T09:38:13.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8