Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1000810 State: PUBLISHED Published: 2018-10-08T15:00:00 Last Updated: 2024-08-05T12:47:56.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201812-11 - https://blog
ditional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201812-11 - https://blog.rust-lang.org/2018/09/21/Security-advisory-for-std.html - https://groups.google.com/forum/#%21topic/rustlang-security-announcements/CmSuTm-SaU0
CVE ID: CVE-2018-1000811 State: PUBLISHED Published: 2018-12-20T15:00:00 Last Updated: 2024-08-05T12:47:56.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46060/ - https://github.com/bludit/bludit/issues/812
CVE ID: CVE-2018-1000812 State: PUBLISHED Published: 2018-12-20T15:00:00 Last Updated: 2024-08-05T12:47:56.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/password_recovery.php that can result in IntegriaIMS web app user accounts can be taken over. This attack appear to be exploitable via Network access to IntegriaIMS web interface . This vulnerability appears to have been fixed in fixed in versions released after commit f2ff0ba821644acecb893483c86a9c4d3bb75047. Addit
ty appears to have been fixed in fixed in versions released after commit f2ff0ba821644acecb893483c86a9c4d3bb75047. Additional Analyst Notes: - CVE Program Container: References: - https://cp270.wordpress.com/2018/05/14/war-story-password-resets/ - https://github.com/fleetcaptain/integria-takeover - https://github.com/articaST/integriaims/commit/f2ff0ba821644acecb893483c86a9c4d3bb75047
CVE ID: CVE-2018-1000813 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T00:02:13.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later. Additional Analyst Notes: - CVE Program Container: References: - https://backdropcms.org/security/backdrop-sa-core-2018-005
CVE ID: CVE-2018-1000814 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T01:01:46.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aio-libs/aiohttp-session/pull/331 - https://github.com/aio-libs/aiohttp-session/issues/325
CVE ID: CVE-2018-1000815 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T23:15:25.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2. Additional Analyst Notes: - CVE Program Container: References: - https://gi
bility appears to have been fixed in 0.25.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brave/browser-laptop/issues/15232 - https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4 - https://github.com/brave/muon/pull/651
CVE ID: CVE-2018-1000816 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T00:31:53.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted.. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/issues/13667
CVE ID: CVE-2018-1000817 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T23:31:40.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially crafted GET request containing directory traversal from assets-pipeline context. This vulnerability appears to have been fixed in 2.14.1.1 (for Grails 2.x), 2.15.1 (for Grails 3 and Java 7) and 3.0.6 (for Grails 3 and Java 8). Additi
ve been fixed in 2.14.1.1 (for Grails 2.x), 2.15.1 (for Grails 3 and Java 7) and 3.0.6 (for Grails 3 and Java 8). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grails/grails-core/issues/11068 - http://grailsblog.objectcomputing.com/posts/2018/09/23/security-vulnerability-in-asset-pipeline-and-jetty.html
CVE ID: CVE-2018-1000818 State: REJECTED Published: 2018-11-29T23:00:00Z Last Updated: 2024-09-17T01:51:53.420Z Description: No description available.
CVE ID: CVE-2018-1000819 State: REJECTED Published: 2018-11-29T23:00:00Z Last Updated: 2024-09-17T00:46:26.436Z Description: No description available.
CVE ID: CVE-2018-1000820 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T18:38:58.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/27/neo4f-apoc-procedures-XXE/ - https://github.com/neo4j-contrib/neo4j-apoc-procedures/issues/931
CVE ID: CVE-2018-1000821 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T16:27:44.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted SMathStudio files. This vulnerability appears to have been fixed in after commit 5c05ac8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mkulesh/microMathematics/issues/79 - https://0dd.zone/2018/10/27/micromathematics-XX
r: References: - https://github.com/mkulesh/microMathematics/issues/79 - https://0dd.zone/2018/10/27/micromathematics-XXE/
CVE ID: CVE-2018-1000822 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T00:36:37.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/27/fess-XXE/ - https://github.com/codelibs/fess/issues/1851
CVE ID: CVE-2018-1000823 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T20:27:46.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/27/exist-XXE/ - https://github.com/eXist-db/exist/issues/2180
CVE ID: CVE-2018-1000824 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T18:17:53.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: MegaMek version < v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/28/megamek-Object-Injection/ - https://github.com/MegaMek/megamek/issues/1162
CVE ID: CVE-2018-1000825 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T00:55:34.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/28/freecol-XXE/ - https://github.com/FreeCol/freecol/issues/26
CVE ID: CVE-2018-1000826 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T02:11:56.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/microweber/microweber/issues/489 - https://0dd.zone/2018/10/28/microweber-XSS/
CVE ID: CVE-2018-1000827 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T00:35:36.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/28/ubilling-Object-Injection/ - https://github.com/nightflyza/Ubilling/issues/330
CVE ID: CVE-2018-1000828 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T01:57:06.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to update the software. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/28/frostwire-XXE-MitM/ - https://github.com/frostwire/frostwire/issues/829
CVE ID: CVE-2018-1000829 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T18:17:52.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 80359b4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dmsl/anyplace/issues/263 - https://0dd.zone/2018/10/28/anyplace-XXE-MitM/
CVE ID: CVE-2018-1000830 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T01:50:36.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/goxr3plus/XR3Player/issues/9 - https://0dd.zone/2018/10/28/xr3player-XXE/
CVE ID: CVE-2018-1000831 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T22:56:39.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDAV server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k9mail/k-9/issues/3681 - https://0dd.zone/2018/10/28/k9mail-XXE-MitM/
CVE ID: CVE-2018-1000832 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T20:16:45.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/28/zoneminder-Object-Injection/ - https://github.com/ZoneMinder/zoneminder/issues/2271
CVE ID: CVE-2018-1000833 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T18:56:24.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/28/zoneminder-Object-Injection-2/ - https://github.com/ZoneMinder/zoneminder/issues/2272
CVE ID: CVE-2018-1000834 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T21:07:36.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: runelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/runelite/runelite/issues/6160 - https://0dd.zone/2018/10/28/runelite-XXE-MitM/
CVE ID: CVE-2018-1000835 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T23:02:08.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Kunzisoft/KeePassDX/issues/200 - https://0dd.zone/2018/10/28/KeePassDX-XXE/
CVE ID: CVE-2018-1000836 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T20:51:59.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bedework/bw-calendar-engine/issues/3 - https://0dd.zone/2018/10/28/bw-calendar-engine-XXE-MitM/
CVE ID: CVE-2018-1000837 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T01:46:52.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file. Additional Analyst Notes: - CVE Program Container: References: - https://0dd.zone/2018/10/28/uml-designer-XXE/ - https://github.com/ObeoNetwork/UML-Designer/issues/1035
CVE ID: CVE-2018-1000838 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T01:10:34.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sleuthkit/autopsy/issues/4236 - https://0dd.zone/2018/10/28/autopsy-XXE/
CVE ID: CVE-2018-1000839 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T17:07:49.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreHealthIO/lh-ehr/issues/1223 - https://0dd.zone/2018/09/03/lh-ehr-RCE-via-picture-upload/
CVE ID: CVE-2018-1000840 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T23:06:18.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/processing/processing/issues/5706 - https://twitter.com/ben_fry/status/1054333613465059329
CVE ID: CVE-2018-1000841 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T02:15:53.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser.. This attack appear to be exploitable via HTTP POST request. This vulnerability appears to have been fixed in 5.16-1 Beta. Additional Analyst Notes: - CVE Program Container: References: - https://zend.to/changelog.php
CVE ID: CVE-2018-1000842 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T22:02:28.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2. Additional Analyst Notes: - CVE Program Container: References:
ve been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/asteinhauser/fat_free_crm/issues/1 - https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa - https://github.com/fatfreecrm/fat_free_crm/wiki/XSS-Vulnerability-%282018-10-27%29 - https://groups.google.com/forum/#%21topic/fat-free-crm-users/TxsdZXSe7Jc
CVE ID: CVE-2018-1000843 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T17:43:37.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such as task name, id, parameter, etc. will be leaked to unauthorized users. This attack appear to be exploitable via The victim must visit a specially crafted webpage from the network where their Luigi server is accessible.. This vulnerability appears to have been fixed i
rafted webpage from the network where their Luigi server is accessible.. This vulnerability appears to have been fixed in 2.8.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spotify/luigi/pull/1870 - https://groups.google.com/forum/#%21topic/luigi-user/ZgfRTpBsVUY - https://github.com/spotify/luigi/blob/2.7.9/luigi/server.py#L67
CVE ID: CVE-2018-1000844 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-17T00:50:46.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/square/retrofit/pull/2735
CVE ID: CVE-2018-1000845 State: REJECTED Published: 2018-12-20T15:00:00 Last Updated: 2019-01-30T16:57:01 Description: No description available.
CVE ID: CVE-2018-1000846 State: PUBLISHED Published: 2018-12-20T15:00:00Z Last Updated: 2024-09-16T22:02:36.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website containing attacker's javascript. This vulnerability appears to have been fixed in 1.0.5 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/funzoneq/freshdns/pull/6/commits/bdeff81bd4baf
Analyst Notes: - CVE Program Container: References: - https://github.com/funzoneq/freshdns/pull/6/commits/bdeff81bd4baff9463d46b90fb1889e7ac7ec4ed - https://github.com/funzoneq/freshdns/issues/7