Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-16349 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/147
CVE ID: CVE-2018-16350 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/148
CVE ID: CVE-2018-16352 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:32.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alterebro/WeaselCMS/issues/8
CVE ID: CVE-2018-16353 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:31.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/focalhot/FHCRM/issues/3
CVE ID: CVE-2018-16354 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:32.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/focalhot/FHCRM/issues/4
CVE ID: CVE-2018-16356 State: PUBLISHED Published: 2020-03-02T19:24:40 Last Updated: 2024-08-05T10:24:31.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/escape_wang/CVE-2018-16356
CVE ID: CVE-2018-16357 State: PUBLISHED Published: 2020-03-02T19:28:02 Last Updated: 2024-08-05T10:24:31.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/escape_wang/CVE-2018-16357
CVE ID: CVE-2018-16358 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:31.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml. Additional Analyst Notes: - CVE Program Container: References: - https://hg.dotclear.org/dotclear/rev/d4841d6d65d6
CVE ID: CVE-2018-16359 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:31.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows attackers to rename files on the host OS. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1632 - https://github.com/google/gvisor/commit/001a4c2493b13a43d62c7511fb509a959ae4abc2
CVE ID: CVE-2018-16361 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:24:32.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/btiteam/xbtit/pull/58 - https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE ID: CVE-2018-16362 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:31.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of arbitrary code (if CSP settings permit it) via repo_manage_page.php or list.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mantisbt-plugins/source-integration/releases/tag/v1.5.9 - https://github.com/mantisbt-plugins/source-integration/issues/286 - https://github.com/ma
egration/releases/tag/v1.5.9 - https://github.com/mantisbt-plugins/source-integration/issues/286 - https://github.com/mantisbt-plugins/source-integration/releases/tag/v2.1.5
CVE ID: CVE-2018-16363 State: PUBLISHED Published: 2018-09-07T22:00:00 Last Updated: 2024-08-05T10:24:32.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php. Additional Analyst Notes: - CVE Program Container: References: - http://blog.51cto.com/010bjsoft/2171087 - https://plugins.trac.wordpress.org/changeset/1936043 - https://wpvulndb.com/vulnerabilities/9126 - https://wordpress.org/support/topic/security-concern-6/#post-10655739
CVE ID: CVE-2018-16364 State: PUBLISHED Published: 2018-09-26T21:00:00 Last Updated: 2024-08-05T10:24:31.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jamesotten.com/post/applications-manager-rce/
CVE ID: CVE-2018-16365 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:32.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/32
CVE ID: CVE-2018-16366 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:31.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/32
CVE ID: CVE-2018-16367 State: PUBLISHED Published: 2018-09-02T22:00:00 Last Updated: 2024-08-05T10:24:31.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OnlineJudge 2.0, the sandbox has an incorrect access control vulnerability that can write a file anywhere. A user can write a directory listing to /tmp, and can leak file data with a #include. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/QingdaoU/OnlineJudge/issues/165
CVE ID: CVE-2018-16368 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:32.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: SplashXPath::strokeAdjust in splash/SplashXPath.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/xpdf
CVE ID: CVE-2018-16369 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:31.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: XRef::fetch in XRef.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (stack consumption) via a crafted pdf file, related to AcroForm::scanField, as demonstrated by pdftohtml. NOTE: this might overlap CVE-2018-7453. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/xpdf
CVE ID: CVE-2018-16370 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:32.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lazyphp/PESCMS-TEAM/issues/2
CVE ID: CVE-2018-16371 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:32.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=User_group&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lazyphp/PESCMS-TEAM/issues/3
CVE ID: CVE-2018-16372 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:32.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/iechoo/ideacms/issues/1
CVE ID: CVE-2018-16373 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:31.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/13
CVE ID: CVE-2018-16374 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:32.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/14
CVE ID: CVE-2018-16375 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:31.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c can lead to a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105266 - https://github.com/uclouvain/openjpeg/issues/1126
CVE ID: CVE-2018-16376 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:32.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105262 - https://github.com/uclouvain/openjpeg/issues/1127
CVE ID: CVE-2018-16379 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:32.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/n00dles/ogma-CMS/issues/38
CVE ID: CVE-2018-16380 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:32.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/n00dles/ogma-CMS/issues/39
CVE ID: CVE-2018-16381 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:24:32.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dhananjay-bajaj/E107-v2.1.8-XSS-POC
CVE ID: CVE-2018-16382 State: PUBLISHED Published: 2018-09-03T02:00:00 Last Updated: 2024-08-05T10:24:31.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwide Assembler (NASM) 2.14rc15 has a buffer over-read in x86/regflags.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392503 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html
CVE ID: CVE-2018-16384 State: PUBLISHED Published: 2018-09-03T00:00:00 Last Updated: 2024-08-05T10:24:31.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167 - https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
CVE ID: CVE-2018-16385 State: PUBLISHED Published: 2018-09-03T02:00:00 Last Updated: 2024-08-05T10:24:31.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/top-think/framework/issues/1375
CVE ID: CVE-2018-16386 State: PUBLISHED Published: 2019-07-05T19:58:09 Last Updated: 2024-08-05T10:24:32.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection (and an arbitrary log filename) can be achieved via the PATH_INFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error messages. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/shiham101/8763642e768582e0182f92cd41c482ec
CVE ID: CVE-2018-16387 State: PUBLISHED Published: 2018-09-03T02:00:00 Last Updated: 2024-08-05T10:24:32.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jbroadway/elefant/issues/285
CVE ID: CVE-2018-16388 State: PUBLISHED Published: 2018-09-12T16:00:00 Last Updated: 2024-08-05T10:24:32.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/ommadawn46/5cb22e7c66cc32a5c7734a8064b4d3f5 - https://github.com/e107inc/e107/commit/e5bb5297f68e56537c004cdbb48a30892e9f6f4c
CVE ID: CVE-2018-16389 State: PUBLISHED Published: 2018-09-12T16:00:00 Last Updated: 2024-08-05T10:24:31.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/e107inc/e107/commit/ec483e9379aa622bfcc1b853b189c74288771f27 - https://gist.github.com/ommadawn46/51e08e13e6980dcbcffb4322c29b93d0
CVE ID: CVE-2018-16391 State: PUBLISHED Published: 2018-09-03T14:00:00 Last Updated: 2024-08-05T10:24:32.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-477b7a40136bb418b10ce271c8664536 - https://github.com/OpenSC/OpenSC/releases/tag/0.
ac4123255a4c796db96337f332160ad#diff-477b7a40136bb418b10ce271c8664536 - https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1 - https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ - https://access.redhat.com/errata/RHSA-2019:2154 - https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html
CVE ID: CVE-2018-16392 State: PUBLISHED Published: 2018-09-03T14:00:00 Last Updated: 2024-08-05T10:24:31.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-b2a356323a9ff2024d041cf2d7e89dd3 - https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-
3255a4c796db96337f332160ad#diff-b2a356323a9ff2024d041cf2d7e89dd3 - https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1 - https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ - https://access.redhat.com/errata/RHSA-2019:2154 - https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html
CVE ID: CVE-2018-16393 State: PUBLISHED Published: 2018-09-03T14:00:00 Last Updated: 2024-08-05T10:24:32.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1 - https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad - https://ww
/releases/tag/0.19.0-rc1 - https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad - https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ - https://access.redhat.com/errata/RHSA-2019:2154 - https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html
CVE ID: CVE-2018-16395 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T10:24:32.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate
he same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations. Additional Analyst Notes: - CVE Program Container: References: - https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/ - https://access.redhat.com/errata/RHSA-2018:3738 - https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://hackerone.com/reports/387250 - https://access.redhat.com/errata/RHSA-2018:3730 - https://access.redhat.com/erra
https://hackerone.com/reports/387250 - https://access.redhat.com/errata/RHSA-2018:3730 - https://access.redhat.com/errata/RHSA-2018:3731 - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/ - https://www.debian.org/security/2018/dsa-4332 - https://usn.ubuntu.com/3808-1/ - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/ - https://security.netapp.com/advisory/ntap-20190221-0002/ - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html - http://www.securitytracker.com/id/1042105 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/
com/id/1042105 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:1948 - https://access.redhat.com/errata/RHSA-2019:2565 - https://www.oracle.com/security-alerts/cpujan2020.html
CVE ID: CVE-2018-16396 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T10:24:32.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/385070 - https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://access.redhat.com/errata/RHSA-2018:3730 - https://access.redhat.com/errata/RHSA-2018:
om/errata/RHSA-2018:3729 - https://access.redhat.com/errata/RHSA-2018:3730 - https://access.redhat.com/errata/RHSA-2018:3731 - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/ - https://www.debian.org/security/2018/dsa-4332 - https://usn.ubuntu.com/3808-1/ - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/ - https://security.netapp.com/advisory/ntap-20190221-0002/ - https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/ - https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html - http://www.securitytracker.com/id/1042106 - htt
/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html - http://www.securitytracker.com/id/1042106 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028
CVE ID: CVE-2018-16397 State: PUBLISHED Published: 2018-09-03T15:00:00Z Last Updated: 2024-09-17T03:27:51.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file, Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/blob/3be9b41e76826b57f5860d18d93b23f47d59d2e4/docs/release_notes.txt#L51
CVE ID: CVE-2018-16398 State: PUBLISHED Published: 2018-09-03T19:00:00 Last Updated: 2024-08-05T10:24:31.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Twistlock AuthZ Broker 0.1, regular expressions are mishandled, as demonstrated by containers/aa/pause?aaa=\/start to bypass a policy in which "docker start" is allowed but "docker pause" is not allowed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/twistlock/authz/issues/50 - https://github.com/twistlock/authz/issues/51