Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-19347 State: PUBLISHED Published: 2018-11-17T21:00:00Z Last Updated: 2024-09-16T19:04:29.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x00000000000d11bb" issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html - https://y
CVE ID: CVE-2018-19348 State: PUBLISHED Published: 2018-11-17T21:00:00Z Last Updated: 2024-09-16T22:36:26.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x000000000012dff5" issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html - https://y
ences: - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html - https://yan-1-20.github.io/2018/11/08/2018/11/2018-11-08/ - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/08/2018/11/2018-11-08/index.html - https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/
CVE ID: CVE-2018-19349 State: PUBLISHED Published: 2018-11-17T22:00:00 Last Updated: 2024-08-05T11:37:09.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Xmansec/seacms_vul/blob/master/SQL/README.md
CVE ID: CVE-2018-19350 State: PUBLISHED Published: 2018-11-17T22:00:00 Last Updated: 2024-08-05T11:37:09.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Xmansec/seacms_vul/tree/master/XSS
CVE ID: CVE-2018-19351 State: PUBLISHED Published: 2018-11-18T17:00:00 Last Updated: 2024-08-05T11:37:10.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/jupyter/hWzu2BSsplY - https://pypi.org/pr
CVE Program Container: References: - https://groups.google.com/forum/#%21topic/jupyter/hWzu2BSsplY - https://pypi.org/project/notebook/#history - https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst - https://github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491 - https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
CVE ID: CVE-2018-19352 State: PUBLISHED Published: 2018-11-18T17:00:00 Last Updated: 2024-08-05T11:37:10.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyter/notebook/commit/288b73e1edbf527740e273fcc69b889460871648 - https://pypi.org/project/notebook/#history - https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
CVE ID: CVE-2018-19353 State: PUBLISHED Published: 2018-11-18T17:00:00 Last Updated: 2024-08-05T11:37:09.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ansilove_ansi function in loaders/ansi.c in libansilove 1.0.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ansilove/libansilove/issues/4 - https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-libansilove-1.0.0
CVE ID: CVE-2018-19355 State: PUBLISHED Published: 2018-11-19T00:00:00 Last Updated: 2024-08-05T11:37:10.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via modules/orderfiles/upload.php with auptype equal to product (for upload destinations under modules/productfiles), order (for upload destinations under modules/files), or cart (for upload destinations under modules/cartfiles). Additional Analyst Notes: - CVE Program Container: References: - https://ia-informatica.com/it/CVE-2018-19355
CVE ID: CVE-2018-19357 State: PUBLISHED Published: 2018-12-24T06:00:00 Last Updated: 2024-08-05T11:37:09.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: XMPlay 3.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted http:// URL in a .m3u file. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/46020/
CVE ID: CVE-2018-19358 State: PUBLISHED Published: 2018-11-18T19:00:00Z Last Updated: 2024-09-17T01:40:52.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used. NOTE: the vendor disputes this because, according to the security model, untrusted applications must not be allowed to access the user's session bus socket. Additional Analyst Notes: - CVE P
l, untrusted applications must not be allowed to access the user's session bus socket. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1780365 - https://github.com/sungjungk/keyring_crack - https://www.youtube.com/watch?v=Do4E9ZQaPck - https://gitlab.gnome.org/GNOME/gnome-keyring/-/issues/5#note_1876550 - https://bugzilla.redhat.com/show_bug.cgi?id=1652194#c8
CVE ID: CVE-2018-19359 State: PUBLISHED Published: 2019-04-25T20:58:09 Last Updated: 2024-08-05T11:37:09.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/ - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54189
CVE ID: CVE-2018-19360 State: PUBLISHED Published: 2019-01-02T18:00:00 Last Updated: 2024-08-05T11:37:10.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FasterXML/jackson-databind/issues/2186 - https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html - https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8 - https://issues.apache.org/jira/browse/TINKERPOP-2121 - https://github.com/FasterXML
jackson/wiki/Jackson-Release-2.9.8 - https://issues.apache.org/jira/browse/TINKERPOP-2121 - https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b - https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E - https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://access.redhat.com/errata/RHSA-2019:0
ps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://access.redhat.com/errata/RHSA-2019:0782 - https://access.redhat.com/errata/RHSA-2019:0877 - https://access.redhat.com/errata/RHBA-2019:0959 - https://www.debian.org/security/2019/dsa-4452 - https://seclists.org/bugtraq/2019/May/68 - https://security.netapp.com/advisory/ntap-20190530-0003/ - https://access.redhat.com/errata/RHSA-2019:1782 - https://access.redhat.com/errata/RHSA-2019:1797 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - http://www.securityfocus.com/bid/107985 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - htt
com/bid/107985 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - https://access.redhat.com/errata/RHSA-2019:2804 - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:3002 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3140 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - http
ists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3892 - https://access.redhat.com/errata/RHSA-2019:4037 - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/r1b10
nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
CVE ID: CVE-2018-19361 State: PUBLISHED Published: 2019-01-02T18:00:00 Last Updated: 2024-08-05T11:37:11.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FasterXML/jackson-databind/issues/2186 - https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html - https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8 - https://issues.apache.org/jira/browse/TINKERPOP-2121 - https://github.com/FasterXML/jackson-dat
/Jackson-Release-2.9.8 - https://issues.apache.org/jira/browse/TINKERPOP-2121 - https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b - https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E - https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://access.redhat.com/errata/RHSA-2019:0782 - https:
cle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://access.redhat.com/errata/RHSA-2019:0782 - https://access.redhat.com/errata/RHSA-2019:0877 - https://access.redhat.com/errata/RHBA-2019:0959 - https://www.debian.org/security/2019/dsa-4452 - https://seclists.org/bugtraq/2019/May/68 - https://security.netapp.com/advisory/ntap-20190530-0003/ - https://access.redhat.com/errata/RHSA-2019:1782 - https://access.redhat.com/errata/RHSA-2019:1797 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - http://www.securityfocus.com/bid/107985 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - https://access.
85 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - https://access.redhat.com/errata/RHSA-2019:2804 - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:3002 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3140 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.ap
org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3892 - https://access.redhat.com/errata/RHSA-2019:4037 - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/r1b103833cb5bc846
org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
CVE ID: CVE-2018-19362 State: PUBLISHED Published: 2019-01-02T18:00:00 Last Updated: 2024-08-05T11:37:09.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FasterXML/jackson-databind/issues/2186 - https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html - https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8 - https://issues.apache.org/jira/browse/TINKERPOP-2121 - https://github.com/FasterXML/j
ckson/wiki/Jackson-Release-2.9.8 - https://issues.apache.org/jira/browse/TINKERPOP-2121 - https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b - https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E - https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://access.redhat.com/errata/RHSA-2019:078
://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://access.redhat.com/errata/RHSA-2019:0782 - https://access.redhat.com/errata/RHSA-2019:0877 - https://access.redhat.com/errata/RHBA-2019:0959 - https://www.debian.org/security/2019/dsa-4452 - https://seclists.org/bugtraq/2019/May/68 - https://security.netapp.com/advisory/ntap-20190530-0003/ - https://access.redhat.com/errata/RHSA-2019:1782 - https://access.redhat.com/errata/RHSA-2019:1797 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - http://www.securityfocus.com/bid/107985 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - https
m/bid/107985 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - https://access.redhat.com/errata/RHSA-2019:2804 - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:3002 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3140 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https:
ts.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3892 - https://access.redhat.com/errata/RHSA-2019:4037 - https://www.oracle.com/security-alerts/cpujan2020.html - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuap
9cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
CVE ID: CVE-2018-19364 State: PUBLISHED Published: 2018-12-13T19:00:00 Last Updated: 2024-08-05T11:37:10.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/01/msg00023.html - https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg01139.html - https://usn.ubuntu.com/3826-1/ - http://www.openwall.com/lists/oss-security/2018/11/20/1 - https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg02795.html - htt
openwall.com/lists/oss-security/2018/11/20/1 - https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg02795.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/ - http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html - https://www.debian.org/security/2019/dsa-4454 - https://seclists.org/bugtraq/2019/May/76
CVE ID: CVE-2018-19365 State: PUBLISHED Published: 2019-03-18T19:58:13 Last Updated: 2024-08-05T11:37:11.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt
CVE ID: CVE-2018-19367 State: PUBLISHED Published: 2018-11-20T09:00:00Z Last Updated: 2024-09-16T18:13:29.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lichti/shodan-portainer/ - https://github.com/portainer/portainer/issues/2475
CVE ID: CVE-2018-19370 State: PUBLISHED Published: 2018-11-28T22:00:00 Last Updated: 2024-08-05T11:37:11.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=nL141dcDGCY - https://wordpress.org/plugins/wordpress-seo/#developers - https://github.com/Yoast/wordpress-seo/pull/11502/commits/3bfa70a143f5ea3ee1934f3a1703bb5caf139ffa
CVE ID: CVE-2018-19371 State: PUBLISHED Published: 2019-01-02T18:00:00 Last Updated: 2024-08-05T11:37:11.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150826/SDL-Web-Content-Manager-8.5.0-XML-Injection.html - https://www.exploit-db.com/exploits/46000/
CVE ID: CVE-2018-19374 State: PUBLISHED Published: 2019-04-30T17:30:40 Last Updated: 2024-08-05T11:37:11.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory. Additional Analyst Notes: - CVE Program Container: References: - https://research.digitalinterruption.com/2019/04/15/privilege-escalation-in-manageengine-admanager-plus-6/
CVE ID: CVE-2018-19376 State: PUBLISHED Published: 2018-11-20T21:00:00 Last Updated: 2024-08-05T11:37:11.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clear URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GreenCMS/GreenCMS/issues/114
CVE ID: CVE-2018-19386 State: PUBLISHED Published: 2019-08-14T19:30:16 Last Updated: 2024-08-05T11:37:11.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. Additional Analyst Notes: - CVE Program Container: References: - https://i.imgur.com/Y7t2AD6.png - https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5