Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-15704 State: PUBLISHED Published: 2018-10-22T19:00:00Z Last Updated: 2024-09-16T19:15:55.882Z Vendors: Advantech Products: Advantech WebAccess Problem Types: Stack buffer overflow Description: Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability by sending a crafted HTTP request to broadweb/system/opcImg.asp. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-33
CVE ID: CVE-2018-15705 State: PUBLISHED Published: 2018-10-31T22:00:00Z Last Updated: 2024-09-16T17:59:24.977Z Vendors: Advantech Products: Advantech WebAccess Problem Types: Directory Traversal Description: WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45774/ - https://www.tenable.com/security/research/tra-2018-35
CVE ID: CVE-2018-15706 State: PUBLISHED Published: 2018-10-31T22:00:00Z Last Updated: 2024-09-17T02:15:57.656Z Vendors: Advantech Products: Advantech WebAccess Problem Types: Directory Traversal Description: WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-35
CVE ID: CVE-2018-15707 State: PUBLISHED Published: 2018-10-31T22:00:00Z Last Updated: 2024-09-16T22:50:29.453Z Vendors: Advantech Products: Advantech WebAccess Problem Types: Cross-site Scripting Description: Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45774/ - https://www.tenable.com/security/research/tra-2018-35
CVE ID: CVE-2018-15708 State: PUBLISHED Published: 2018-11-14T18:00:00Z Last Updated: 2024-09-17T01:55:50.961Z Vendors: Nagios Products: Nagios XI Problem Types: Command Injection Description: Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46221/ - https://www.tenable.com/security/research/tra-2018-37 - http://packetstormsecurity.com/files/153433/Nagios-XI-Magpie_debug.php-Root-Remote-Code-Execution.html
CVE ID: CVE-2018-15709 State: PUBLISHED Published: 2018-11-14T18:00:00Z Last Updated: 2024-09-17T02:11:03.837Z Vendors: Nagios Products: Nagios XI Problem Types: Command Injection Description: Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-37
CVE ID: CVE-2018-15710 State: PUBLISHED Published: 2018-11-14T18:00:00Z Last Updated: 2024-09-17T00:51:15.249Z Vendors: Nagios Products: Nagios XI Problem Types: Privilege Escalation Description: Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46221/ - https://www.tenable.com/security/research/tra-2018-37 - http://packetstormsecurity.com/files/153433/Nagios-XI-Magpie_debug.php-Root-Remote-Code-Execution.html
CVE ID: CVE-2018-15711 State: PUBLISHED Published: 2018-11-14T18:00:00Z Last Updated: 2024-09-17T01:37:03.880Z Vendors: Nagios Products: Nagios XI Problem Types: Privilege Escalation Description: Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-37
CVE ID: CVE-2018-15712 State: PUBLISHED Published: 2018-11-14T18:00:00Z Last Updated: 2024-09-16T19:09:54.638Z Vendors: Nagios Products: Nagios XI Problem Types: Cross Site Scripting Description: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-37
CVE ID: CVE-2018-15713 State: PUBLISHED Published: 2018-11-14T18:00:00Z Last Updated: 2024-09-17T01:56:44.865Z Vendors: Nagios Products: Nagios XI Problem Types: Cross Site Scripting Description: Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-37
CVE ID: CVE-2018-15714 State: PUBLISHED Published: 2018-11-14T18:00:00Z Last Updated: 2024-09-16T20:01:50.609Z Vendors: Nagios Products: Nagios XI Problem Types: Cross Site Scripting Description: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-37
CVE ID: CVE-2018-15715 State: PUBLISHED Published: 2018-11-30T20:00:00Z Last Updated: 2024-09-16T21:56:33.284Z Vendors: Zoom Products: Zoom Problem Types: CWE-290 Description: Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthorized message processing. A remote unauthenticated attacker can spoof UDP messages from a meeting attendee or Zoom server in order to invoke functionality in the target client. This allows the attacker to remove attendees from meetings, spoof messages from users, or hijack shared screens. Additional Analyst Notes: - CVE Program Container: References: - https://w
essages from users, or hijack shared screens. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-40
CVE ID: CVE-2018-15716 State: PUBLISHED Published: 2018-11-30T20:00:00Z Last Updated: 2024-09-16T17:28:51.627Z Vendors: NUUO Products: NUUO NVRMini2 Problem Types: CWE-78 Description: NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-41 - http://www.securityfocus.com/bid/106059 - https://github.com/tenable/poc/tree/master/nuuo/nvrmini2/cve_2018_15716 - https://www.exploit-db.com/exploits/45948/
CVE ID: CVE-2018-15717 State: PUBLISHED Published: 2018-12-12T19:00:00Z Last Updated: 2024-09-17T00:26:20.760Z Vendors: Open Dental Products: Open Dental Problem Types: CWE-916 Description: Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-44
CVE ID: CVE-2018-15718 State: PUBLISHED Published: 2018-12-12T19:00:00Z Last Updated: 2024-09-17T04:13:56.936Z Vendors: Open Dental Products: Open Dental Problem Types: CWE-200 Description: Open Dental before version 18.4 transmits the entire user database over the network when a remote unauthenticated user accesses the command prompt. This allows the attacker to gain access to usernames, password hashes, privilege levels, and more. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-44
CVE ID: CVE-2018-15719 State: PUBLISHED Published: 2018-12-12T19:00:00Z Last Updated: 2024-09-16T23:20:48.043Z Vendors: Open Dental Products: Open Dental Problem Types: CWE-255 Description: Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank password. This allows anyone on the network with access to the server to access all database information. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-44
CVE ID: CVE-2018-15720 State: PUBLISHED Published: 2018-12-20T21:00:00Z Last Updated: 2024-09-16T20:59:02.021Z Vendors: Logitech Products: Logitech Harmony Hub Problem Types: CWE-798 Description: Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-47
CVE ID: CVE-2018-15721 State: PUBLISHED Published: 2018-12-20T21:00:00Z Last Updated: 2024-09-17T02:26:25.523Z Vendors: Logitech Products: Logitech Harmony Hub Problem Types: CWE-287 Description: The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-47
CVE ID: CVE-2018-15722 State: PUBLISHED Published: 2018-12-20T21:00:00Z Last Updated: 2024-09-17T02:42:06.972Z Vendors: Logitech Products: Logitech Harmony Hub Problem Types: CWE-78 Description: The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-47
CVE ID: CVE-2018-15723 State: PUBLISHED Published: 2018-12-20T21:00:00Z Last Updated: 2024-09-17T02:10:50.517Z Vendors: Logitech Products: Logitech Harmony Hub Problem Types: CWE-346 Description: The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands (e.g. harmony.system?systeminfo). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2018-47
CVE ID: CVE-2018-15726 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-08-05T10:01:54.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Privilege Escalation Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877
CVE ID: CVE-2018-15727 State: PUBLISHED Published: 2018-08-29T15:00:00 Last Updated: 2024-08-05T10:01:54.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105184 - https://access.redhat.com/errata/RHSA-2019:0019 - https://access.redhat.com/errata/RHSA-2018:3829 - https://grafana.com/blog/2018/08/29/grafana-5.2.3-and-4.6.4-released-with-important-security-fix/
CVE ID: CVE-2018-15728 State: PUBLISHED Published: 2018-08-24T19:00:00 Last Updated: 2024-08-05T10:01:54.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version: 4.0.0, 4.1.2, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2 Additional Analyst Notes: - CVE Program Con
, 4.5.1, 5.0.0, 4.6.5, 5.0.1, 5.1.1, 5.5.0, 5.5.1. Fix Version: 6.0.0, 5.5.2 Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2018/Aug/49 - http://www.securityfocus.com/bid/105157 - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2018-15729 State: PUBLISHED Published: 2019-06-21T14:15:05 Last Updated: 2024-08-05T10:01:54.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x8000204B. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15730 State: PUBLISHED Published: 2019-06-21T14:11:48 Last Updated: 2024-08-05T10:01:54.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x80002067. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15731 State: PUBLISHED Published: 2019-06-21T14:10:51 Last Updated: 2024-08-05T10:01:54.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x8000205B. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15732 State: PUBLISHED Published: 2019-06-21T14:09:46 Last Updated: 2024-08-05T10:01:54.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x80002063. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15733 State: PUBLISHED Published: 2019-06-21T14:04:44 Last Updated: 2024-08-05T10:01:54.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a NULL Pointer Dereference vulnerability due to not validating the size of the output buffer value from IOCtl 0x80002028. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15734 State: PUBLISHED Published: 2019-06-21T14:03:12 Last Updated: 2024-08-05T10:01:54.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x8000206B. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15735 State: PUBLISHED Published: 2019-06-21T14:01:41 Last Updated: 2024-08-05T10:01:54.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x8000206F. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15736 State: PUBLISHED Published: 2019-06-21T14:00:40 Last Updated: 2024-08-05T10:01:54.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x8000204F. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15737 State: PUBLISHED Published: 2019-06-21T13:53:46 Last Updated: 2024-08-05T10:01:54.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x80002043. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15738 State: PUBLISHED Published: 2019-07-09T12:13:40 Last Updated: 2024-08-05T10:01:54.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the output buffer address value from IOCtl 0x8000205F. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net - https://www.greyhathacker.net/?p=1025
CVE ID: CVE-2018-15740 State: PUBLISHED Published: 2018-08-28T19:00:00 Last Updated: 2024-08-05T10:01:54.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45256/ - https://drive.google.com/open?id=0Bw8rxEHEov76a0hwbFFVLVRMMjYxc05VV2JYc21NLXJiSHhJ - https://drive.google.com/open?id=0Bw8rxEHEov76cUVxZUxWS3lIanZ1VjhxSVBhdHBHUmJ1dmhr - http://packetstormsecurity.com/files/149097/ManageEngine-ADManager-Plus-6.5.7-Cross-Site-Scripting.html
CVE ID: CVE-2018-15745 State: PUBLISHED Published: 2018-08-30T17:00:00 Last Updated: 2024-08-05T10:01:54.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45296/ - http://packetstormsecurity.com/files/149134/Argus-Surveillance-DVR-4.0.0.0-Directory-Traversal.html - http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt
CVE ID: CVE-2018-15746 State: PUBLISHED Published: 2018-08-29T19:00:00 Last Updated: 2024-08-05T10:01:54.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/08/28/6 - https://lists.gnu.org/archive/html/qemu-devel/2018-08/msg04892.html - https://access.redhat.com/errata/RHSA-2019:2425
CVE ID: CVE-2018-15747 State: PUBLISHED Published: 2019-06-21T13:06:54 Last Updated: 2024-08-05T10:01:54.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prasmussen/glot-code-runner/issues/15
CVE ID: CVE-2018-15748 State: PUBLISHED Published: 2018-08-23T15:00:00Z Last Updated: 2024-09-17T02:56:43.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(2335dn MFP) 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the HTML source code of the Email Settings webpage. In some cases, authentication can be achieved with the blank default password for the admin account. NOTE: the vendor indicates that this is an "End Of Support Life" product. Additional Analyst Notes: - C
e admin account. NOTE: the vendor indicates that this is an "End Of Support Life" product. Additional Analyst Notes: - CVE Program Container: References: - https://www.gerrenmurphy.com/dell-2335dn-password-disclosure/
CVE ID: CVE-2018-15749 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-08-05T10:01:54.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877
CVE ID: CVE-2018-15750 State: PUBLISHED Published: 2018-10-24T22:00:00 Last Updated: 2024-08-05T10:01:54.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server. Additional Analyst Notes: - CVE Program Container: References: - https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html - https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html - https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ - https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ - http://li
sg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ - https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html - https://usn.ubuntu.com/4459-1/
CVE ID: CVE-2018-15751 State: PUBLISHED Published: 2018-10-24T22:00:00 Last Updated: 2024-08-05T10:01:54.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). Additional Analyst Notes: - CVE Program Container: References: - https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html - https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html - https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ - https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ - http://lists.opensuse.org/o
cJ0UXxs/qgDj42obBQAJ - https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html - https://usn.ubuntu.com/4459-1/
CVE ID: CVE-2018-15752 State: PUBLISHED Published: 2018-10-02T18:00:00 Last Updated: 2024-08-05T10:01:54.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. Cleartext Transmission of Sensitive Information allows man-in-the-middle attackers to eavesdrop authentication information between the application and the server. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.e2security.de/2018/E2SA-2018-01.txt - https://seclists.org/bugtraq/2018/Oct/3