Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-5315 State: PUBLISHED Published: 2018-01-12T17:00:00 Last Updated: 2024-08-05T05:33:44.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145833/WordPress-Events-Calendar-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/43479/
CVE ID: CVE-2018-5316 State: PUBLISHED Published: 2018-01-09T22:00:00Z Last Updated: 2024-09-16T22:08:56.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/145459/WordPress-Sagepay-Server-Gateway-For-WooCommerce-1.0.7-XSS.html - https://wordpress.org/support/topic/sagepay-server-gateway-for-woocommerce-1-0-7-cross-site-scripting/#post-9792337 - https://wordpress.org/plugins/sagepay-server-gateway-for-woocommerce/#developers
CVE ID: CVE-2018-5319 State: PUBLISHED Published: 2018-01-24T15:00:00 Last Updated: 2024-08-05T05:33:43.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43856/
CVE ID: CVE-2018-5326 State: PUBLISHED Published: 2018-01-12T02:00:00 Last Updated: 2024-08-05T05:33:44.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cheetah Mobile CM Browser 5.22.06.0012, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/mishradhiraj_/status/950975902892150785
CVE ID: CVE-2018-5327 State: PUBLISHED Published: 2018-01-12T02:00:00 Last Updated: 2024-08-05T05:33:44.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cheetah Mobile Armorfly Browser & Downloader 1.1.05.0010, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/mishradhiraj_/status/950975902892150785
CVE ID: CVE-2018-5328 State: PUBLISHED Published: 2018-01-15T21:00:00 Last Updated: 2024-08-05T05:33:44.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse these functionalities to perform unauthorized actions, as demonstrated by Edit User Details. Additional Analyst Notes: - CVE Program Container: References: - https://becomepentester.blogspot.com/2018/01/ZUUSE-BEIMS-ContractorWeb-Privilege-Escalations-CVE-2018-5328.html
CVE ID: CVE-2018-5329 State: PUBLISHED Published: 2018-01-15T21:00:00 Last Updated: 2024-08-05T05:33:44.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) on /CWEBNET/* authenticated pages. A successful CSRF attack can force the user to modify state: creating users, changing an email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. Additional Analyst Notes: - CVE Program Container: References: - https://becomepentester.blogspot.com/2018/01/ZUUSE-BEIMS-ContractorWeb-CSRF-CVE-2018-5329.html
CVE ID: CVE-2018-5330 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T05:33:43.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (router unreachable/unresponsive) via a flood of fragmented UDP packets. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145863/ZyXEL-P-660HW-UDP-Denial-Of-Service.html
CVE ID: CVE-2018-5331 State: PUBLISHED Published: 2018-01-10T09:00:00 Last Updated: 2024-08-05T05:33:44.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php, as demonstrated by a mod=space do=poll request to home.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.whsgwl.net/text.php?textid=32
CVE ID: CVE-2018-5332 State: PUBLISHED Published: 2018-01-11T07:00:00 Last Updated: 2024-08-05T05:33:43.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c). Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c095508770aebf1b9218e77026e48345d719b17c - https://www.debian.org/security/2018/dsa-4187 - https://github.com/torvalds/linux/commit/c095508770aebf1
48345d719b17c - https://www.debian.org/security/2018/dsa-4187 - https://github.com/torvalds/linux/commit/c095508770aebf1b9218e77026e48345d719b17c - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://usn.ubuntu.com/3617-3/ - https://usn.ubuntu.com/3632-1/ - https://usn.ubuntu.com/3620-2/ - http://www.securityfocus.com/bid/102507 - https://access.redhat.com/errata/RHSA-2018:0470 - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3617-2/ - https://usn.ubuntu.com/3620-1/ - https://usn.ubuntu.com/3619-1/ - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=60daca9efbb3e4109ebc1f7069543e5573fc124e
CVE ID: CVE-2018-5333 State: PUBLISHED Published: 2018-01-11T07:00:00 Last Updated: 2024-08-05T05:33:43.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4187 - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://usn.ubuntu.com/3617-3/ - https://usn.ubuntu.com/3583-2/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/comm
buntu.com/3617-3/ - https://usn.ubuntu.com/3583-2/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7d11f77f84b27cef452cee332f4e469503084737 - https://usn.ubuntu.com/3632-1/ - https://usn.ubuntu.com/3583-1/ - http://www.securityfocus.com/bid/102510 - https://access.redhat.com/errata/RHSA-2018:0470 - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3617-2/ - https://github.com/torvalds/linux/commit/7d11f77f84b27cef452cee332f4e469503084737 - https://usn.ubuntu.com/3619-1/ - http://packetstormsecurity.com/files/156053/Reliable-Datagram-Sockets-RDS-rds_atomic_free_op-Privilege-Escalation.html
CVE ID: CVE-2018-5334 State: PUBLISHED Published: 2018-01-11T21:00:00 Last Updated: 2024-08-05T05:33:44.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timestamp bounds checks. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14297 - https://lists.debian.org/debian-lts-announce/2018/01/msg00032.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=dc308c05ba0673460fe80873b22d296880ee996d - http://www.securityfocus.com/bid/102499 - htt
?p=wireshark.git%3Ba=commit%3Bh=dc308c05ba0673460fe80873b22d296880ee996d - http://www.securityfocus.com/bid/102499 - https://www.debian.org/security/2018/dsa-4101 - https://www.wireshark.org/security/wnpa-sec-2018-03.html
CVE ID: CVE-2018-5335 State: PUBLISHED Published: 2018-01-11T21:00:00 Last Updated: 2024-08-05T05:33:44.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102500 - https://lists.debian.org/debian-lts-announce/2018/01/msg00032.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=086b87376b988c555484349aa115d6e08ac6db07 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14251 - https:/
ommit%3Bh=086b87376b988c555484349aa115d6e08ac6db07 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14251 - https://www.debian.org/security/2018/dsa-4101 - https://www.wireshark.org/security/wnpa-sec-2018-04.html
CVE ID: CVE-2018-5336 State: PUBLISHED Published: 2018-01-11T21:00:00 Last Updated: 2024-08-05T05:33:44.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/01/msg00032.html - http://www.securityfocus.com/bid/102504 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=4f4c95cf46ba6adbd10b09747e10742801bc706b - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=co
Ba=commit%3Bh=4f4c95cf46ba6adbd10b09747e10742801bc706b - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f6702e49a9720d173246668495eece6d77eca5b0 - https://www.wireshark.org/security/wnpa-sec-2018-01.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14253 - https://www.debian.org/security/2018/dsa-4101
CVE ID: CVE-2018-5337 State: PUBLISHED Published: 2018-04-18T08:00:00 Last Updated: 2024-08-05T05:33:43.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing scripts. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/
CVE ID: CVE-2018-5338 State: PUBLISHED Published: 2018-04-18T08:00:00 Last Updated: 2024-08-05T05:33:43.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/
CVE ID: CVE-2018-5339 State: PUBLISHED Published: 2018-04-18T08:00:00 Last Updated: 2024-08-05T05:33:44.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/query-restriction-bypass-vulnerability.html - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/
CVE ID: CVE-2018-5340 State: PUBLISHED Published: 2018-04-18T08:00:00 Last Updated: 2024-08-05T05:33:43.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account (specifically, an account with permission to write to the filesystem via SQL queries). Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/query-restriction-bypass-vulnerability.html - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/
CVE ID: CVE-2018-5341 State: PUBLISHED Published: 2018-04-18T08:00:00 Last Updated: 2024-08-05T05:33:44.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/
CVE ID: CVE-2018-5342 State: PUBLISHED Published: 2018-04-18T08:00:00 Last Updated: 2024-08-05T05:33:43.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services (Desktop Central and PostgreSQL) running with a superuser account. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/
CVE ID: CVE-2018-5344 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:43.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://usn.ubuntu.com/3617-3/ - http://www.securityfocus.com/bid/102503 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/l
sn.ubuntu.com/3617-3/ - http://www.securityfocus.com/bid/102503 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5 - https://usn.ubuntu.com/3583-2/ - https://usn.ubuntu.com/3632-1/ - https://access.redhat.com/errata/RHSA-2018:2948 - https://usn.ubuntu.com/3583-1/ - https://usn.ubuntu.com/3617-2/ - https://access.redhat.com/errata/RHSA-2018:3096 - https://usn.ubuntu.com/3619-1/ - https://github.com/torvalds/linux/commit/ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5
CVE ID: CVE-2018-5345 State: PUBLISHED Published: 2018-01-12T00:00:00 Last Updated: 2024-08-05T05:33:43.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0350 - https://usn.ubuntu.com/3546-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1527296 - https://www.debian.org/security/2018/dsa-4095
CVE ID: CVE-2018-5347 State: PUBLISHED Published: 2018-01-12T01:00:00 Last Updated: 2024-08-05T05:33:44.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43659/ - https://blogs.securiteam.com/index.php/archives/3548
CVE ID: CVE-2018-5349 State: PUBLISHED Published: 2018-03-22T16:00:00 Last Updated: 2024-08-05T05:33:43.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been found in Heimdal PRO v2.2.190, but it is most likely also present in Heimdal FREE and Heimdal CORP. Faulty permissions on the directory "C:\ProgramData\Heimdal Security\Heimdal Agent" allow BUILTIN\Users to write new files to the directory. On startup, the process Heimdal.MonitorServices.exe running as SYSTEM will attempt to load version.dll from this directory. Placing a malicious version.dll in this directory will result in privilege escalation. NOTE: any affected Heimdal products are completely unre
rsion.dll in this directory will result in privilege escalation. NOTE: any affected Heimdal products are completely unrelated to the Heimdal vendor of a Kerberos 5 product on the h5l.org web site. Additional Analyst Notes: - CVE Program Container: References: - https://improsec.com/blog/heimdal-advisory-1
CVE ID: CVE-2018-5353 State: PUBLISHED Published: 2020-09-29T20:07:22 Last Updated: 2024-08-05T05:33:44.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a mi
vel Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html - http://zoho.com - https://github.com/missing0x00/CVE-2018-5353
CVE ID: CVE-2018-5354 State: PUBLISHED Published: 2020-09-29T19:54:52 Last Updated: 2024-08-05T05:33:44.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additio
nLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additional Analyst Notes: - CVE Program Container: References: - http://anixis.com - https://github.com/missing0x00/CVE-2018-5354
CVE ID: CVE-2018-5357 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - http://www.securityfocus.com/bid/102497 - https://github.com/ImageMagick/ImageMagick/issues/941
CVE ID: CVE-2018-5358 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/939
CVE ID: CVE-2018-5359 State: PUBLISHED Published: 2018-01-23T18:00:00 Last Updated: 2024-08-05T05:33:44.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43588/ - http://packetstormsecurity.com/files/145900/SysGauge-Server-3.6.18-Buffer-Overflow.html
CVE ID: CVE-2018-5360 State: PUBLISHED Published: 2018-01-14T02:00:00 Last Updated: 2024-08-05T05:33:44.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/540/ - https://gitlab.com/libtiff/libtiff/commit/739dcd28a061738b317c1e9f91029d9cbc157159 - http://bugzilla.maptools.org/show_bug.cgi?id=2500
CVE ID: CVE-2018-5361 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md - https://wpvulndb.com/vulnerabilities/9003
CVE ID: CVE-2018-5362 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md - https://wpvulndb.com/vulnerabilities/9003
CVE ID: CVE-2018-5363 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md - https://wpvulndb.com/vulnerabilities/9003
CVE ID: CVE-2018-5364 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md - https://wpvulndb.com/vulnerabilities/9003
CVE ID: CVE-2018-5365 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md - https://wpvulndb.com/vulnerabilities/9003
CVE ID: CVE-2018-5366 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md - https://wpvulndb.com/vulnerabilities/9003