Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-20647 State: PUBLISHED Published: 2019-03-20T19:23:48 Last Updated: 2024-08-05T12:05:17.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cvehttps://gkaim.com/cve-2018-20647-vikas-chaudhary/
CVE ID: CVE-2018-20648 State: PUBLISHED Published: 2019-03-20T19:26:04 Last Updated: 2024-08-05T12:05:17.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-20648-vikas-chaudhary/
CVE ID: CVE-2018-20650 State: PUBLISHED Published: 2019-01-01T16:00:00 Last Updated: 2024-08-05T12:05:17.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/704 - https://gitlab.freedesktop.org/poppler/poppler/commit/de0c0b8324e776f0b851485e0fc9622fc35695b7 - http://www.securityfocus.com/bid/106459 - https://usn.ubuntu.com/3865-1/ - ht
de0c0b8324e776f0b851485e0fc9622fc35695b7 - http://www.securityfocus.com/bid/106459 - https://usn.ubuntu.com/3865-1/ - https://access.redhat.com/errata/RHSA-2019:2022 - https://access.redhat.com/errata/RHSA-2019:2713 - https://lists.debian.org/debian-lts-announce/2019/09/msg00033.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html - https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html
CVE ID: CVE-2018-20651 State: PUBLISHED Published: 2019-01-01T16:00:00 Last Updated: 2024-08-05T12:05:17.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference was discovered in elf_link_add_object_symbols in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.1. This occurs for a crafted ET_DYN with no program headers. A specially crafted ELF file allows remote attackers to cause a denial of service, as demonstrated by ld. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106440 - https://sourceware.org/bugzilla/show_bug.cgi?id=24041 - https://sourceware.or
http://www.securityfocus.com/bid/106440 - https://sourceware.org/bugzilla/show_bug.cgi?id=24041 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=54025d5812ff100f5f0654eb7e1ffd50f2e37f5f - https://support.f5.com/csp/article/K38336243 - https://security.gentoo.org/glsa/201908-01 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-20652 State: PUBLISHED Published: 2019-01-01T16:00:00 Last Updated: 2024-08-05T12:05:17.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: An attempted excessive memory allocation was discovered in the function tinyexr::AllocateImage in tinyexr.h in tinyexr v0.9.5. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted input, which leads to an out-of-memory exception. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/syoyo/tinyexr/issues/104
CVE ID: CVE-2018-20655 State: PUBLISHED Published: 2019-06-14T17:02:57 Last Updated: 2024-08-05T12:05:17.701Z Vendors: Facebook Products: WhatsApp for iOS, WhatsApp Business for iOS Problem Types: CWE-121 Description: When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for iOS prior to v2.18.90.24 and WhatsApp Business for iOS prior to v2.18.90.24. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2018-20655/ - http://www.securityfocus.com/bid/108805
CVE ID: CVE-2018-20657 State: PUBLISHED Published: 2019-01-02T14:00:00 Last Updated: 2024-08-05T12:05:17.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106444 - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539 - https://support.f5.com/csp/article/K62602089 - https://access.redhat.com/errata/RHSA-2019:3352
CVE ID: CVE-2018-20658 State: PUBLISHED Published: 2019-01-02T15:00:00Z Last Updated: 2024-09-16T19:40:29.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon crash) via a crafted XRMD command. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45091 - http://coreftp.com/forums/viewtopic.php?f=15&t=4022509
CVE ID: CVE-2018-20659 State: PUBLISHED Published: 2019-01-02T17:00:00 Last Updated: 2024-08-05T12:05:17.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1-627. The AP4_StcoAtom class in Core/Ap4StcoAtom.cpp has an attempted excessive memory allocation when called from AP4_AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp, as demonstrated by mp42hls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/350
CVE ID: CVE-2018-20662 State: PUBLISHED Published: 2019-01-03T13:00:00 Last Updated: 2024-08-05T12:05:17.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/706 - https://lists.debian.org/debian-lts-announce/2019/03/msg00008.html - https://gitlab.freedesktop.org/poppler/p
sues/706 - https://lists.debian.org/debian-lts-announce/2019/03/msg00008.html - https://gitlab.freedesktop.org/poppler/poppler/commit/9fd5ec0e6e5f763b190f2a55ceb5427cfe851d5f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BI7NLDN2HUEU4ZW3D7XPHOAEGT2CKDRO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ6RABASMSIMMWMDZTP6ZWUWZPTBSVB5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWP5XSUG6GNRI75NYKF53KIB2CZY6QQ6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OSCOYM3AMFFBJWSBWY6VJVLNE5
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OSCOYM3AMFFBJWSBWY6VJVLNE5JD7YS/ - https://usn.ubuntu.com/4042-1/ - https://access.redhat.com/errata/RHSA-2019:2022 - https://access.redhat.com/errata/RHSA-2019:2713 - https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html
CVE ID: CVE-2018-20663 State: PUBLISHED Published: 2019-01-03T18:00:00Z Last Updated: 2024-09-17T00:42:36.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cuba-platform/reports/issues/140
CVE ID: CVE-2018-20664 State: PUBLISHED Published: 2019-01-03T18:00:00 Last Updated: 2024-08-05T12:05:17.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html#5701 - https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20664/
CVE ID: CVE-2018-20669 State: PUBLISHED Published: 2019-03-18T16:33:59 Last Updated: 2024-08-05T12:05:17.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106748 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/drivers/
- http://www.securityfocus.com/bid/106748 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/i915/i915_gem_execbuffer.c - http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00042.html - http://www.openwall.com/lists/oss-security/2019/01/23/6 - https://access.redhat.com/security/cve/cve-2018-20669 - https://security.netapp.com/advisory/ntap-20190404-0002/ - https://support.f5.com/csp/article/K32059550 - https://usn.ubuntu.com/4485-1/
CVE ID: CVE-2018-20671 State: PUBLISHED Published: 2019-01-04T16:00:00 Last Updated: 2024-08-05T12:05:17.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=11fa9f134fd658075c6f74499c780df045d9e9ca - http://www.securityfocus.com/bid/106457 - https://sourceware.org/bugzilla/show_bug.cgi?id=24005 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html
rceware.org/bugzilla/show_bug.cgi?id=24005 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-20673 State: PUBLISHED Published: 2019-01-04T17:00:00 Last Updated: 2024-08-05T12:05:17.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=24039 - http://www.securityfocus.com/bid/106454
CVE ID: CVE-2018-20674 State: PUBLISHED Published: 2019-01-09T00:00:00Z Last Updated: 2024-09-16T20:32:52.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow authenticated remote command execution. Additional Analyst Notes: - CVE Program Container: References: - https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101
CVE ID: CVE-2018-20675 State: PUBLISHED Published: 2019-01-09T00:00:00Z Last Updated: 2024-09-17T01:21:23.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10101
CVE ID: CVE-2018-20676 State: PUBLISHED Published: 2019-01-09T05:00:00 Last Updated: 2024-08-05T12:05:17.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/twbs/bootstrap/issues/27044 - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906 - https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ - https://github.com/twbs/bootstrap/pull/27047 - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628 - https://access.redhat.com/errata/RHSA-2019:1456 - https://access.redhat.com/errata/
ssues/27915#issuecomment-452196628 - https://access.redhat.com/errata/RHSA-2019:1456 - https://access.redhat.com/errata/RHBA-2019:1076 - https://access.redhat.com/errata/RHBA-2019:1570 - https://access.redhat.com/errata/RHSA-2019:3023 - https://access.redhat.com/errata/RHSA-2020:0132 - https://access.redhat.com/errata/RHSA-2020:0133 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://www.tenable.com/security/tns-2021-14
CVE ID: CVE-2018-20677 State: PUBLISHED Published: 2019-01-09T05:00:00 Last Updated: 2024-08-05T12:05:17.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906 - https://github.com/twbs/bootstrap/issues/27045 - https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ - https://github.com/twbs/bootstrap/pull/27047 - https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628 - https://access.redhat.com/errata/RHSA-2019:1456 - https://access.redhat.com/err
ap/issues/27915#issuecomment-452196628 - https://access.redhat.com/errata/RHSA-2019:1456 - https://access.redhat.com/errata/RHBA-2019:1076 - https://access.redhat.com/errata/RHBA-2019:1570 - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3023 - https://access.redhat.com/errata/RHSA-2020:0132 - https://access.redhat.com/errata/RHSA-2020:0133 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://www.tenable.com/security/tns-2021-14
CVE ID: CVE-2018-20678 State: PUBLISHED Published: 2019-03-28T15:21:28 Last Updated: 2024-08-05T12:05:17.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search. Additional Analyst Notes: - CVE Program Container: References: - https://cert.enea.pl/advisories/cert-190101.html - https://github.com/librenms/librenms/commits/master/html/ajax_table.php
CVE ID: CVE-2018-20679 State: PUBLISHED Published: 2019-01-09T16:00:00.000Z Last Updated: 2025-06-09T15:26:04.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1a
am Container: - CISA ADP Vulnrichment: References: - https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c - https://busybox.net/news.html - https://bugs.busybox.net/show_bug.cgi?id=11506 - https://usn.ubuntu.com/3935-1/ - http://seclists.org/fulldisclosure/2019/Sep/7 - https://seclists.org/bugtraq/2019/Sep/7 - http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
CVE ID: CVE-2018-20680 State: PUBLISHED Published: 2019-01-09T17:00:00 Last Updated: 2024-08-05T12:05:17.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/22
CVE ID: CVE-2018-20681 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:05:17.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By unplugging and re-plugging or power-cycling external output devices (such as additionally attached graphical outputs via HDMI, VGA, DVI, etc.) the content of a screensaver-locked session can be revealed. In some scenarios, the attacker can execute applications, such as by clicking with a mouse. Additional Analyst Notes: - CVE Program Container: References: - https://gith
cations, such as by clicking with a mouse. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mate-desktop/mate-screensaver/pull/167 - https://github.com/mate-desktop/mate-screensaver/issues/170 - https://github.com/mate-desktop/mate-screensaver/issues/152 - https://github.com/mate-desktop/mate-screensaver/issues/155
CVE ID: CVE-2018-20682 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:05:17.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section). Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ns-18-032-stored-cross-site-scripting-in-forkcms/
CVE ID: CVE-2018-20683 State: PUBLISHED Published: 2019-01-10T01:00:00 Last Updated: 2024-08-05T12:05:17.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sitaramc/gitolite/commit/5df2b817255ee919991da6c310239e08c8fcc1ae - https://bugs.debian.org/918849 - https://github.com/sitaramc/gitolite/blob/master/CHANGELOG - https://groups.google.com/forum/#%21topic/gitolite-announce/6xbjjmpLeP
hub.com/sitaramc/gitolite/blob/master/CHANGELOG - https://groups.google.com/forum/#%21topic/gitolite-announce/6xbjjmpLePQ
CVE ID: CVE-2018-20684 State: PUBLISHED Published: 2019-01-10T21:00:00 Last Updated: 2024-08-05T12:05:17.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106526 - https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54 - https://winscp.net/eng/docs/history - https://winscp.net/tracker/1675 - https://sintonen.fi/advisories/scp-cl
6bf16f54 - https://winscp.net/eng/docs/history - https://winscp.net/tracker/1675 - https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt - https://www.oracle.com/security-alerts/cpujan2020.html
CVE ID: CVE-2018-20685 State: PUBLISHED Published: 2019-01-10T00:00:00 Last Updated: 2024-08-05T12:05:17.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4387 - https://usn.ubuntu.com/3885-1/ - https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2 - https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/
sh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2 - https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h - https://security.netapp.com/advisory/ntap-20190215-0001/ - http://www.securityfocus.com/bid/106531 - https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt - https://security.gentoo.org/glsa/201903-16 - https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3702 - https://security.gentoo.org/glsa/202007-53 - http
t2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3702 - https://security.gentoo.org/glsa/202007-53 - https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
CVE ID: CVE-2018-20686 State: REJECTED Published: 2021-09-17T18:43:48 Last Updated: 2021-09-17T18:43:48 Description: No description available.
CVE ID: CVE-2018-20687 State: PUBLISHED Published: 2019-11-18T18:12:12 Last Updated: 2024-08-05T12:05:17.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html - http://seclists.org/fulldisclosure/2019/Nov/11
CVE ID: CVE-2018-20698 State: PUBLISHED Published: 2019-04-09T17:06:00 Last Updated: 2024-08-05T12:05:17.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set. Additional Analyst Notes: - CVE Program Container: References: - https://docs.search-guard.com/latest/changelog-kibana-6.x-16 - https://github.com/floragunncom/search-guard-kibana-plugin/pull/140
CVE ID: CVE-2018-20699 State: PUBLISHED Published: 2019-01-12T02:00:00 Last Updated: 2024-08-05T12:05:17.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/docker/engine/pull/70 - https://github.com/moby/moby/pull/37967 - https://access.redhat.com/errata/RHSA-2019:0487
CVE ID: CVE-2018-20703 State: PUBLISHED Published: 2019-01-13T15:00:00Z Last Updated: 2024-09-16T17:03:41.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ns-18-025-reflected-cross-site-scripting-in-cubecart/
CVE ID: CVE-2018-20710 State: REJECTED Published: 2019-03-07T22:00:00 Last Updated: 2019-04-15T17:46:17 Description: No description available.