Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-20012 State: PUBLISHED Published: 2018-12-10T09:00:00 Last Updated: 2024-08-05T11:51:18.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/copy_cat/phpcmf/blob/master/README.md - http://www.phpcmf.net/version-13.html
CVE ID: CVE-2018-20013 State: PUBLISHED Published: 2019-06-18T12:32:20 Last Updated: 2024-08-05T11:51:18.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::ProcessPacket metadata_id!=0 assertion, leading to shutting down the client application. Additional Analyst Notes: - CVE Program Container: References: - http://www.urbackup.org/client_changelog.html - https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2018-20013
CVE ID: CVE-2018-20014 State: PUBLISHED Published: 2019-06-07T15:57:43 Last Updated: 2024-08-05T11:51:18.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::GetFileHashAndMetadata NULL pointer dereference, leading to shutting down the client application. Additional Analyst Notes: - CVE Program Container: References: - http://www.urbackup.org/client_changelog.html - https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2018-20014
CVE ID: CVE-2018-20015 State: PUBLISHED Published: 2018-12-10T09:00:00 Last Updated: 2024-08-05T11:51:18.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: YzmCMS v5.2 has admin/role/add.html CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Jxysir/YZM-CSRF-
CVE ID: CVE-2018-20017 State: PUBLISHED Published: 2018-12-10T09:00:00 Last Updated: 2024-08-05T11:51:18.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/semcms/issues/1
CVE ID: CVE-2018-20018 State: PUBLISHED Published: 2018-12-10T09:00:00 Last Updated: 2024-08-05T11:51:18.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: S-CMS V3.0 has SQL injection via the S_id parameter, as demonstrated by the /1/?type=productinfo&S_id=140 URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/QQ704568679/-/blob/master/README.md
CVE ID: CVE-2018-20019 State: PUBLISHED Published: 2018-12-19T16:00:00 Last Updated: 2024-08-05T11:51:18.279Z Vendors: n/a Products: LibVNC Problem Types: Multiple Heap Out-of-Bound Description: LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4383 - https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-029-libvnc-multiple-heap-out-of-bound-vulnerabilities/ - https://
.com/advisories/klcert-advisories/2018/12/19/klcert-18-029-libvnc-multiple-heap-out-of-bound-vulnerabilities/ - https://usn.ubuntu.com/3877-1/ - https://security.gentoo.org/glsa/201908-05 - https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html - https://usn.ubuntu.com/4547-1/ - https://usn.ubuntu.com/4587-1/ - https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
CVE ID: CVE-2018-20020 State: PUBLISHED Published: 2018-12-19T16:00:00 Last Updated: 2024-08-05T11:51:18.295Z Vendors: n/a Products: LibVNC Problem Types: Heap Out-of-Bound write Description: LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4383 - https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html - https://usn.ubuntu.com/3877-1/ - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-
3877-1/ - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/ - https://security.gentoo.org/glsa/201908-05 - https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html - https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html - https://security.gentoo.org/glsa/202006-06 - https://usn.ubuntu.com/4547-1/ - https://usn.ubuntu.com/4547-2/ - https://usn.ubuntu.com/4587-1/
CVE ID: CVE-2018-20021 State: PUBLISHED Published: 2018-12-19T16:00:00 Last Updated: 2024-08-05T11:51:18.342Z Vendors: n/a Products: LibVNC Problem Types: Denial of Service Description: LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources like CPU and RAM Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4383 - https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-031-libvnc-infinite-loop/ - https
tml - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-031-libvnc-infinite-loop/ - https://usn.ubuntu.com/3877-1/ - https://security.gentoo.org/glsa/201908-05 - https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html - https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html - https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html - https://security.gentoo.org/glsa/202006-06 - https://usn.ubuntu.com/4547-1/ - https://usn.ubuntu.com/4547-2/ - https://usn.ubuntu.com/4587-1/
CVE ID: CVE-2018-20022 State: PUBLISHED Published: 2018-12-19T16:00:00 Last Updated: 2024-08-05T11:51:18.317Z Vendors: n/a Products: LibVNC Problem Types: Information disclosure Description: LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4383 - https://lists.debian.org/debian-lts-announce/2018/12/msg0
References: - https://www.debian.org/security/2019/dsa-4383 - https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-032-libvnc-multiple-memory-leaks/ - https://usn.ubuntu.com/3877-1/ - https://security.gentoo.org/glsa/201908-05 - https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html - https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html - https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html - https://security.gentoo.org/glsa/202006-06 - https://usn.ubuntu.com/4547-1/ - https://usn.ubuntu.com/4547-2/ - https://usn.ubuntu.com/4587-1/
CVE ID: CVE-2018-20023 State: PUBLISHED Published: 2018-12-19T16:00:00 Last Updated: 2024-08-05T11:51:18.305Z Vendors: n/a Products: LibVNC Problem Types: Information disclosure Description: LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-033-libvnc-memory-leak/ - https://w
: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-033-libvnc-memory-leak/ - https://www.debian.org/security/2019/dsa-4383 - https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html - https://usn.ubuntu.com/3877-1/ - https://security.gentoo.org/glsa/201908-05 - https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html - https://usn.ubuntu.com/4547-1/ - https://usn.ubuntu.com/4587-1/
CVE ID: CVE-2018-20024 State: PUBLISHED Published: 2018-12-19T16:00:00 Last Updated: 2024-08-05T11:51:18.329Z Vendors: n/a Products: LibVNC Problem Types: Denial of Service Description: LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that can result DoS. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4383 - https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-034-libvnc-null-pointer-dereference/ - https://usn.ubuntu.com/3877-1/ - https://security.gentoo.org/glsa/201908-05
t-18-034-libvnc-null-pointer-dereference/ - https://usn.ubuntu.com/3877-1/ - https://security.gentoo.org/glsa/201908-05 - https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html - https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html - https://security.gentoo.org/glsa/202006-06 - https://usn.ubuntu.com/4547-1/ - https://usn.ubuntu.com/4547-2/ - https://usn.ubuntu.com/4587-1/
CVE ID: CVE-2018-20025 State: PUBLISHED Published: 2019-02-19T21:00:00Z Last Updated: 2024-09-16T18:39:11.508Z Vendors: Kaspersky Lab Products: CODESYS V3 products Problem Types: Use of Insufficiently Random Values Description: Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106251 - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-037-codesys-control-v3-use-of-insufficiently-random-values/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04
CVE ID: CVE-2018-20026 State: PUBLISHED Published: 2019-02-19T21:00:00Z Last Updated: 2024-09-16T20:37:39.329Z Vendors: Kaspersky Lab Products: CODESYS V3 products Problem Types: Improper Communication Address Filtering Description: Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106251 - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-036-codesys-control-v3-improper-communication-address-filtering/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04
CVE ID: CVE-2018-20027 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:51:18.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: The yaml_parse.load method in Pylearn2 allows code injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lisa-lab/pylearn2/issues/1593
CVE ID: CVE-2018-20028 State: PUBLISHED Published: 2019-04-17T18:58:45 Last Updated: 2024-08-05T11:51:18.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/en/news.html - https://contao.org/en/news/security-vulnerability-cve-2018-20028.html
CVE ID: CVE-2018-20029 State: PUBLISHED Published: 2018-12-10T20:00:00Z Last Updated: 2024-09-16T20:53:16.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read. Additional Analyst Notes: - CVE Program Container: References: - https://www.nomachine.com/TR11P08975
CVE ID: CVE-2018-20030 State: PUBLISHED Published: 2019-02-20T17:00:00Z Last Updated: 2024-09-17T01:01:49.355Z Vendors: Flexera Software LLC Products: libexif Problem Types: DoS (Denial of Service) via CPU resource exhaustion Description: An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libexif/libexif/commit/6aa11df549114ebda520dde4cdaea2f9357b2c89 - https://secuniaresearch.flexerasoftware.com/secunia_research/2018-28/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html - h
asoftware.com/secunia_research/2018-28/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html - https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html - https://usn.ubuntu.com/4358-1/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
CVE ID: CVE-2018-20031 State: PUBLISHED Published: 2019-03-21T20:47:53 Last Updated: 2024-08-05T11:51:18.328Z Vendors: Flexera Software LLC Products: FlexNet Publisher Problem Types: DoS Description: A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon to stop, and the vendor daemon to shut down. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109155 - https://www.oracle.com/security-alerts/cp
CVE Program Container: References: - http://www.securityfocus.com/bid/109155 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://secuniaresearch.flexerasoftware.com/advisories/85979/
CVE ID: CVE-2018-20032 State: PUBLISHED Published: 2019-03-21T20:52:17 Last Updated: 2024-08-05T11:51:18.821Z Vendors: Flexera Software LLC Products: FlexNet Publisher Problem Types: DoS Description: A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon to stop, and the vendor daemon to shut down. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109155 - https://www.oracle.com/security-alerts/cpuoct2021
ram Container: References: - http://www.securityfocus.com/bid/109155 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://secuniaresearch.flexerasoftware.com/advisories/85979/
CVE ID: CVE-2018-20033 State: PUBLISHED Published: 2019-02-25T20:00:00Z Last Updated: 2024-09-17T02:11:14.068Z Vendors: Flexera Software LLC Products: FlexNet Publisher Problem Types: Remote Code Execution (RCE) Description: A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a remote attacker to corrupt the memory by allocating / deallocating memory, loading lmgrd or the vendor daemon and causing the heartbeat between lmgrd and the vendor daemon to stop. This would force the vendor daemon to shut down. No exploit of this vulnerability has been demonstrated. Additional Analyst Notes: - CVE Program Containe
n to shut down. No exploit of this vulnerability has been demonstrated. Additional Analyst Notes: - CVE Program Container: References: - https://secuniaresearch.flexerasoftware.com/advisories/85979/ - http://www.securityfocus.com/bid/109155 - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-20034 State: PUBLISHED Published: 2019-03-21T20:54:28 Last Updated: 2024-08-05T11:51:18.806Z Vendors: Flexera Software LLC Products: FlexNet Publisher Problem Types: DoS Description: A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon to stop, and the vendor daemon to shut down. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109155 - https://www.oracle.com/security-alerts/cp
CVE ID: CVE-2018-20050 State: PUBLISHED Published: 2018-12-10T22:00:00 Last Updated: 2024-08-05T11:51:18.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/iamweifan/jooan/blob/master/es_poc.py
CVE ID: CVE-2018-20051 State: PUBLISHED Published: 2018-12-10T22:00:00 Last Updated: 2024-08-05T11:51:18.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mishandling of '>' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via certain ONVIF methods such as CreateUsers, SetImagingSettings, GetStreamUri, and so on. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/iamweifan/jooan/blob/master/ss_poc.py
CVE ID: CVE-2018-20052 State: PUBLISHED Published: 2019-04-25T15:40:27 Last Updated: 2024-08-05T11:51:18.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities that could be used to escalate privileges to root. One example is the "sudo ln -s /tmp/script /etc/cron.hourly/script" command. Additional Analyst Notes: - CVE Program Container: References: - https://www.securifera.com/advisories/cve-2018-20052-20053/
CVE ID: CVE-2018-20053 State: PUBLISHED Published: 2019-04-25T15:43:56 Last Updated: 2024-08-05T11:51:18.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The hostname, timezone, and NTP server configurations on the CCE device are vulnerable to command injection by sending a crafted configuration file over the network. Additional Analyst Notes: - CVE Program Container: References: - https://www.securifera.com/advisories/cve-2018-20052-20053/
CVE ID: CVE-2018-20056 State: PUBLISHED Published: 2018-12-11T09:00:00 Last Updated: 2024-08-05T11:51:18.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-619%20stack%20overflow.md
CVE ID: CVE-2018-20057 State: PUBLISHED Published: 2018-12-11T09:00:00 Last Updated: 2024-08-05T11:51:18.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-619%20command%20execution.md
CVE ID: CVE-2018-20058 State: PUBLISHED Published: 2018-12-11T09:00:00 Last Updated: 2024-08-05T11:51:18.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634. Additional Analyst Notes: - CVE Program Container: References: - https://evernote.com/security/updates
CVE ID: CVE-2018-20059 State: PUBLISHED Published: 2018-12-11T10:00:00Z Last Updated: 2024-09-16T21:03:03.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pippo-java/pippo/issues/486
CVE ID: CVE-2018-20060 State: PUBLISHED Published: 2018-12-11T17:00:00 Last Updated: 2024-12-27T16:02:59.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/urllib3/urllib3/issues/1316 - https://github.com/urllib3/urllib3/pull/1346 - https://github.com/urllib3/urllib3/blob/master/CHANGES.rst - https://bugzilla
s://github.com/urllib3/urllib3/pull/1346 - https://github.com/urllib3/urllib3/blob/master/CHANGES.rst - https://bugzilla.redhat.com/show_bug.cgi?id=1649153 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/ - https://usn.ubuntu.com/3990-1/ - https://access.redhat.com/errata/RHSA-2019:2272 - http://lists.opensuse.org/opensuse-security-announce/2019-09
3990-1/ - https://access.redhat.com/errata/RHSA-2019:2272 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html - https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
CVE ID: CVE-2018-20061 State: PUBLISHED Published: 2018-12-11T17:00:00 Last Updated: 2024-08-05T11:51:18.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item
L queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/erpnext/issues/15337
CVE ID: CVE-2018-20062 State: PUBLISHED Published: 2018-12-11T18:00:00.000Z Last Updated: 2025-10-21T23:45:46.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nangge/noneCms/issues/21 - http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html