Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-7448 State: PUBLISHED Published: 2018-02-26T17:00:00 Last Updated: 2024-08-05T06:24:12.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44192/ - https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html - http://dev.cmsmadesimple.org/project/changelog/5471
CVE ID: CVE-2018-7449 State: PUBLISHED Published: 2018-03-04T01:00:00 Last Updated: 2024-08-05T06:24:11.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or RETR command. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44221/ - http://hyp3rlinx.altervista.org/advisories/SEGGER-embOS-FTP-SERVER-v3.22-FTP-COMMANDS-DENIAL-OF-SERVICE.txt
CVE ID: CVE-2018-7452 State: PUBLISHED Published: 2018-02-24T06:00:00 Last Updated: 2024-08-05T06:24:12.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in JPXStream::fillReadBuf in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=613
CVE ID: CVE-2018-7453 State: PUBLISHED Published: 2018-02-24T06:00:00 Last Updated: 2024-08-05T06:24:12.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infinite recursion in AcroForm::scanField in AcroForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file due to lack of loop checking, as demonstrated by pdftohtml. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?p=814#p814
CVE ID: CVE-2018-7454 State: PUBLISHED Published: 2018-02-24T06:00:00 Last Updated: 2024-08-05T06:24:12.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in XFAForm::scanFields in XFAForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=613
CVE ID: CVE-2018-7455 State: PUBLISHED Published: 2018-02-24T06:00:00 Last Updated: 2024-08-05T06:24:11.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read in JPXStream::readTilePart in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=654&p=819#p819
CVE ID: CVE-2018-7456 State: PUBLISHED Published: 2018-02-24T06:00:00 Last Updated: 2024-08-05T06:24:12.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.) Additional Analyst Notes: - CVE Program
TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.) Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/04/msg00011.html - https://usn.ubuntu.com/3864-1/ - https://www.debian.org/security/2018/dsa-4349 - https://github.com/xiaoqx/pocs/tree/master/libtiff - http://bugzilla.maptools.org/show_bug.cgi?id=2778 - https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html - https://lists.debian.org/debian-lts-announce/2018/04/msg00010.html - https://gitlab.com/libtiff/libtiff/commit/be4c85b16e8801a16eec25e80eb9f3dd6a96731b - https://access.redhat.com/errata/RHSA-2019:2051 - https://access.redhat.com/
/be4c85b16e8801a16eec25e80eb9f3dd6a96731b - https://access.redhat.com/errata/RHSA-2019:2051 - https://access.redhat.com/errata/RHSA-2019:2053
CVE ID: CVE-2018-7463 State: PUBLISHED Published: 2018-02-26T13:00:00 Last Updated: 2024-08-05T06:24:12.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2018020278
CVE ID: CVE-2018-7465 State: PUBLISHED Published: 2018-04-26T19:00:00 Last Updated: 2024-08-05T06:24:12.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS. Additional Analyst Notes: - CVE Program Container: References: - https://imgur.com/a/Hf6JD - https://www.exploit-db.com/exploits/44625/ - http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-en
- https://www.exploit-db.com/exploits/44625/ - http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handling
CVE ID: CVE-2018-7466 State: PUBLISHED Published: 2018-02-25T07:00:00 Last Updated: 2024-08-05T06:24:11.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44226/ - https://www.exploit-db.com/exploits/44349/ - https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/9696012eecbafb0aa21cc346234512c29b474679
CVE ID: CVE-2018-7467 State: PUBLISHED Published: 2018-02-27T21:00:00 Last Updated: 2024-08-05T06:24:11.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.projectxit.com.au/blog/2018/2/27/axxonsoft-client-directory-traversal-cve-2018-7467-axxonsoft-axxon-next-axxonsoft-client-directory-traversal-via-an-initial-css2f-substring-in-a-uri-cve-2018-7467
CVE ID: CVE-2018-7469 State: PUBLISHED Published: 2018-02-28T15:00:00 Last Updated: 2024-08-05T06:24:11.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p_name (aka Edit Category Name) field to admin/categories_industry.php (aka Categories - Industry Type). Additional Analyst Notes: - CVE Program Container: References: - https://neetech18.blogspot.in/2018/02/stored-xss-vulnerability-in-php-scripts.html
CVE ID: CVE-2018-7470 State: PUBLISHED Published: 2018-02-25T07:00:00 Last Updated: 2024-08-05T06:31:03.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsWEBPImageLossless function in coders/webp.c allows attackers to cause a denial of service (segmentation violation) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/998
CVE ID: CVE-2018-7471 State: PUBLISHED Published: 2018-02-25T07:00:00 Last Updated: 2024-08-05T06:31:03.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: KingView 7.5SP1 has an integer overflow during stgopenstorage API read operations. Additional Analyst Notes: - CVE Program Container: References: - http://www.cnvd.org.cn/flaw/show/1202823
CVE ID: CVE-2018-7472 State: PUBLISHED Published: 2018-02-25T07:00:00 Last Updated: 2024-08-05T06:31:03.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: INVT Studio 1.2 allows remote attackers to cause a denial of service during import operations. Additional Analyst Notes: - CVE Program Container: References: - http://www.cnvd.org.cn/flaw/show/1205913
CVE ID: CVE-2018-7473 State: PUBLISHED Published: 2018-03-07T15:00:00 Last Updated: 2024-08-05T06:31:03.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL. Additional Analyst Notes: - CVE Program Container: References: - https://blog.redyops.com/cve-2018-7473-open-url-redirection-vulnerability/
CVE ID: CVE-2018-7474 State: PUBLISHED Published: 2018-03-14T14:00:00 Last Updated: 2024-08-05T06:31:03.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/34 - https://www.exploit-db.com/exploits/44277/
CVE ID: CVE-2018-7475 State: PUBLISHED Published: 2018-06-30T14:00:00 Last Updated: 2024-08-05T06:31:03.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://0xd0ff9.wordpress.com/2018/06/21/cve-2018-7475/ - https://www.youtube.com/watch?v=8_3Q80JrMm4
CVE ID: CVE-2018-7476 State: PUBLISHED Published: 2018-02-25T19:00:00 Last Updated: 2024-08-05T06:31:03.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid parameter in a c=linkage,m=import request to admin.php, because the xss_clean protection mechanism is defeated by crafted input that lacks a '<' or '>' character. Additional Analyst Notes: - CVE Program Container: References: - https://www.from0to1.me/index.php/archives/22/ - https://gitee.com/w1tcher/finecms/commit/6978c63b3bc5e0d1038a23bfc6293ad5e9d5f530
CVE ID: CVE-2018-7477 State: PUBLISHED Published: 2018-02-28T07:00:00 Last Updated: 2024-08-05T06:31:03.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44191
CVE ID: CVE-2018-7479 State: PUBLISHED Published: 2018-02-26T03:00:00 Last Updated: 2024-08-05T06:31:03.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kongxin520/YzmCMS/blob/master/YzmCMS_3.6_bug.md - https://kongxin.gitbook.io/yzmcms-3-6-bug/
CVE ID: CVE-2018-7480 State: PUBLISHED Published: 2018-02-25T20:00:00 Last Updated: 2024-08-05T06:31:03.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/9b54d816e00425c3a517514e0d677bb3cec49258 - https://usn.ubuntu.com/3654-1/ - https://www.debian.org/security/2018/dsa-4188 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b54d8
www.debian.org/security/2018/dsa-4188 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b54d816e00425c3a517514e0d677bb3cec49258 - https://usn.ubuntu.com/3654-2/ - https://usn.ubuntu.com/3656-1/
CVE ID: CVE-2018-7482 State: PUBLISHED Published: 2018-02-28T07:00:00 Last Updated: 2024-11-14T20:51:45.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1 request. The specific pathname ../configuration.php should be base64 encoded for a valid attack. NOTE: the vendor disputes this issue because only files under the media-manager path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless
er path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless, 2.8.1 has additional blocking of .php downloads Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.joomlaworks.net/forum/forum-updates-other-resources/49046-false-cve-report-on-k2-v2-8-0 - https://exploit-db.com/exploits/44188
CVE ID: CVE-2018-7484 State: PUBLISHED Published: 2018-02-26T02:00:00Z Last Updated: 2024-09-16T18:03:02.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT Authority\SYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified path, the application will first try to load the library from the directory from which the application is started. As the residing director
on will first try to load the library from the directory from which the application is started. As the residing directory of PureVPNService.exe is writable to all users, this makes the application susceptible to privilege escalation through DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - http://www.defensecode.com/advisories/DC-2018-02-001-PureVPN-Windows-Privilege-Escalation.pdf - https://www.securityfocus.com/archive/1/541803
CVE ID: CVE-2018-7485 State: PUBLISHED Published: 2018-02-26T14:00:00 Last Updated: 2024-08-05T06:31:03.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e594410438569d8e2963aL24 - http://www.securityfocus.com/bid/103193 - https://access.redhat.com/errata/RHSA-2019:2336
CVE ID: CVE-2018-7486 State: PUBLISHED Published: 2018-02-26T14:00:00 Last Updated: 2024-08-05T06:31:03.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an [m]$.dspinclude("../pathname/executable.jpeg")[/m] approach, where executable.jpeg contains ColdFusion Markup Language code. This can be exploited in conjunction with a CKFinder feature that allows file upload. Additional Analyst Notes: - CVE Program Container: References: - http://bekhzod0725.github.io/cybers
allows file upload. Additional Analyst Notes: - CVE Program Container: References: - http://bekhzod0725.github.io/cybersecurity/2018/02/16/exploiting-muracms.html
CVE ID: CVE-2018-7487 State: PUBLISHED Published: 2018-02-26T15:00:00 Last Updated: 2024-08-05T06:31:04.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer overflow in the LoadPCX function of in_pcx.cpp in sam2p 0.49.4. A Crafted input will lead to a denial of service or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pts/sam2p/issues/18 - https://lists.debian.org/debian-lts-announce/2018/04/msg00004.html
CVE ID: CVE-2018-7489 State: PUBLISHED Published: 2018-02-26T15:00:00 Last Updated: 2024-08-05T06:31:03.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103203 - https://access.r
itional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103203 - https://access.redhat.com/errata/RHSA-2018:1448 - https://access.redhat.com/errata/RHSA-2018:1449 - https://access.redhat.com/errata/RHSA-2018:2938 - https://access.redhat.com/errata/RHSA-2018:1450 - https://access.redhat.com/errata/RHSA-2018:2090 - https://access.redhat.com/errata/RHSA-2018:2939 - http://www.securitytracker.com/id/1041890 - http://www.securitytracker.com/id/1040693 - https://access.redhat.com/errata/RHSA-2018:1786 - https://access.redhat.com/errata/RHSA-2018:1451 - https://www.debian.org/security/2018/dsa-4190 - https://access.redhat.com/errata/RHSA-2018:1447 - https://ac
2018:1451 - https://www.debian.org/security/2018/dsa-4190 - https://access.redhat.com/errata/RHSA-2018:1447 - https://access.redhat.com/errata/RHSA-2018:2088 - https://access.redhat.com/errata/RHSA-2018:2089 - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:3149 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
ecurity-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us - https://security.netapp.com/advisory/ntap-20180328-0001/ - https://github.com/FasterXML/jackson-databind/issues/1931 - https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2018-7490 State: PUBLISHED Published: 2018-02-26T22:00:00 Last Updated: 2024-08-05T06:31:03.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44223/ - https://www.debian.org/security/2018/dsa-4142 - https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html
CVE ID: CVE-2018-7491 State: PUBLISHED Published: 2018-02-26T17:00:00Z Last Updated: 2024-09-16T20:01:56.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors' values. Additional Analyst Notes: - CVE Program Container: References: - http://forge.prestashop.com/browse/BOOM-4917 - https://github.com/PrestaShop/PrestaShop/pull/8807
CVE ID: CVE-2018-7492 State: PUBLISHED Published: 2018-02-26T20:00:00 Last Updated: 2024-08-05T06:31:03.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4187 - http://www.securityfocus.com/bid/103185 - https://usn.ubuntu.com/3619-2/ - https://usn.ubuntu.com/3674-1/ - https://usn.ubuntu.com/3677-1/ - https://usn.ubuntu.com/3674-2/ - https
u.com/3619-2/ - https://usn.ubuntu.com/3674-1/ - https://usn.ubuntu.com/3677-1/ - https://usn.ubuntu.com/3674-2/ - https://bugzilla.redhat.com/show_bug.cgi?id=1527393 - https://patchwork.kernel.org/patch/10096441/ - https://usn.ubuntu.com/3677-2/ - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.7 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f3069c6d33f6ae63a1668737bc78aaaa51bff7ca - https://xorl.wordpress.com/2017/12/18/linux-kernel-rdma-null-pointer-dereference/ - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3619-1/ - https://github.com/torvalds/linux/commit/f3069c6d33f6ae63a1668737bc78aaaa51bff7ca
CVE ID: CVE-2018-7493 State: PUBLISHED Published: 2018-03-05T20:00:00 Last Updated: 2024-08-05T06:31:03.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: CactusVPN through 6.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2018-007.md
CVE ID: CVE-2018-7494 State: PUBLISHED Published: 2018-05-04T19:00:00Z Last Updated: 2024-09-16T19:46:54.978Z Vendors: ICS-CERT Products: Delta Electronics WPLSoft Problem Types: CWE-121 Description: WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length stack buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103179 - https://ics-cert.us-cert.gov/advisories/ICSA-18-058-02
CVE ID: CVE-2018-7495 State: PUBLISHED Published: 2018-05-15T22:00:00Z Last Updated: 2024-09-17T02:47:10.070Z Vendors: Advantech Products: WebAccess Problem Types: CWE-73 Description: In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified, which may allow an attacker to delete files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104190 - https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01