Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-18836 State: PUBLISHED Published: 2019-06-18T15:13:26 Last Updated: 2024-08-05T11:23:07.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L388 - https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L403 - https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca
3ec96da07/web/api/web_api_v1.c#L403 - https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca - https://github.com/netdata/netdata/pull/4521 - https://www.red4sec.com/cve/netdata_json_injection.txt
CVE ID: CVE-2018-18837 State: PUBLISHED Published: 2019-06-18T15:11:43 Last Updated: 2024-08-05T11:23:08.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca - https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L367-L370 - https://github.com/netdata/netdata/pull/4521 - https://www.red4sec.com/cve/netdata_header
b/api/web_api_v1.c#L367-L370 - https://github.com/netdata/netdata/pull/4521 - https://www.red4sec.com/cve/netdata_header_injection.txt
CVE ID: CVE-2018-18838 State: PUBLISHED Published: 2019-06-18T15:10:28 Last Updated: 2024-08-05T11:23:08.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to api/v1/registry. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca - https://github.com/netdata/netdata/pull/4521 - https://www.red4sec.com/cve/netdata_log_injection.txt
CVE ID: CVE-2018-18839 State: PUBLISHED Published: 2019-06-18T15:06:25 Last Updated: 2024-08-05T11:23:08.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is intentional. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca - https://github.com/netdata/netdata/pull/4521 - https://www.red4sec.com/cve/netdata_fpd.txt
CVE ID: CVE-2018-18840 State: PUBLISHED Published: 2018-10-30T06:00:00 Last Updated: 2024-08-05T11:23:08.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexmetatit parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/m3lon/XSS-Expoit/blob/master/SEMCMS%20Stored%20XSS%20Vulnerability.md
CVE ID: CVE-2018-18841 State: PUBLISHED Published: 2018-10-30T06:00:00 Last Updated: 2024-08-05T11:23:08.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/m3lon/XSS-Expoit/blob/master/SEMCMS%20Stored%20XSS_2.md
CVE ID: CVE-2018-18842 State: PUBLISHED Published: 2018-10-30T06:00:00 Last Updated: 2024-08-05T11:23:08.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zblogcn/zblogphp/files/2524853/CSRF.Vulnerability.exists.in.the.file.of.Z-BLOG.1.5.2.1935.docx - https://github.com/zblogcn/zblogphp/issues/201
CVE ID: CVE-2018-18843 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:23:08.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/53158 - https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/
CVE ID: CVE-2018-18845 State: PUBLISHED Published: 2019-03-17T19:44:33 Last Updated: 2024-08-05T11:23:08.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACS_path. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The product is discontinued. Additional Analyst Notes: - CVE Program Container: References: - http:
by the web browser. The product is discontinued. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151799/Advanced-Comment-System-1.0-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2019/Feb/46
CVE ID: CVE-2018-18849 State: PUBLISHED Published: 2019-03-17T19:56:41 Last Updated: 2024-08-05T11:23:08.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3826-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQIBTGNRDQEXGAAYHE4JIWFAYFNHZ6QP/ - http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00043.html - http://lists.opensuse.org/
/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00043.html - http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00004.html - http://www.openwall.com/lists/oss-security/2018/11/01/1 - https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06401.html - https://security.netapp.com/advisory/ntap-20190411-0006/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00010.html - https://www.debian.org/security/2019/dsa-4454 - https://seclists.org/bugtraq/2019/May/76
CVE ID: CVE-2018-18850 State: PUBLISHED Published: 2018-10-31T03:00:00 Last Updated: 2024-08-05T11:23:08.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server (for self-hosted installations by default, SYSTEM). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/5042
CVE ID: CVE-2018-18852 State: PUBLISHED Published: 2019-06-18T15:00:32 Last Updated: 2024-08-05T11:23:08.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature's use of Save.cgi to execute a ping command, as exploited in the wild in October 2018. Additional Analyst Notes: - CVE Program Container: References: - https://www.fortiguard.com/zeroday/FG-VD-18-149
CVE ID: CVE-2018-18853 State: PUBLISHED Published: 2018-10-31T05:00:00 Last Updated: 2024-08-05T11:23:08.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spray/spray-json/issues/278
CVE ID: CVE-2018-18854 State: PUBLISHED Published: 2018-10-31T05:00:00 Last Updated: 2024-08-05T11:23:08.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spray/spray-json/issues/277
CVE ID: CVE-2018-18856 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:23:08.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the system function to execute the "openvpncmd" parameter as a shell command. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1
Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html - https://www.exploit-db.com/exploits/45782/ - http://seclists.org/fulldisclosure/2018/Nov/1
CVE ID: CVE-2018-18857 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:23:08.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the system function to execute the "command_line" parameter as a shell command. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS
al Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html - https://www.exploit-db.com/exploits/45782/ - http://seclists.org/fulldisclosure/2018/Nov/1
CVE ID: CVE-2018-18858 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:23:08.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the system function to execute the "tun_path" or "tap_path" pathname within a shell command. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150137/Liquid
and. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html - https://www.exploit-db.com/exploits/45782/ - http://seclists.org/fulldisclosure/2018/Nov/1
CVE ID: CVE-2018-18859 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:23:08.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the value of the "tun_path" or "tap_path" pathname in a kextload() call. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-
yst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html - https://www.exploit-db.com/exploits/45782/ - http://seclists.org/fulldisclosure/2018/Nov/1
CVE ID: CVE-2018-18860 State: PUBLISHED Published: 2018-11-30T18:00:00 Last Updated: 2024-08-05T11:23:08.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. Due to over-permissive configuration settings and a SUID binary, an attacker is able to execute arbitrary binaries as root. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150323/SwitchVPN-For-MacOS-2.1012.03-Privilege-Escalation.html - https://www.exploit-db.com/exploits/45854/ - http://seclists.org/fulldisclosure/2018/Nov/38
CVE ID: CVE-2018-18861 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:23:08.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in PCMan FTP Server 2.0.7 allows for remote code execution via the APPE command. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150174/PCManFTPD-2.0.7-Server-APPE-Command-Buffer-Overflow.html
CVE ID: CVE-2018-18862 State: PUBLISHED Published: 2019-03-17T20:19:26 Last Updated: 2024-08-05T11:23:08.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Details/Default+Admin+View/, AST%3AARServerConnection/Default+Admin+View/, and AR+System+Administration%3A+Server+Information/Default+Admin+View/. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151021/BMC-Remedy-ITAM-7.1.00-9.1.02.003-Information-Disclosure.html - http://seclists.org/fulldisclosure/2019/Jan/11 - https://
MC-Remedy-ITAM-7.1.00-9.1.02.003-Information-Disclosure.html - http://seclists.org/fulldisclosure/2019/Jan/11 - https://docs.bmc.com/docs/ars91/en/release-notes-and-notices-609073037.html
CVE ID: CVE-2018-18863 State: PUBLISHED Published: 2019-06-19T15:32:03 Last Updated: 2024-08-05T11:23:08.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: NGA ResourceLink 20.0.2.1 allows local file inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://www.dionach.com/blog/cve-2018-18863-resourcelink-local-file-inclusion
CVE ID: CVE-2018-18864 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:23:08.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Loadbalancer.org Enterprise VA MAX before 8.3.3 has XSS because Apache HTTP Server logs are displayed. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150135/Loadbalancer.org-Enterprise-VA-MAX-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Nov/5
CVE ID: CVE-2018-18865 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:23:08.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13) allow Credentials Disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Nov/4 - https://www.exploit-db.com/exploits/45783/ - http://packetstormsecurity.com/files/150136/Royal-TS-X-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Nov/25
CVE ID: CVE-2018-18867 State: PUBLISHED Published: 2018-10-31T05:00:00 Last Updated: 2024-08-05T11:23:08.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-15495. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/trippo/ResponsiveFilemanager/issues/506
CVE ID: CVE-2018-18868 State: PUBLISHED Published: 2018-10-31T06:00:00 Last Updated: 2024-08-05T11:23:08.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter, as demonstrated by the VG48Z5PqVWname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/s-kustm/Subodh/blob/master/CVE-2018-18868.pdf
CVE ID: CVE-2018-18869 State: PUBLISHED Published: 2018-10-31T06:00:00Z Last Updated: 2024-09-17T00:40:49.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter. Additional Analyst Notes: - CVE Program Container: References: - https://qclover.github.io/2018/10/10/EmpireCMS_V7.5%E7%9A%84%E4%B8%80%E6%AC%A1%E5%AE%A1%E8%AE%A1.html
CVE ID: CVE-2018-18871 State: PUBLISHED Published: 2018-12-20T21:00:00 Last Updated: 2024-08-05T11:23:08.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password). Additional Analyst Notes: - CVE Program Container: References: - https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Gigaset_Maxwell.pdf?_=1541431343
CVE ID: CVE-2018-18872 State: PUBLISHED Published: 2019-05-13T13:04:19 Last Updated: 2024-08-05T11:23:08.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9141
CVE ID: CVE-2018-18873 State: PUBLISHED Published: 2018-10-31T16:00:00 Last Updated: 2024-08-05T11:23:08.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html - https://github.com/mdadams/jasper/issues/184 - https://security.gentoo.org/glsa/201908-03 - https://www.oracle.com/security-alerts/cpuapr2020.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html - http://lists.opensuse.org/opensuse-security-
ttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html
CVE ID: CVE-2018-18874 State: PUBLISHED Published: 2018-10-31T16:00:00Z Last Updated: 2024-09-16T17:18:25.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=file_manager_upload URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gnat/nc-cms/issues/11
CVE ID: CVE-2018-18875 State: PUBLISHED Published: 2019-06-18T14:29:39 Last Updated: 2024-08-05T11:23:08.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script via changestationname.php. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
CVE ID: CVE-2018-18876 State: PUBLISHED Published: 2019-06-18T14:27:40 Last Updated: 2024-08-05T11:23:08.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it possible to read any file present on the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
CVE ID: CVE-2018-18877 State: PUBLISHED Published: 2019-06-18T14:26:17 Last Updated: 2024-08-05T11:23:08.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page config_main.php that allows manipulation of the device. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
CVE ID: CVE-2018-18878 State: PUBLISHED Published: 2019-06-18T14:03:35 Last Updated: 2024-08-05T11:23:08.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
CVE ID: CVE-2018-18879 State: PUBLISHED Published: 2019-06-18T14:00:08 Last Updated: 2024-08-05T11:23:08.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
CVE ID: CVE-2018-18880 State: PUBLISHED Published: 2019-06-18T13:20:05 Last Updated: 2024-08-05T11:23:08.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02
CVE ID: CVE-2018-18881 State: PUBLISHED Published: 2019-03-17T21:09:32 Last Updated: 2024-08-05T11:23:08.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service (DOS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module 1.05 with firmware revision v1.05. An authenticated user can configure invalid network settings, stopping TCP based communications to the device. A physical factory reset is required to restore the device to an operational state. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106655 - https://applied-risk.com/labs/advisories