Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
vswitch/ovs/commit/9237a63c47bd314b807cda0bd2216264e82edbe8 - https://access.redhat.com/errata/RHSA-2019:0081 - https://lists.debian.org/debian-lts-announce/2021/02/msg00032.html
CVE ID: CVE-2018-17207 State: PUBLISHED Published: 2018-09-19T16:00:00Z Last Updated: 2024-09-17T03:59:04.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://snapcreek.com/duplicator/docs/changelog/?lite - https://www.synacktiv.com/ressources/advisories/WordPress_Duplicator-1.2.40-RCE.pdf
CVE ID: CVE-2018-17208 State: PUBLISHED Published: 2018-09-19T17:00:00Z Last Updated: 2024-09-17T02:47:14.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface). This occurs because shell metacharacters in the query string are mishandled by ShellExecute, as demonstrated by the zbtest.cgi?cmd=level&level= substring. This can also be exploited via CSRF. Additional Analyst Notes: - CVE Program Container: References: - h
evel= substring. This can also be exploited via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://langkjaer.com/velop.html
CVE ID: CVE-2018-17210 State: PUBLISHED Published: 2019-07-19T23:19:50 Last Updated: 2024-08-05T10:47:03.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass the session checks (that would otherwise logout a low-privileged user) by calling the core print job components directly via crafted HTTP GET and POST requests. Additional Analyst Notes: - CVE Program Container: References: - https:
directly via crafted HTTP GET and POST requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17210-Authorization_Bypass-PrinterOn
CVE ID: CVE-2018-17211 State: PUBLISHED Published: 2019-07-29T17:30:43 Last Updated: 2024-08-05T10:47:04.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17211-Unauthenticated_Information_Disclosure-PrinterOn
CVE ID: CVE-2018-17213 State: PUBLISHED Published: 2019-07-29T17:37:41 Last Updated: 2024-08-05T10:47:03.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtaining a valid session cookie with guest/pseudo-guest level privileges. This cookie can then be further used to perform other attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17213-Authentication_Bypass-PrinterOn
CVE ID: CVE-2018-17215 State: PUBLISHED Published: 2018-09-26T21:00:00 Last Updated: 2024-08-05T10:47:04.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker (for example, user credentials). Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2018/Sep/56 - https://www.syss.de/f
l Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2018/Sep/56 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-016.txt
CVE ID: CVE-2018-17216 State: PUBLISHED Published: 2018-10-01T01:00:00 Last Updated: 2024-08-05T10:47:03.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users. Additional Analyst Notes: - CVE Program Container: References: - https://www.ptc.com/en/support/article?n=CS291004
CVE ID: CVE-2018-17217 State: PUBLISHED Published: 2018-10-01T01:00:00 Last Updated: 2024-08-05T10:47:03.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key. Additional Analyst Notes: - CVE Program Container: References: - https://www.ptc.com/en/support/article?n=CS291004
CVE ID: CVE-2018-17218 State: PUBLISHED Published: 2018-10-01T01:00:00 Last Updated: 2024-08-05T10:47:04.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function. Additional Analyst Notes: - CVE Program Container: References: - https://www.ptc.com/en/support/article?n=CS291004
CVE ID: CVE-2018-17228 State: PUBLISHED Published: 2018-09-19T21:00:00Z Last Updated: 2024-09-16T19:14:39.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/narkisr/nmap4j/issues/9
CVE ID: CVE-2018-17229 State: PUBLISHED Published: 2018-09-19T22:00:00 Last Updated: 2024-08-05T10:47:03.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/453 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
CVE ID: CVE-2018-17230 State: PUBLISHED Published: 2018-09-19T22:00:00 Last Updated: 2024-08-05T10:47:03.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/455 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
CVE ID: CVE-2018-17231 State: PUBLISHED Published: 2018-09-19T22:00:00Z Last Updated: 2024-09-16T19:19:22.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2018/09/19/8
CVE ID: CVE-2018-17232 State: PUBLISHED Published: 2018-09-20T06:00:00 Last Updated: 2024-08-05T10:47:03.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot (aka slack-archive-bot) before 2018-09-19 allows remote attackers to execute arbitrary SQL commands via the text parameter to cursor.execute(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/docmarionum1/slack-archive-bot/issues/12
CVE ID: CVE-2018-17233 State: PUBLISHED Published: 2018-09-20T00:00:00 Last Updated: 2024-08-05T10:47:03.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SIGFPE signal is raised in the function H5D__create_chunk_file_map_hyper() of H5Dchunk.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln2#divided-by-zero---h5d__create_chunk_file_map_hyper_div_zero - https://lists.debian.org/debian-lts-announce/20
HDF5/vuln2#divided-by-zero---h5d__create_chunk_file_map_hyper_div_zero - https://lists.debian.org/debian-lts-announce/2023/08/msg00009.html
CVE ID: CVE-2018-17234 State: PUBLISHED Published: 2018-09-20T00:00:00 Last Updated: 2024-08-05T10:47:03.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln3#memory-leak---h5o__chunk_deserialize_memory_leak - https://lists.debian.org/debian-lts-announce/2023/08/msg00009.html
CVE ID: CVE-2018-17235 State: PUBLISHED Published: 2018-09-20T00:00:00 Last Updated: 2024-08-05T10:47:04.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function mp4v2::impl::MP4Track::FinishSdtp() in mp4track.cpp in libmp4v2 2.1.0 mishandles compatibleBrand while processing a crafted mp4 file, which leads to a heap-based buffer over-read, causing denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1629451 - https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0
CVE ID: CVE-2018-17236 State: PUBLISHED Published: 2018-09-20T00:00:00 Last Updated: 2024-08-05T10:47:04.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function MP4Free() in mp4property.cpp in libmp4v2 2.1.0 internally calls free() on a invalid pointer, raising a SIGABRT signal. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1629453 - https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0
CVE ID: CVE-2018-17237 State: PUBLISHED Published: 2018-09-20T00:00:00 Last Updated: 2024-08-05T10:47:03.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SIGFPE signal is raised in the function H5D__chunk_set_info_real() of H5Dchunk.c in the HDF HDF5 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. This issue is different from CVE-2018-11207. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SegfaultMasters/covering360/blob/master/HDF5/README.md#divided-by-zero---h5d__chunk_set_info_real_div_by_zero - https://lists.debian.org/debian-lts-announce/2023/08/msg00009.html
CVE ID: CVE-2018-17240 State: PUBLISHED Published: 2022-06-10T17:03:52 Last Updated: 2024-08-05T10:47:04.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration (e.g., username and password). Additional Analyst Notes: - CVE Program Container: References: - https://www.bbge.org/file/exploit.py - https://github.com/BBge/CVE-2018-17240/blob/main/exploit.py - https://github.com/BBge/CVE-2018-17240
CVE ID: CVE-2018-17243 State: PUBLISHED Published: 2018-09-20T07:00:00Z Last Updated: 2024-09-17T02:11:22.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me.html
CVE ID: CVE-2018-17244 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T10:47:04.105Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-362 Description: Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to. Additional Analyst Notes: - CVE Program Container:
low a user to access information that they should not have access to. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 - https://www.elastic.co/community/security - http://www.securityfocus.com/bid/106318
CVE ID: CVE-2018-17245 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T10:47:04.122Z Vendors: Elastic Products: Kibana Problem Types: CWE-201 Description: Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 - https://www.elastic.co/community/security
CVE ID: CVE-2018-17246 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T10:47:04.056Z Vendors: Elastic Products: Kibana Problem Types: CWE-73 Description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106285 - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-secur
eferences: - http://www.securityfocus.com/bid/106285 - https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 - https://access.redhat.com/errata/RHBA-2018:3743 - https://www.elastic.co/community/security
CVE ID: CVE-2018-17247 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T10:47:04.127Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-611 Description: Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus
hey should not have access to. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106294 - https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594 - https://www.elastic.co/community/security
CVE ID: CVE-2018-17248 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17249 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17250 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17251 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17252 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17253 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17254 State: PUBLISHED Published: 2018-09-20T14:00:00 Last Updated: 2024-08-05T10:47:04.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45423/ - http://packetstormsecurity.com/files/161683/Joomla-JCK-Editor-6.4.4-SQL-Injection.html
CVE ID: CVE-2018-17255 State: REJECTED Published: 2018-09-20T14:00:00 Last Updated: 2021-08-06T16:22:24 Description: No description available.
CVE ID: CVE-2018-17256 State: PUBLISHED Published: 2018-11-27T21:00:00Z Last Updated: 2024-09-17T04:08:55.751Z Vendors: CyberSecurity Philippines - CERT Products: UmbracoCMS Problem Types: Persistent cross-site scripting Description: Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content. Additional Analyst Notes: - CVE Program Container: References: - https://www.cspcert.ph/advisories/2018/CVE-2018-17256.html
CVE ID: CVE-2018-17257 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17258 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17259 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17260 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17261 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17262 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17263 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17264 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17265 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17266 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17267 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17268 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17269 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17270 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17271 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17272 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17273 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17274 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17275 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17276 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17277 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17278 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17279 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17280 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-17281 State: PUBLISHED Published: 2018-09-24T22:00:00 Last Updated: 2024-08-05T10:47:04.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041694 - http://seclists.org/fulldisclosure/2018/Sep/31 - http://packetstormsecurity.com/files/149453/Asterisk-Pr
om/id/1041694 - http://seclists.org/fulldisclosure/2018/Sep/31 - http://packetstormsecurity.com/files/149453/Asterisk-Project-Security-Advisory-AST-2018-009.html - https://www.debian.org/security/2018/dsa-4320 - https://seclists.org/bugtraq/2018/Sep/53 - https://issues.asterisk.org/jira/browse/ASTERISK-28013 - https://lists.debian.org/debian-lts-announce/2018/09/msg00034.html - https://security.gentoo.org/glsa/201811-11 - http://www.securityfocus.com/bid/105389 - http://downloads.asterisk.org/pub/security/AST-2018-009.html
CVE ID: CVE-2018-17282 State: PUBLISHED Published: 2018-09-20T20:00:00 Last Updated: 2024-08-05T10:47:03.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/457 - https://access.redhat.com/errata/RHSA-2019:2101 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
CVE ID: CVE-2018-17283 State: PUBLISHED Published: 2018-09-21T03:00:00 Last Updated: 2024-08-05T10:47:04.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me.html - https://github.com/x-f1v3/ForCve/is
r: References: - https://www.manageengine.com/network-monitoring/help/read-me.html - https://github.com/x-f1v3/ForCve/issues/4