Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-11697 State: PUBLISHED Published: 2018-06-04T06:00:00 Last Updated: 2024-08-05T08:17:08.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2656
CVE ID: CVE-2018-11698 State: PUBLISHED Published: 2018-06-04T06:00:00 Last Updated: 2024-08-05T08:17:09.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2662
CVE ID: CVE-2018-11701 State: PUBLISHED Published: 2018-06-19T13:00:00 Last Updated: 2024-08-05T08:17:09.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone Image Viewer 6.2 has a User Mode Write AV at 0x005cb509, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MostafaSoliman/Security-Advisories/tree/master/CVE-2018-11701
CVE ID: CVE-2018-11702 State: PUBLISHED Published: 2018-06-19T13:00:00 Last Updated: 2024-08-05T08:17:08.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cb3, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MostafaSoliman/Security-Advisories/tree/master/CVE-2018-11702
CVE ID: CVE-2018-11703 State: PUBLISHED Published: 2018-06-19T13:00:00 Last Updated: 2024-08-05T08:17:08.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d6a, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MostafaSoliman/Security-Advisories/tree/master/CVE-2018-11703
CVE ID: CVE-2018-11704 State: PUBLISHED Published: 2018-06-19T13:00:00 Last Updated: 2024-08-05T08:17:08.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d7d, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MostafaSoliman/Security-Advisories/tree/master/CVE-2018-11704
CVE ID: CVE-2018-11705 State: PUBLISHED Published: 2018-06-19T13:00:00 Last Updated: 2024-08-05T08:17:08.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cc4, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MostafaSoliman/Security-Advisories/tree/master/CVE-2018-11705
CVE ID: CVE-2018-11706 State: PUBLISHED Published: 2018-06-19T13:00:00 Last Updated: 2024-08-05T08:17:08.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578dd8, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MostafaSoliman/Security-Advisories/tree/master/CVE-2018-11706
CVE ID: CVE-2018-11707 State: PUBLISHED Published: 2018-06-19T13:00:00 Last Updated: 2024-08-05T08:17:08.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone Image Viewer 6.2 has a User Mode Read and Execute AV at 0x0057898e, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MostafaSoliman/Security-Advisories/tree/master/CVE-2018-11707
CVE ID: CVE-2018-11709 State: PUBLISHED Published: 2018-06-04T13:00:00Z Last Updated: 2024-09-16T17:28:22.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting (XSS) via the URI. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9090 - https://blog.dewhurstsecurity.com/2018/06/01/wp-foro-wordpress-plugin-xss-vulnerability.html - https://wordpress.org/plugins/wpforo/#developers
CVE ID: CVE-2018-11710 State: PUBLISHED Published: 2018-06-04T13:00:00Z Last Updated: 2024-09-16T18:19:31.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an invalid write near address 0 in an out-of-memory situation. Additional Analyst Notes: - CVE Program Container: References: - https://lib.openmpt.org/libopenmpt/2018/04/29/security-updates-0.3.9-0.2-beta32-0.2.7561-beta20.5-p9-0.2.7386-beta20.3-p12/ - https://source.openmpt.org/browse/openmpt/trunk/?op=revision&rev=10149&peg=10150
CVE ID: CVE-2018-11711 State: PUBLISHED Published: 2018-06-04T13:00:00 Last Updated: 2024-08-05T08:17:09.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44845/ - https://gist.github.com/huyk
Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44845/ - https://gist.github.com/huykha/9dbcd0e46058f1e18bab241d1b2754bd
CVE ID: CVE-2018-11712 State: PUBLISHED Published: 2018-06-04T14:00:00 Last Updated: 2024-08-05T08:17:08.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed to perform TLS certificate verification for WebSocket connections. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201808-04 - https://trac.webkit.org/changeset/230886/webkit - https://bugs.webkit.org/show_bug.cgi?id=184804
CVE ID: CVE-2018-11713 State: PUBLISHED Published: 2018-06-04T14:00:00 Last Updated: 2024-08-05T08:17:08.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection. Additional Analyst Notes: - CVE Program Container: References: - https://trac.webkit.org/changeset/228088/webkit - https://security.gentoo.org/glsa/201808-04 - https://bugs.webkit.org/show_
s://trac.webkit.org/changeset/228088/webkit - https://security.gentoo.org/glsa/201808-04 - https://bugs.webkit.org/show_bug.cgi?id=126384
CVE ID: CVE-2018-11714 State: PUBLISHED Published: 2018-06-04T14:00:00Z Last Updated: 2024-09-16T23:25:29.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action. Additional Analyst Notes: - CVE Program Container: References: - http://blog.securelayer7.net/time-to-disable-tp-link-home-wifi-router/ -
t Notes: - CVE Program Container: References: - http://blog.securelayer7.net/time-to-disable-tp-link-home-wifi-router/ - https://www.exploit-db.com/exploits/44781/
CVE ID: CVE-2018-11715 State: PUBLISHED Published: 2018-06-04T17:00:00 Last Updated: 2024-08-05T08:17:09.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject. Additional Analyst Notes: - CVE Program Container: References: - https://community.mybb.com/mods.php?action=changelog&pid=842 - https://www.exploit-db.com/exploits/44833/
CVE ID: CVE-2018-11716 State: PUBLISHED Published: 2018-07-16T14:00:00 Last Updated: 2024-08-05T08:17:09.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information (private information such as location of enrolled devices, cleartext passwords, patching level, etc.) via a GET request on port 8022, 8443, or 8444. Additional Analyst Notes: - CVE Program Container: References: - https://blog.netxp.fr/manageengine-deep-exploitation/ - https://www.manageengine.com/products/desktop-central/vulnerability
ps://blog.netxp.fr/manageengine-deep-exploitation/ - https://www.manageengine.com/products/desktop-central/vulnerability-in-log-files.html
CVE ID: CVE-2018-11717 State: PUBLISHED Published: 2018-07-16T14:00:00 Last Updated: 2024-08-05T08:17:08.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depending on the modules configured) the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the EAS account (an AD account used to send mail), the cleartext password of recovery_password of Android devices, the cleartext password of account "set", the location of devices enrolled in the platform (with UUID and information rel
the cleartext password of account "set", the location of devices enrolled in the platform (with UUID and information related to the name of the person at the location), critical information about all enrolled devices such as Serial Number, UUID, Model, Name, and auth_session_token (usable to spoof a terminal identity on the platform), etc. Additional Analyst Notes: - CVE Program Container: References: - https://blog.netxp.fr/manageengine-deep-exploitation/ - https://www.manageengine.com/products/desktop-central/vulnerability-in-log-files.html
CVE ID: CVE-2018-11718 State: PUBLISHED Published: 2018-08-30T16:00:00 Last Updated: 2024-08-05T08:17:09.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://xovis.com/security/xovis-sec-2018-001.html
CVE ID: CVE-2018-11719 State: PUBLISHED Published: 2018-08-30T16:00:00 Last Updated: 2024-08-05T08:17:08.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE. Additional Analyst Notes: - CVE Program Container: References: - https://xovis.com/security/xovis-sec-2018-002.html
CVE ID: CVE-2018-11720 State: PUBLISHED Published: 2018-08-30T16:00:00 Last Updated: 2024-08-05T08:17:09.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://xovis.com/security/xovis-sec-2018-003.html
CVE ID: CVE-2018-11722 State: PUBLISHED Published: 2018-06-05T12:00:00 Last Updated: 2024-08-05T08:17:09.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/141
CVE ID: CVE-2018-11723 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:08.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libpff_name_to_id_map_entry_read function in libpff_name_to_id_map.c in libyal libpff through 2018-04-28 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted pff file. NOTE: the vendor has disputed this as described in libyal/libpff issue 66 on GitHub Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://packetstormsecurity.com/files/148113/libpff-2018-04-28-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Jun
ormsecurity.com/files/148113/libpff-2018-04-28-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Jun/15
CVE ID: CVE-2018-11724 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:09.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mobi_pk1_decrypt function in encryption.c in Libmobi 0.3 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted mobi file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jun/16 - http://packetstormsecurity.com/files/148114/libmobi-0.3-Information-Disclosure.html
CVE ID: CVE-2018-11725 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:09.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mobi_parse_index_entry function in index.c in Libmobi 0.3 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted mobi file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jun/16 - http://packetstormsecurity.com/files/148114/libmobi-0.3-Information-Disclosure.html
CVE ID: CVE-2018-11726 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:09.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mobi_decode_font_resource function in util.c in Libmobi 0.3 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted mobi file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jun/16 - http://packetstormsecurity.com/files/148114/libmobi-0.3-Information-Disclosure.html
CVE ID: CVE-2018-11727 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:09.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libfsntfs_attribute_read_from_mft function in libfsntfs_attribute.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Jun/
msecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Jun/17
CVE ID: CVE-2018-11728 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:09.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libfsntfs_reparse_point_values_read_data function in libfsntfs_reparse_point_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html - http://seclists.org/fulldi
http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Jun/17
CVE ID: CVE-2018-11729 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:09.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libfsntfs_mft_entry_read_header function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Jun/17
CVE ID: CVE-2018-11730 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:08.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libfsntfs_security_descriptor_values_free function in libfsntfs_security_descriptor_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause a denial of service (double-free) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Jun/17
CVE ID: CVE-2018-11731 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:17:09.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libfsntfs_mft_entry_read_attributes function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Jun/17
CVE ID: CVE-2018-11734 State: PUBLISHED Published: 2019-07-10T17:19:51 Last Updated: 2024-08-05T08:17:09.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: In e107 v2.1.7, output without filtering results in XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/e107inc/e107/issues/3170
CVE ID: CVE-2018-11735 State: PUBLISHED Published: 2018-06-05T06:00:00Z Last Updated: 2024-09-17T04:14:17.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XIMDEX/ximdex/issues/146
CVE ID: CVE-2018-11736 State: PUBLISHED Published: 2018-06-05T06:00:00Z Last Updated: 2024-09-16T20:16:49.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/61 - https://github.com/pluck-cms/pluck/releases/tag/4.7.7-dev2
CVE ID: CVE-2018-11737 State: PUBLISHED Published: 2018-06-05T11:00:00Z Last Updated: 2024-09-17T01:55:40.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfs_fix_idxrec in tsk/fs/ntfs_dent.cpp which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sleuthkit/sleuthkit/issues/1266
CVE ID: CVE-2018-11738 State: PUBLISHED Published: 2018-06-05T11:00:00Z Last Updated: 2024-09-16T17:33:36.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfs_make_data_run in tsk/fs/ntfs.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sleuthkit/sleuthkit/issues/1265
CVE ID: CVE-2018-11739 State: PUBLISHED Published: 2018-06-05T11:00:00Z Last Updated: 2024-09-16T23:26:17.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function raw_read in tsk/img/raw.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sleuthkit/sleuthkit/issues/1267
CVE ID: CVE-2018-11740 State: PUBLISHED Published: 2018-06-05T11:00:00Z Last Updated: 2024-09-17T00:56:23.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function tsk_UTF16toUTF8 in tsk/base/tsk_unicode.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sleuthkit/sleuthkit/issues/1264
CVE ID: CVE-2018-11741 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T08:17:09.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=#####&GOTO(8) URIs. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html - https://www.exploit-db.com/exploits/45942/ - http://seclists.org/fulldisclosure/2018/Dec/1 - http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SE
ists.org/fulldisclosure/2018/Dec/1 - http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt