Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-17784 State: PUBLISHED Published: 2018-10-10T21:00:00 Last Updated: 2024-08-05T10:54:10.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/purplemet/status/1043979681186369537 - https://www.exploit-db.com/exploits/45594/ - https://www.purplemet.com/blog/sugarcrm-multiple-xss-vulnerabilities
CVE ID: CVE-2018-17785 State: PUBLISHED Published: 2018-09-30T15:00:00Z Last Updated: 2024-09-16T17:09:11.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as demonstrated by reading the /etc/passwd file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blynkkk/blynk-server/issues/1256 - https://github.com/blynkkk/blynk-server/releases/tag/v0.39.7
CVE ID: CVE-2018-17786 State: PUBLISHED Published: 2018-10-02T18:00:00 Last Updated: 2024-08-05T10:54:10.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi do not require authentication, which allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://xz.aliyun.com/t/2834
CVE ID: CVE-2018-17787 State: PUBLISHED Published: 2018-10-02T18:00:00 Last Updated: 2024-08-05T10:54:10.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because this data is sent directly to the "system" library function. Additional Analyst Notes: - CVE Program Container: References: - https://xz.aliyun.com/t/2834
CVE ID: CVE-2018-17789 State: PUBLISHED Published: 2019-09-20T18:08:17 Last Updated: 2024-08-05T10:54:10.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prospecta Master Data Online (MDO) allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/154498/Master-Data-Online-Cross-Site-Request-Forgery-Data-Tampering.html - https://packetstormsecurity.com/files/cve/CVE-2018-17789
CVE ID: CVE-2018-17790 State: PUBLISHED Published: 2019-08-15T16:25:36 Last Updated: 2024-08-05T10:54:10.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prospecta Master Data Online (MDO) 2.0 has Stored XSS. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/154001/Master-Data-Online-2.0-Cross-Site-Scripting.html - https://packetstormsecurity.com/files/cve/CVE-2018-17790
CVE ID: CVE-2018-17791 State: PUBLISHED Published: 2019-08-21T19:24:17 Last Updated: 2024-08-05T10:54:10.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the D, creating business confusion. In the worst case, all available resources are consumed while processing the data, resulting in unavailability of the service to legitimate users. This occurs because non-editable parameters can be modified by manually e
ailability of the service to legitimate users. This occurs because non-editable parameters can be modified by manually editing a disabled form field within the developer options. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/154061/OmniDoc-7.0-Input-Validation.html - https://packetstormsecurity.com/files/cve/CVE-2018-17791
CVE ID: CVE-2018-17792 State: PUBLISHED Published: 2019-07-19T16:47:01 Last Updated: 2024-08-05T10:54:10.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Webmail (formerly WorldClient) has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.altn.com/Software/MDaemon-Webmail-WorldClient/ - http://packetstormsecurity.com/files/153686/WorldClient-14-Cross-Site-Request-Forgery.html - https://packetstormsecurity.com/files/cve/CVE-2018-17792
CVE ID: CVE-2018-17793 State: REJECTED Published: 2018-09-30T19:00:00 Last Updated: 2019-09-25T22:15:46 Description: No description available.
CVE ID: CVE-2018-17794 State: PUBLISHED Published: 2018-09-30T20:00:00 Last Updated: 2024-08-05T10:54:10.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from when called from iterate_demangle_function. Additional Analyst Notes: - CVE Program Container: References: - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87350 - https://usn.ubuntu.com/4326-1/ - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-17795 State: PUBLISHED Published: 2018-09-30T20:00:00 Last Updated: 2024-08-05T10:54:10.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function t2p_write_pdf in tiff2pdf.c in LibTIFF 4.0.9 and earlier allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2816 - http://www.securityfocus.com/bid/105445 - https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2018-17795
CVE ID: CVE-2018-17796 State: PUBLISHED Published: 2018-09-30T20:00:00 Last Updated: 2024-08-05T10:54:10.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MRCMS (aka mushroom) through 3.1.2. The WebParam.java file directly accepts the FIELD_T parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel() in the ChannelService.java file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuweiit/mushroom/issues/16
CVE ID: CVE-2018-17797 State: PUBLISHED Published: 2018-09-30T20:00:00 Last Updated: 2024-08-05T10:54:10.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seedis/zzcms/blob/master/arbitrary_file_deletion1.md
CVE ID: CVE-2018-17798 State: PUBLISHED Published: 2018-09-30T20:00:00 Last Updated: 2024-08-05T10:54:10.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seedis/zzcms/blob/master/arbitrary_file_deletion2.md
CVE ID: CVE-2018-17825 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AdPlug 2.3.1. There are several double-free vulnerabilities in the CEmuopl class in emuopl.cpp because of a destructor's two OPLDestroy calls, each of which frees TL_TABLE, SIN_TABLE, AMS_TABLE, and VIB_TABLE. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/adplug/adplug/issues/67 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3PW6PLDTPSQQRHKTU2FB72SUB4Q66NE/ - https://lists.fedoraproject.org/archives/list/packa
0lists.fedoraproject.org/message/U3PW6PLDTPSQQRHKTU2FB72SUB4Q66NE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q32A64R2APAC5PXIMSYIEFDQX5AD4GAS/
CVE ID: CVE-2018-17826 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types (.jpg, .png, .gif, .jpeg, and .ico). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rakjong/vuln/blob/master/hisiphp_getshell.pdf
CVE ID: CVE-2018-17827 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rakjong/vuln/blob/master/hisiphp_hetshell_2.pdf
CVE ID: CVE-2018-17828 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gdraheim/zziplib/issues/62
CVE ID: CVE-2018-17830 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted). The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=&args[ substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redaxo/redaxo4/issues/421
CVE ID: CVE-2018-17831 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rex_list were used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redaxo/redaxo/issues/2043 - https://github.com/redaxo/redaxo/releases/tag/5.6.3 - https://redaxo.org/cms/news/sicherheitsluecke-und-neue-yform-version/
CVE ID: CVE-2018-17832 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45514/ - https://cxsecurity.com/issue/WLB-2018050139
CVE ID: CVE-2018-17835 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1298
CVE ID: CVE-2018-17836 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JTBC(PHP) 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/JTBC/blob/master/README.md#getshell
CVE ID: CVE-2018-17837 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JTBC(PHP) 3.0.1.6. Arbitrary file deletion is possible via a /console/file/manage.php?type=action&action=delete&path=c%3A%2F substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/JTBC/blob/master/README.md#arbitrary-file-deletion
CVE ID: CVE-2018-17838 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JTBC(PHP) 3.0.1.6. Arbitrary file read operations are possible via a /console/#/console/file/manage.php?type=list&path=c:/ substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/JTBC/blob/master/README.md#arbitrary-file-read
CVE ID: CVE-2018-17840 State: PUBLISHED Published: 2019-06-19T16:34:27 Last Updated: 2024-08-05T10:54:10.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection exists in Scriptzee Education Website 1.0 via the college_list.html subject, city, or country parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45510
CVE ID: CVE-2018-17841 State: PUBLISHED Published: 2019-06-19T16:12:57 Last Updated: 2024-08-05T10:54:10.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection exists in Scriptzee Flippa Marketplace Clone 1.0 via the site-search sortBy or sortDir parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/41674
CVE ID: CVE-2018-17842 State: PUBLISHED Published: 2019-06-19T16:05:02 Last Updated: 2024-08-05T10:54:10.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels h_room_type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45509
CVE ID: CVE-2018-17843 State: PUBLISHED Published: 2019-05-24T17:11:03 Last Updated: 2024-08-05T10:54:10.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection exists in ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Investment MLM Software 1.0, Bidding MLM Software 1.0, Moneyorder MLM Software 1.0, Repurchase MLM Software 1.0, and Gift MLM Software 1.0 via the member/readmsg.php msg_id parameter, the member/tree.php pid parameter, or the member/downline.php m_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - h
arameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45511
CVE ID: CVE-2018-17846 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/go/issues/27842 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/list
unce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
CVE ID: CVE-2018-17847 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/go/issues/27846 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://
roject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
CVE ID: CVE-2018-17848 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/go/issues/27846 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/arch
kage-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
CVE ID: CVE-2018-17849 State: PUBLISHED Published: 2018-10-04T20:00:00 Last Updated: 2024-08-05T10:54:10.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2018100018
CVE ID: CVE-2018-17850 State: REJECTED Published: 2018-10-01T08:00:00 Last Updated: 2018-10-02T20:57:01 Description: No description available.
CVE ID: CVE-2018-17851 State: REJECTED Published: 2018-10-01T08:00:00 Last Updated: 2018-10-02T20:57:01 Description: No description available.
CVE ID: CVE-2018-17852 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detail_listing URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/155
CVE ID: CVE-2018-17854 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:54:10.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: SIMDComp before 0.1.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it can read (and then discard) extra bytes. NOTE: this issue exists because of an incomplete fix for CVE-2018-17427. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lemire/simdcomp/issues/21
CVE ID: CVE-2018-17855 State: PUBLISHED Published: 2018-10-09T21:00:00 Last Updated: 2024-08-05T10:54:10.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105559 - http://www.securitytracker.com/id/1041914 - https://developer.joomla.org/security-centre/754-20181004-core-acl-violation-in-com-users-for-the-admin-verification
CVE ID: CVE-2018-17856 State: PUBLISHED Published: 2018-10-09T21:00:00 Last Updated: 2024-08-05T10:54:10.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105559 - http://www.securitytracker.com/id/1041914 - https://developer.joomla.org/security-centre/752-20181002-core-inadequate-default-access-level-for-com-joomlaupdate.html
CVE ID: CVE-2018-17857 State: PUBLISHED Published: 2018-10-09T21:00:00 Last Updated: 2024-08-05T10:54:10.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105559 - http://www.securitytracker.com/id/1041914 - https://developer.joomla.org/security-centre/753-20181003-core-access-level-violation-in-com-tags
CVE ID: CVE-2018-17858 State: PUBLISHED Published: 2018-10-09T21:00:00 Last Updated: 2024-08-05T10:54:10.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105559 - http://www.securitytracker.com/id/1041914 - https://developer.joomla.org/security-centre/755-20181005-core-csrf-hardening-in-com-installer.html
CVE ID: CVE-2018-17859 State: PUBLISHED Published: 2018-10-09T21:00:00 Last Updated: 2024-08-05T10:54:10.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disabled forms. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105559 - http://www.securitytracker.com/id/1041914 - https://developer.joomla.org/security-centre/751-20181001-core-hardening-com-contact-contact-form.html
CVE ID: CVE-2018-17860 State: PUBLISHED Published: 2019-11-26T14:11:35 Last Updated: 2024-08-05T10:54:10.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#hadoop - https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_vp4_q2x_thb