Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-16446 State: PUBLISHED Published: 2018-09-04T04:00:00 Last Updated: 2024-08-05T10:24:32.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SeaCMS through 6.61. adm1n/admin_database.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting install_lock.txt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MichaelWayneLIU/seacms/blob/master/seacms5.md
CVE ID: CVE-2018-16447 State: PUBLISHED Published: 2018-09-04T04:00:00 Last Updated: 2024-08-05T10:24:32.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/12 - https://github.com/security-breachlock/CVE-2018-16447/blob/master/frog_CSRF.pdf
CVE ID: CVE-2018-16448 State: PUBLISHED Published: 2018-09-04T04:00:00 Last Updated: 2024-08-05T10:24:32.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chshcms/cscms/issues/1
CVE ID: CVE-2018-16449 State: PUBLISHED Published: 2018-09-04T04:00:00 Last Updated: 2024-08-05T10:24:32.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/liu21st/onethink/issues/37
CVE ID: CVE-2018-16450 State: PUBLISHED Published: 2018-09-04T04:00:00 Last Updated: 2024-08-05T10:24:32.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: CraftedWeb through 2013-09-24 has reflected XSS via the p parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/FuryKangaroo/8dc2ba91a5d63d6560d0088d0d265137
CVE ID: CVE-2018-16451 State: PUBLISHED Published: 2019-10-03T15:57:34 Last Updated: 2024-08-05T10:24:32.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES - https://github.com/the-tcpdump-group/tcpdump/commit/96480ab95308cd9234b4f09b175ebf60e17792c6 - https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.or
10/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html - https://seclists.org/bugtraq/2019/Oct/28 - https://www.debian.org/security/2019/dsa-4547 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ - https://support.apple.com/kb/HT210788
age-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ - https://support.apple.com/kb/HT210788 - https://seclists.org/bugtraq/2019/Dec/23 - http://seclists.org/fulldisclosure/2019/Dec/26 - https://security.netapp.com/advisory/ntap-20200120-0001/ - https://usn.ubuntu.com/4252-2/ - https://usn.ubuntu.com/4252-1/
CVE ID: CVE-2018-16452 State: PUBLISHED Published: 2019-10-03T15:58:44 Last Updated: 2024-08-05T10:24:32.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES - https://github.com/the-tcpdump-group/tcpdump/commit/24182d959f661327525a20d9a94c98a8ec016778 - https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.org/opensuse-security-announce/
CVE ID: CVE-2018-16453 State: PUBLISHED Published: 2018-10-04T21:00:00 Last Updated: 2024-08-05T10:24:32.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar. Additional Analyst Notes: - CVE Program Container: References: - https://googlequeens.com/2018/09/04/cve-2018-16453-domain-lookup-script-3-0-5-stored-xss-via-search-by-whois/
CVE ID: CVE-2018-16454 State: PUBLISHED Published: 2018-09-07T22:00:00 Last Updated: 2024-08-05T10:24:32.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface change) via an inverted comma. Additional Analyst Notes: - CVE Program Container: References: - https://googlequeens.com/2018/09/04/cve-2018-16454-currency-converter-script-2-0-5-has-buffer-overflow
CVE ID: CVE-2018-16455 State: PUBLISHED Published: 2018-10-04T21:00:00 Last Updated: 2024-08-05T10:24:32.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword. Additional Analyst Notes: - CVE Program Container: References: - https://googlequeens.com/2018/09/04/cve-2018-16455-market-place-script-1-0-1-stored-xss-via-search-by-keyword/
CVE ID: CVE-2018-16456 State: PUBLISHED Published: 2018-10-04T21:00:00 Last Updated: 2024-08-05T10:24:32.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has XSS via the Listings Search feature. Additional Analyst Notes: - CVE Program Container: References: - https://googlequeens.com/2018/09/04/cve-2018-16456-website-seller-scriptwebsite-seller-script-2-0-5-stored-xss-via-search-by-keyword/
CVE ID: CVE-2018-16457 State: PUBLISHED Published: 2018-10-04T21:00:00 Last Updated: 2024-08-05T10:24:32.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/template_dp_dec2015/img directory. Additional Analyst Notes: - CVE Program Container: References: - https://googlequeens.com/2018/09/04/cve-2018-16457-open-source-real-estate-script-3-6-2-directory-traversal/
CVE ID: CVE-2018-16458 State: PUBLISHED Published: 2018-09-04T11:00:00 Last Updated: 2024-08-05T10:24:32.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in baigo CMS v2.1.1. There is an index.php?m=article&c=request CSRF that can cause publication of any article. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/baigoStudio/baigoCMS/issues/5
CVE ID: CVE-2018-16459 State: PUBLISHED Published: 2018-09-06T13:00:00Z Last Updated: 2024-09-17T02:32:59.544Z Vendors: https://github.com/guyonroche Products: exceljs Problem Types: CWE-79 Description: An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/356809
CVE ID: CVE-2018-16460 State: PUBLISHED Published: 2018-09-07T19:00:00Z Last Updated: 2024-09-17T02:42:51.207Z Vendors: https://github.com/UmbraEngineering Products: ps Problem Types: CWE-77 Description: A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/390848
CVE ID: CVE-2018-16461 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.382Z Vendors: n/a Products: libnmap Problem Types: CWE-77 Description: A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/390865
CVE ID: CVE-2018-16462 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.408Z Vendors: n/a Products: apex-publish-static-files Problem Types: CWE-77 Description: A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution through a maliciously crafted argument. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/405694
CVE ID: CVE-2018-16463 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.457Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-384 Description: A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=NC-SA-2018-013 - https://hackerone.com/reports/237184
CVE ID: CVE-2018-16464 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.614Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-287 Description: A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/146133 - https://nextcloud.com/security/advisory/?id=NC-SA-2018-012
CVE ID: CVE-2018-16465 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.624Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-287 Description: Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/317711 - https://nextcloud.com/security/advisory/?id=NC-SA-2018-011
CVE ID: CVE-2018-16466 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.504Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-284 Description: Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/388515 - https://nextcloud.com/security/advisory/?id=NC-SA-2018-010
CVE ID: CVE-2018-16467 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.609Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-200 Description: A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=NC-SA-2018-014 - https://hackerone.com/reports/231917
CVE ID: CVE-2018-16468 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.638Z Vendors: n/a Products: Loofah (Ruby Gem) Problem Types: CWE-79 Description: In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4364 - https://github.com/flavorjones/loofah/issues/154
CVE ID: CVE-2018-16469 State: PUBLISHED Published: 2018-10-30T21:00:00 Last Updated: 2024-08-05T10:24:32.373Z Vendors: HackerOne Products: merge Problem Types: CWE-400 Description: The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/381194
CVE ID: CVE-2018-16470 State: PUBLISHED Published: 2018-11-13T23:00:00 Last Updated: 2024-08-05T10:24:32.612Z Vendors: Rack Products: Rack Problem Types: CWE-400 Description: There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21msg/rubyonrails-security/U_x-YkfuVTg/xhvYAmp6AAAJ - https://access.redhat.com/errata/RHSA-2019:3172
CVE ID: CVE-2018-16471 State: PUBLISHED Published: 2018-11-13T23:00:00 Last Updated: 2024-08-05T10:24:32.587Z Vendors: Rack Products: Rack Problem Types: CWE-79 Description: There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable. Additional Analyst Notes
ed, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/rubyonrails-security/GKsAFT924Ag - https://lists.debian.org/debian-lts-announce/2018/11/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00032.html - https://usn.ubuntu.com/4089-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html
CVE ID: CVE-2018-16472 State: PUBLISHED Published: 2018-11-06T00:00:00 Last Updated: 2024-08-05T10:24:32.809Z Vendors: npm Products: cached-path-relative Problem Types: CWE-400 Description: A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/390847 - https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html
CVE ID: CVE-2018-16473 State: PUBLISHED Published: 2018-11-06T19:00:00 Last Updated: 2024-08-05T10:24:32.584Z Vendors: npm Products: takeapeek Problem Types: CWE-22 Description: A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/403736
CVE ID: CVE-2018-16474 State: PUBLISHED Published: 2018-11-06T19:00:00 Last Updated: 2024-08-05T10:24:32.445Z Vendors: npm Products: tianma-static Problem Types: CWE-79 Description: A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/403692
CVE ID: CVE-2018-16475 State: PUBLISHED Published: 2018-11-06T19:00:00 Last Updated: 2024-08-05T10:24:32.480Z Vendors: npm Products: knightjs Problem Types: CWE-22 Description: A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/403707
CVE ID: CVE-2018-16476 State: PUBLISHED Published: 2018-11-30T19:00:00 Last Updated: 2024-08-05T10:24:32.802Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-284 Description: A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ - https://weblog.rubyonrails.org/2018/11
- https://groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ - https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/ - https://access.redhat.com/errata/RHSA-2019:0600
CVE ID: CVE-2018-16477 State: PUBLISHED Published: 2018-11-30T19:00:00 Last Updated: 2024-08-05T10:24:32.757Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-200 Description: A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1. Addit
ccess to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/rubyonrails-security/3KQRnXDIuLg/mByx5KkqBAAJ - https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/
CVE ID: CVE-2018-16478 State: PUBLISHED Published: 2018-12-04T14:00:00 Last Updated: 2024-08-05T10:24:32.870Z Vendors: n/a Products: simplehttpserver Problem Types: CWE-22 Description: A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/403703
CVE ID: CVE-2018-16479 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.597Z Vendors: HackerOne Products: http-live-simulator Problem Types: CWE-22 Description: Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/411405
CVE ID: CVE-2018-16480 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.712Z Vendors: HackerOne Products: public Problem Types: CWE-79 Description: A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/329950 - https://www.npmjs.com/package/public
CVE ID: CVE-2018-16481 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.672Z Vendors: HackerOne Products: html-pages Problem Types: CWE-79 Description: A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/330356
CVE ID: CVE-2018-16482 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.435Z Vendors: HackerOne Products: mcstatic Problem Types: CWE-22 Description: A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/330285
CVE ID: CVE-2018-16483 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.838Z Vendors: HackerOne Products: express-cart Problem Types: Privilege Escalation (CAPEC-233) Description: A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/343626
CVE ID: CVE-2018-16484 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.703Z Vendors: HackerOne Products: m-server Problem Types: CWE-79 Description: A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/319794
CVE ID: CVE-2018-16485 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.559Z Vendors: HackerOne Products: m-server Problem Types: CWE-22 Description: Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/319795
CVE ID: CVE-2018-16486 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.798Z Vendors: HackerOne Products: defaults-deep Problem Types: CWE-400 Description: A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/380878
CVE ID: CVE-2018-16487 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.702Z Vendors: HackerOne Products: lodash Problem Types: CWE-400 Description: A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/380873 - https://security.netapp.com/advisory/ntap-20190919-0004/
CVE ID: CVE-2018-16489 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.562Z Vendors: HackerOne Products: just-extend Problem Types: CWE-400 Description: A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/430291
CVE ID: CVE-2018-16490 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.842Z Vendors: HackerOne Products: mpath Problem Types: CWE-400 Description: A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/390860
CVE ID: CVE-2018-16491 State: PUBLISHED Published: 2019-02-01T18:00:00 Last Updated: 2024-08-05T10:24:32.711Z Vendors: HackerOne Products: node.extend Problem Types: CWE-400 Description: A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/430831