Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-17092 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DonLinkage 6.6.8. SQL injection in /pages/proxy/php.php and /pages/proxy/add.php can be exploited via specially crafted input, allowing an attacker to obtain information from a database. The vulnerability can only be triggered by an authorized user. Additional Analyst Notes: - CVE Program Container: References: - http://www.safecomp.com/blog/donlinkage.html
CVE ID: CVE-2018-17093 State: REJECTED Published: 2018-09-16T21:00:00 Last Updated: 2020-02-10T16:30:41 Description: No description available.
CVE ID: CVE-2018-17094 State: REJECTED Published: 2018-09-16T21:00:00 Last Updated: 2020-02-10T16:41:38 Description: No description available.
CVE ID: CVE-2018-17095 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mpruett/audiofile/issues/50 - https://usn.ubuntu.com/3800-1/ - https://github.com/mpruett/audiofile/issues/51
CVE ID: CVE-2018-17096 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BPMDetect class in BPMDetect.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/soundtouch/soundtouch/issues/14 - https://github.com/TeamSeri0us/pocs/tree/master/soundtouch/2018_09_03
CVE ID: CVE-2018-17097 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (double free) or possibly have unspecified other impact, as demonstrated by SoundStretch. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/soundtouch/soundtouch/issues/14 - https://github.com/TeamSeri0us/pocs/tree/master/soundtouch/2018_09_03
CVE ID: CVE-2018-17098 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (heap corruption from size inconsistency) or possibly have unspecified other impact, as demonstrated by SoundStretch. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/soundtouch/soundtouch/issues/14 - https://github.com/TeamSeri0us/pocs/blob/master/soundtouch/2018_09_03
CVE ID: CVE-2018-17100 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3864-1/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00019.html - http://bugzilla.maptools.org/show_bug.cgi?id=2810 - https://gitlab.com/libtiff/libtiff/merge_requests/33/diffs?commit_id=6da1fb3f64d43be37e640efbec6
/show_bug.cgi?id=2810 - https://gitlab.com/libtiff/libtiff/merge_requests/33/diffs?commit_id=6da1fb3f64d43be37e640efbec60400d1f1ac39e - https://usn.ubuntu.com/3906-2/ - https://access.redhat.com/errata/RHSA-2019:2053 - https://www.debian.org/security/2020/dsa-4670
CVE ID: CVE-2018-17101 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/merge_requests/33/diffs?commit_id=f1b94e8a3ba49febdd3361c0214a1d1149251577 - https://usn.ubuntu.com/3864-1/ - http://www.securityfocus.com/bid/105370 - https://www.debian.org/secur
4a1d1149251577 - https://usn.ubuntu.com/3864-1/ - http://www.securityfocus.com/bid/105370 - https://www.debian.org/security/2018/dsa-4349 - http://bugzilla.maptools.org/show_bug.cgi?id=2807 - https://lists.debian.org/debian-lts-announce/2018/10/msg00019.html - https://usn.ubuntu.com/3906-2/ - https://access.redhat.com/errata/RHSA-2019:2053
CVE ID: CVE-2018-17102 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/quickapps/cms/issues/187 - https://github.com/quickapps/cms/issues/199
CVE ID: CVE-2018-17103 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1295
CVE ID: CVE-2018-17104 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/microweber/microweber/issues/484 - https://github.com/microweber/microweber/issues/483 - https://github.com/microweber/microweber/commit/982ea9d5efb7d2306a05644ebc3469dadb33767e
CVE ID: CVE-2018-17106 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tinyftp Tinyftpd 1.1, a buffer overflow exists in the text variable of the do_mkd function in the ftpproto.c file. An attacker can overwrite ebp via a long pathname. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vbirds/Tinyftp/issues/4
CVE ID: CVE-2018-17107 State: PUBLISHED Published: 2018-09-24T22:00:00 Last Updated: 2024-08-05T10:39:59.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tgstation/tgstation-server/issues/690
CVE ID: CVE-2018-17108 State: PUBLISHED Published: 2018-09-16T23:00:00Z Last Updated: 2024-09-17T01:52:00.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow attackers to perform Account Takeover attacks by intercepting a security-question response during the initial configuration of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/SBI_Buddy_AuthenticationBypass.pdf
CVE ID: CVE-2018-17110 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple POS 4.0.24 allows SQL Injection via a products/get_products/ columns[0][search][value] parameter in the management panel, as demonstrated by products/get_products/1. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45328/
CVE ID: CVE-2018-17111 State: PUBLISHED Published: 2018-09-18T21:00:00 Last Updated: 2024-08-05T10:39:59.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: The onlyOwner modifier of a smart contract implementation for Coinlancer (CL), an Ethereum ERC20 token, has a potential access control vulnerability. All contract users can access functions that use this onlyOwner modifier, because the comparison between msg.sender and owner is incorrect. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17111
CVE ID: CVE-2018-17113 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/teameasy/EasyCMS/issues/7
CVE ID: CVE-2018-17125 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/CScms/blob/master/CScms_dirdel.md - https://www.patec.cn/newsshow.php?cid=24&id=125
CVE ID: CVE-2018-17126 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/CScms/blob/master/CScms_xss.md#cscms_getshell - https://www.patec.cn/newsshow.php?cid=24&id=125
CVE ID: CVE-2018-17127 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: blocking_request.cgi on ASUS GT-AC5300 devices through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (NULL pointer dereference and device crash) via a request that lacks a timestap parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/tree/master/ASUS/GT-AC5300/dos1
CVE ID: CVE-2018-17128 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode. Additional Analyst Notes: - CVE Program Container: References: - https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/ - https://www.exploit-db.com/exploits/45449/
CVE ID: CVE-2018-17129 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/panghusec/exploit/issues/2
CVE ID: CVE-2018-17130 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header, Additional Analyst Notes: - CVE Program Container: References: - https://github.com/panghusec/exploit/issues/3
CVE ID: CVE-2018-17131 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/panghusec/exploit/issues/5
CVE ID: CVE-2018-17132 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/panghusec/exploit/issues/4
CVE ID: CVE-2018-17133 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/panghusec/exploit/issues/6
CVE ID: CVE-2018-17134 State: PUBLISHED Published: 2018-09-17T04:00:00 Last Updated: 2024-08-05T10:39:59.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/panghusec/exploit/issues/7
CVE ID: CVE-2018-17136 State: PUBLISHED Published: 2018-09-17T06:00:00 Last Updated: 2024-08-05T10:39:59.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: zzcms 8.3 contains a SQL Injection vulnerability in /user/check.php via a Client-Ip HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TEag1e/zzcms
CVE ID: CVE-2018-17137 State: PUBLISHED Published: 2018-09-17T06:00:00 Last Updated: 2024-08-05T10:39:59.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SE_DEBUG_PRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GitHubAssessments/CVE_Assessment_04_2018
CVE ID: CVE-2018-17138 State: PUBLISHED Published: 2018-09-17T06:00:00 Last Updated: 2024-08-05T10:39:59.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45305/
CVE ID: CVE-2018-17139 State: PUBLISHED Published: 2018-09-17T06:00:00 Last Updated: 2024-08-05T10:39:59.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45253/
CVE ID: CVE-2018-17140 State: PUBLISHED Published: 2018-09-17T06:00:00 Last Updated: 2024-08-05T10:39:59.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45307/
CVE ID: CVE-2018-17141 State: PUBLISHED Published: 2018-09-21T17:00:00 Last Updated: 2024-08-05T10:39:59.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00026.html - https://seclists.org/bugtraq/2018/Sep/49 - http://git.hylafax.org/HylaFAX?a=commit%3Bh=c6cac8d8cd0dbe313689ba77023e12bc5b3027be - https://www.x41-dsec.de/lab/a
9 - http://git.hylafax.org/HylaFAX?a=commit%3Bh=c6cac8d8cd0dbe313689ba77023e12bc5b3027be - https://www.x41-dsec.de/lab/advisories/x41-2018-008-hylafax/ - https://www.debian.org/security/2018/dsa-4298 - http://www.openwall.com/lists/oss-security/2018/09/20/1
CVE ID: CVE-2018-17142 State: PUBLISHED Published: 2018-09-17T14:00:00 Last Updated: 2024-08-05T10:39:59.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/go/issues/27702 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/me
KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
CVE ID: CVE-2018-17143 State: PUBLISHED Published: 2018-09-17T14:00:00 Last Updated: 2024-08-05T10:39:59.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call. Additional Analyst Notes: - CVE Program Container: References: - https://go-review.googlesource.com/c/net/+/136575 - https://github.com/golang/go/issues/27704 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/li
nounce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
CVE ID: CVE-2018-17144 State: PUBLISHED Published: 2018-09-19T08:00:00 Last Updated: 2024-08-05T10:39:59.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash. Additional Analyst Notes: - CVE Program Container: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17144 - https://github.com/bitcoin/bitcoin/blob/v0.16.3/doc/release-notes.md - https://bitcoincore.org/en/2018
#CVE-2018-17144 - https://github.com/bitcoin/bitcoin/blob/v0.16.3/doc/release-notes.md - https://bitcoincore.org/en/2018/09/18/release-0.16.3/ - https://github.com/bitcoinknots/bitcoin/blob/v0.16.3.knots20180918/doc/release-notes.md - https://github.com/JinBean/CVE-Extension
CVE ID: CVE-2018-17145 State: PUBLISHED Published: 2020-09-10T16:32:13 Last Updated: 2024-08-05T10:39:59.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145 - https://invdos.n
doc/release-notes.md - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145 - https://invdos.net/paper/CVE-2018-17145.pdf - https://invdos.net
CVE ID: CVE-2018-17146 State: PUBLISHED Published: 2019-06-19T17:25:16 Last Updated: 2024-08-05T10:39:59.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page. Additional Analyst Notes: - CVE Program Container: References: - https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
CVE ID: CVE-2018-17147 State: PUBLISHED Published: 2019-07-10T13:59:13 Last Updated: 2024-08-05T10:39:59.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI before 5.5.4 has XSS in the auto login admin management page. Additional Analyst Notes: - CVE Program Container: References: - https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT - http://www.securityfocus.com/bid/109116
CVE ID: CVE-2018-17148 State: PUBLISHED Published: 2019-06-19T17:23:25 Last Updated: 2024-08-05T10:39:59.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials. Additional Analyst Notes: - CVE Program Container: References: - https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
CVE ID: CVE-2018-17150 State: PUBLISHED Published: 2019-07-11T18:40:35 Last Updated: 2024-08-05T10:39:59.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intersystems Cache 2017.2.2.865.0 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities
CVE ID: CVE-2018-17151 State: PUBLISHED Published: 2019-07-11T18:44:53 Last Updated: 2024-08-05T10:39:59.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities
CVE ID: CVE-2018-17152 State: PUBLISHED Published: 2019-07-11T18:42:44 Last Updated: 2024-08-05T10:39:59.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intersystems Cache 2017.2.2.865.0 allows XXE. Additional Analyst Notes: - CVE Program Container: References: - https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities
CVE ID: CVE-2018-17153 State: PUBLISHED Published: 2018-09-18T00:00:00 Last Updated: 2024-08-05T10:39:59.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admi