Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-12923 State: PUBLISHED Published: 2018-06-28T11:00:00 Last Updated: 2024-08-05T08:45:02.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97373
CVE ID: CVE-2018-12924 State: PUBLISHED Published: 2018-06-28T11:00:00 Last Updated: 2024-08-05T08:45:02.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET service. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97374
CVE ID: CVE-2018-12925 State: PUBLISHED Published: 2018-06-28T11:00:00 Last Updated: 2024-08-05T08:45:02.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: Baseon Lantronix MSS devices do not require a password for TELNET access. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97375
CVE ID: CVE-2018-12926 State: PUBLISHED Published: 2018-06-28T11:00:00 Last Updated: 2024-08-05T08:45:02.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97376
CVE ID: CVE-2018-12927 State: PUBLISHED Published: 2018-06-28T11:00:00 Last Updated: 2024-08-05T08:45:02.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97377
CVE ID: CVE-2018-12928 State: PUBLISHED Published: 2018-06-28T14:00:00 Last Updated: 2024-08-05T08:45:02.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104593 - https://marc.info/?l=linux-fsdevel&m=152407263325766&w=2 - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763384
CVE ID: CVE-2018-12929 State: PUBLISHED Published: 2018-06-28T14:00:00 Last Updated: 2024-08-05T08:45:02.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=linux-ntfs-dev&m=152413769810234&w=2 - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403 - http://www.securityfocus.com/bid/104588 - https://access.redhat.com/errata/RHSA-2019:0641
CVE ID: CVE-2018-12930 State: PUBLISHED Published: 2018-06-28T14:00:00 Last Updated: 2024-08-05T08:45:02.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=linux-ntfs-dev&m=152413769810234&w=2 - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403 - http://www.securityfocus.com/bid/104588 - https://access.redhat.com/
s.launchpad.net/ubuntu/+source/linux/+bug/1763403 - http://www.securityfocus.com/bid/104588 - https://access.redhat.com/errata/RHSA-2019:0641
CVE ID: CVE-2018-12931 State: PUBLISHED Published: 2018-06-28T14:00:00 Last Updated: 2024-08-05T08:45:02.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=linux-ntfs-dev&m=152413769810234&w=2 - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403 - http://www.securityfocus.com/bid/104588 - https://access.redhat.com/errata/RHSA-
net/ubuntu/+source/linux/+bug/1763403 - http://www.securityfocus.com/bid/104588 - https://access.redhat.com/errata/RHSA-2019:0641
CVE ID: CVE-2018-12932 State: PUBLISHED Published: 2018-06-28T14:00:00Z Last Updated: 2024-09-17T04:20:35.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by triggering a large pAlphaBlend->cbBitsSrc value. Additional Analyst Notes: - CVE Program Container: References: - https://source.winehq.org/git/wine.git/commit/b6da3547d8990c3c3affc3a5865aefd2a0946949 - https://source.winehq.org/git/wine.git/commit/8d2676fd14f130f9e8f06744743423168bf8d18d - https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719 - https
it/commit/8d2676fd14f130f9e8f06744743423168bf8d18d - https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719 - https://bugs.winehq.org/attachment.cgi?id=61284 - https://bugs.winehq.org/show_bug.cgi?id=45105
CVE ID: CVE-2018-12933 State: PUBLISHED Published: 2018-06-28T14:00:00Z Last Updated: 2024-09-17T01:41:30.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact because the attacker controls the pCreatePen->ihPen array index. Additional Analyst Notes: - CVE Program Container: References: - https://source.winehq.org/git/wine.git/commit/b6da3547d8990c3c3affc3a5865aefd2a0946949 - https://bugs.winehq.org/show_bug.cgi?id=45106 - https://bugs.winehq.org/attachment.cgi?id=61285 - https://source.winehq.org/git/wine.git/commit/8d2676
ug.cgi?id=45106 - https://bugs.winehq.org/attachment.cgi?id=61285 - https://source.winehq.org/git/wine.git/commit/8d2676fd14f130f9e8f06744743423168bf8d18d - https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719
CVE ID: CVE-2018-12934 State: PUBLISHED Published: 2018-06-28T14:00:00 Last Updated: 2024-08-05T08:52:49.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=23059 - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85453 - https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763101 - https://usn.ubuntu.com/4326-1/ - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-12938 State: REJECTED Published: 2018-06-28T23:00:00 Last Updated: 2018-07-06T19:57:02 Description: No description available.
CVE ID: CVE-2018-12939 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T08:52:49.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary files via a .. (dot dot) in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using CVE-2018-12940. Additional Analyst Notes: - CVE Program Container: References: - https://www.contextis.com/resources/advisories/cve-2018-12939 - https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG
CVE ID: CVE-2018-12940 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T08:52:49.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in "op/op.UploadChunks.php" in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the "qqfile" parameter. This allows an authenticated attacker to upload a malicious file containing PHP code to execute operating system commands to the web root of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.contextis.com/resources/advisories/cve-2
n. Additional Analyst Notes: - CVE Program Container: References: - https://www.contextis.com/resources/advisories/cve-2018-12940 - https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG
CVE ID: CVE-2018-12941 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T08:52:49.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: This vulnerability allows remote attackers to execute arbitrary code in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 by adding a system command at the end of the "cacheDir" path and following usage of the "Clear Cache" functionality. This allows an authenticated attacker, with permission to the Settings functionality, to inject arbitrary system commands within the application by manipulating the "Cache directory" path. An attacker can use it to perform malicious tasks such as to extract, change, or delete sensitive infor
directory" path. An attacker can use it to perform malicious tasks such as to extract, change, or delete sensitive information or run system commands on the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://www.contextis.com/resources/advisories/cve-2018-12941 - https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG
CVE ID: CVE-2018-12942 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T08:52:49.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "Users management" functionality in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows authenticated attackers to manipulate an SQL query within the application by sending additional SQL commands to the application server. An attacker can use this vulnerability to perform malicious tasks such as to extract, change, or delete sensitive information within the database supporting the application, and potentially run system commands on the underlying operating system. Additional Analyst No
upporting the application, and potentially run system commands on the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG - https://www.contextis.com/resources/advisories/cve-2018-12942
CVE ID: CVE-2018-12943 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T08:52:49.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in every page that includes the "action" URL parameter in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.contextis.com/resources/advisories/cve-2018-12943 - https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG
CVE ID: CVE-2018-12944 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T08:52:49.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG - https://www.contextis.com/resources/advisories/cve-2018-12944
CVE ID: CVE-2018-12959 State: PUBLISHED Published: 2018-07-19T20:00:00 Last Updated: 2024-08-05T08:52:49.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all contract balances into their account). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rootclay/Audit-of-smart-contracts/tree/master/0x8810C63470d38639954c6B41AaC545848C46484a
CVE ID: CVE-2018-12971 State: PUBLISHED Published: 2018-06-29T05:00:00 Last Updated: 2024-08-05T08:52:49.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/teameasy/EasyCMS/issues/3
CVE ID: CVE-2018-12972 State: PUBLISHED Published: 2018-06-29T05:00:00 Last Updated: 2024-08-05T08:52:49.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenTSDB/opentsdb/issues/1239
CVE ID: CVE-2018-12973 State: PUBLISHED Published: 2018-06-29T05:00:00 Last Updated: 2024-08-05T08:52:49.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenTSDB/opentsdb/issues/1240
CVE ID: CVE-2018-12975 State: PUBLISHED Published: 2018-09-24T22:00:00 Last Updated: 2024-08-05T08:52:49.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable (which can be read with a getStorageAt call). Therefore, attackers can precompute the random number and manipulate the game (e.g., get powerful characters or get critical damages). Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40jonghyk.song/create-legendary-champs-by
onal Analyst Notes: - CVE Program Container: References: - https://medium.com/%40jonghyk.song/create-legendary-champs-by-breaking-prng-of-cryptosaga-an-ethereum-rpg-game-cve-2018-12975-8de733ff8255
CVE ID: CVE-2018-12976 State: PUBLISHED Published: 2018-07-05T18:00:00 Last Updated: 2024-08-05T08:52:49.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Go Doc Dot Org (gddo) through 2018-06-27, an attacker could use specially crafted <go-import> tags in packages being fetched by gddo to cause a directory traversal and remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21msg/golang-announce/4rpTbfzYB1k/no6MEwlQAwAJ - https://github.com/golang/gddo/commit/daffe1f90ec57f8ed69464f9094753fc6452e983
CVE ID: CVE-2018-12977 State: PUBLISHED Published: 2018-07-09T18:00:00 Last Updated: 2024-08-05T08:52:49.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the SoftExpert (SE) Excellence Suite 2.0 allows remote authenticated users to perform SQL heuristics by pulling information from the database with the "cddocument" parameter in the "Downloading Electronic Documents" section. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44981/
CVE ID: CVE-2018-12979 State: PUBLISHED Published: 2018-07-12T18:00:00 Last Updated: 2024-08-05T08:52:49.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwrite critical files by abusing the unrestricted file upload in the WBM. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2018-010 - https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02 - https://ww
tion-via-multiple-attack-vectors-in-wago-edisplay/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02 - https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjU - https://www.exploit-db.com/exploits/45014/ - http://seclists.org/fulldisclosure/2018/Jul/38
CVE ID: CVE-2018-12980 State: PUBLISHED Published: 2018-07-12T18:00:00 Last Updated: 2024-08-05T08:52:49.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2018-010 - https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02 - htt
e-execution-via-multiple-attack-vectors-in-wago-edisplay/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02 - https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjU - https://www.exploit-db.com/exploits/45014/ - http://seclists.org/fulldisclosure/2018/Jul/38
CVE ID: CVE-2018-12981 State: PUBLISHED Published: 2018-07-12T18:00:00 Last Updated: 2024-08-05T08:52:49.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be rendered and/or executed in the browser of the user's browser. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2018-010 - https://www.sec-consult.com/en/blog/advisories/remote-cod
rences: - https://cert.vde.com/en-us/advisories/vde-2018-010 - https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02 - https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjU - https://www.exploit-db.com/exploits/45014/ - http://seclists.org/fulldisclosure/2018/Jul/38
CVE ID: CVE-2018-12982 State: PUBLISHED Published: 2018-06-29T05:00:00 Last Updated: 2024-08-05T08:52:49.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1595689
CVE ID: CVE-2018-12983 State: PUBLISHED Published: 2018-06-29T05:00:00 Last Updated: 2024-08-05T08:52:49.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a denial-of-service via a crafted pdf file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1595693 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEJQUDZT4JRJSPZYY3UPSCTFPAC5TUHK/ - https://lists.fedoraproject.org/archives/list/package-announ
doraproject.org/message/LEJQUDZT4JRJSPZYY3UPSCTFPAC5TUHK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMEMSUUXA3SL3AZAKKCTZFXVPHTBBK3O/
CVE ID: CVE-2018-12984 State: PUBLISHED Published: 2018-06-29T05:00:00 Last Updated: 2024-08-05T08:52:49.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44954/
CVE ID: CVE-2018-12988 State: PUBLISHED Published: 2018-06-29T05:00:00 Last Updated: 2024-08-05T08:52:49.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GreenCMS/GreenCMS/issues/111
CVE ID: CVE-2018-12989 State: PUBLISHED Published: 2018-08-03T18:00:00 Last Updated: 2024-08-05T08:52:49.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet Explorer or Microsoft Edge as Administrator, which allows local users to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://computeco.de/2018-07-29_1.html - https://certiport.pearsonvue.com/Support/Console-system-updates
CVE ID: CVE-2018-12990 State: PUBLISHED Published: 2018-06-30T14:00:00 Last Updated: 2024-08-05T08:52:49.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field. Additional Analyst Notes: - CVE Program Container: References: - https://3xpl01tc0d3r.blogspot.com/2018/06/information-disclosure-internal-path.html
CVE ID: CVE-2018-12992 State: PUBLISHED Published: 2018-06-29T12:00:00 Last Updated: 2024-08-05T08:52:49.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lzlzh2016/MaeloStore/blob/master/ccXSS.md
CVE ID: CVE-2018-12993 State: PUBLISHED Published: 2018-06-29T12:00:00 Last Updated: 2024-08-05T08:52:49.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rocktronica/OneFileCMS/issues/6
CVE ID: CVE-2018-12994 State: PUBLISHED Published: 2018-06-29T12:00:00 Last Updated: 2024-08-05T08:52:49.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rocktronica/OneFileCMS/issues/7