Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://github.com/openemr/openemr/pull/1757/files
CVE ID: CVE-2018-15151 State: PUBLISHED Published: 2018-08-15T17:00:00 Last Updated: 2024-08-05T09:46:25.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in interface/de_identification_forms/find_code_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'search_term' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://insecurity.sh/reports/openemr.pdf - https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://github.com/openemr/open
vered-by-project-insecurity/ - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://github.com/openemr/openemr/pull/1757/files
CVE ID: CVE-2018-15152 State: PUBLISHED Published: 2018-08-15T17:00:00 Last Updated: 2024-08-05T09:46:25.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_c
rtal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php, or (15) portal/report/portal_patient_report.php without authenticating as a patient. Additional Analyst Notes: - CVE Program Container: References: - https://insecurity.sh/reports/openemr.pdf - https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://github.com/openemr/openemr/pull/1758/files - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - http://packetstormsecurity.com/files/163181/OpenEMR-5.0.1.3-Authentication-Bypass.
.org/wiki/index.php/OpenEMR_Patches - http://packetstormsecurity.com/files/163181/OpenEMR-5.0.1.3-Authentication-Bypass.html - https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-15152-Exploit
CVE ID: CVE-2018-15153 State: PUBLISHED Published: 2018-08-15T17:00:00 Last Updated: 2024-08-05T09:46:25.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/main/daemon_frame.php after modifying the "hylafax_server" global variable in interface/super/edit_globals.php. Additional Analyst Notes: - CVE Program Container: References: - https://insecurity.sh/reports/openemr.pdf - https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/wi
.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://github.com/openemr/openemr/pull/1757 - https://www.exploit-db.com/exploits/45161/
CVE ID: CVE-2018-15154 State: PUBLISHED Published: 2018-08-15T17:00:00 Last Updated: 2024-08-05T09:46:25.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/billing/sl_eob_search.php after modifying the "print_command" global variable in interface/super/edit_globals.php. Additional Analyst Notes: - CVE Program Container: References: - https://insecurity.sh/reports/openemr.pdf - https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org
www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://github.com/openemr/openemr/pull/1757
CVE ID: CVE-2018-15155 State: PUBLISHED Published: 2018-08-15T17:00:00 Last Updated: 2024-08-05T09:46:25.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/fax_dispatch.php after modifying the "hylafax_enscript" global variable in interface/super/edit_globals.php. Additional Analyst Notes: - CVE Program Container: References: - https://insecurity.sh/reports/openemr.pdf - https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/w
w.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://github.com/openemr/openemr/pull/1757
CVE ID: CVE-2018-15156 State: PUBLISHED Published: 2018-08-15T17:00:00 Last Updated: 2024-08-05T09:46:25.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/faxq.php after modifying the "hylafax_server" global variable in interface/super/edit_globals.php. Additional Analyst Notes: - CVE Program Container: References: - https://insecurity.sh/reports/openemr.pdf - https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/wiki/index.
ches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/ - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://github.com/openemr/openemr/pull/1757
CVE ID: CVE-2018-15157 State: PUBLISHED Published: 2018-09-01T03:00:00 Last Updated: 2024-08-05T09:46:25.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libfsclfs_block_read function in libfsclfs_block.c in libfsclfs before 2018-07-25 allows remote attackers to cause a heap-based buffer over-read via a crafted clfs file. NOTE: the vendor has disputed this as described in the GitHub issue comments Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libyal/libfsclfs/issues/3
CVE ID: CVE-2018-15158 State: PUBLISHED Published: 2018-09-01T03:00:00 Last Updated: 2024-08-05T09:46:25.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libesedb_page_read_values function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libyal/libesedb/issues/43
CVE ID: CVE-2018-15159 State: PUBLISHED Published: 2018-09-01T03:00:00 Last Updated: 2024-08-05T09:46:25.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libesedb_page_read_tags function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libyal/libesedb/issues/43
CVE ID: CVE-2018-15160 State: PUBLISHED Published: 2018-09-01T03:00:00 Last Updated: 2024-08-05T09:46:25.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libesedb_catalog_definition_read function in libesedb_catalog_definition.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libyal/libesedb/issues/43
CVE ID: CVE-2018-15161 State: PUBLISHED Published: 2018-09-01T03:00:00 Last Updated: 2024-08-05T09:46:25.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libesedb_key_append_data function in libesedb_key.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/libyal/libesedb/issues/43
CVE ID: CVE-2018-15168 State: PUBLISHED Published: 2018-08-08T00:00:00 Last Updated: 2024-08-05T09:46:25.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/issues.html - https://github.com/x-f1v3/ForCve/issues/2 - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-15168.html
CVE ID: CVE-2018-15169 State: PUBLISHED Published: 2018-08-08T00:00:00 Last Updated: 2024-08-05T09:46:25.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/issues.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-15169.html - https://github.com/x-f1v3/ForCve/issues/3
CVE ID: CVE-2018-15172 State: PUBLISHED Published: 2018-08-15T17:00:00 Last Updated: 2024-08-05T09:46:25.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link WR840N devices have a buffer overflow via a long Authorization HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45203/ - https://hackingvila.wordpress.com/2018/08/08/tp-link-buffer-overflow-via-a-long-authorization-http-header-cve-2018-15172/
CVE ID: CVE-2018-15173 State: PUBLISHED Published: 2018-08-08T00:00:00 Last Updated: 2024-08-05T09:46:25.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2018/07/crashing-nmap-770.html - http://code610.blogspot.com/2018/07/crashing-nmap-760.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00067.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html - http://lists.o
unce/2019-05/msg00067.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html - https://security.netapp.com/advisory/ntap-20200827-0004/
CVE ID: CVE-2018-15174 State: PUBLISHED Published: 2018-08-08T00:00:00Z Last Updated: 2024-09-17T00:21:16.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView 2.45 allows remote attackers to cause a denial of service (Read Access Violation at the Instruction Pointer and application crash) or possibly have unspecified other impact via a crafted ICO file. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2018/08/updating-xnview.html
CVE ID: CVE-2018-15175 State: PUBLISHED Published: 2018-08-08T00:00:00Z Last Updated: 2024-09-17T03:38:27.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView 2.45 allows remote attackers to cause a denial of service (User Mode Write AV starting at Qt5Core!QVariant::~QVariant+0x0000000000000014 and application crash) or possibly have unspecified other impact via a crafted RLE file. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2018/08/updating-xnview.html
CVE ID: CVE-2018-15176 State: PUBLISHED Published: 2018-08-08T00:00:00Z Last Updated: 2024-09-16T19:05:09.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView 2.45 allows remote attackers to cause a denial of service (User Mode Write AV starting at MSVCR120!memcpy+0x0000000000000074 and application crash) or possibly have unspecified other impact via a crafted RLE file. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2018/08/updating-xnview.html
CVE ID: CVE-2018-15177 State: PUBLISHED Published: 2018-08-08T00:00:00 Last Updated: 2024-08-05T09:46:25.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/gxlcms/gxlcms_news_system_2/issues/ILVLP
CVE ID: CVE-2018-15178 State: PUBLISHED Published: 2018-08-08T00:00:00 Last Updated: 2024-08-05T09:46:25.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/issues/5364 - https://github.com/gogs/gogs/pull/5365
CVE ID: CVE-2018-15180 State: PUBLISHED Published: 2019-04-02T16:29:58 Last Updated: 2024-08-05T09:46:25.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: qTest Portal in QASymphony qTest Manager 9.0.0 has an Open Redirect via the /portal/loginform redirect parameter. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/0B60g8JcPElCCNHd1R2pPNzVGdy1ITjIza1VubWlUekoyNGhR/view
CVE ID: CVE-2018-15181 State: PUBLISHED Published: 2018-08-09T19:00:00 Last Updated: 2024-08-05T09:46:25.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service (secure configuration outage) via an XSS payload in the SSID name and Security Key fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45199/ - https://gkaim.com/cve-2018-15181-vikas-chaudhary/
CVE ID: CVE-2018-15182 State: PUBLISHED Published: 2018-08-09T19:00:00 Last Updated: 2024-08-05T09:46:25.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15182-vikas-chaudhary/
CVE ID: CVE-2018-15183 State: PUBLISHED Published: 2018-08-09T19:00:00 Last Updated: 2024-08-05T09:46:25.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15183-vikas-chaudhary/
CVE ID: CVE-2018-15184 State: PUBLISHED Published: 2018-08-09T19:00:00 Last Updated: 2024-08-05T09:46:25.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15184-vikas-chaudhary/
CVE ID: CVE-2018-15185 State: PUBLISHED Published: 2018-08-10T15:00:00 Last Updated: 2024-08-05T09:46:25.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page update outage) via crafted PHP and JavaScript code in the "Current Position" field. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15185-vikas-chaudhary/
CVE ID: CVE-2018-15186 State: PUBLISHED Published: 2018-08-10T15:00:00 Last Updated: 2024-08-05T09:46:25.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15186-vikas-chaudhary/
CVE ID: CVE-2018-15187 State: PUBLISHED Published: 2018-08-10T15:00:00 Last Updated: 2024-08-05T09:46:25.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15187-vikas-chaudhary/
CVE ID: CVE-2018-15188 State: PUBLISHED Published: 2018-08-10T15:00:00 Last Updated: 2024-08-05T09:46:25.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in the Name field of a profile. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15188-vikas-chaudhary/
CVE ID: CVE-2018-15189 State: PUBLISHED Published: 2018-08-10T15:00:00 Last Updated: 2024-08-05T09:46:25.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15189-vikas-chaudhary/
CVE ID: CVE-2018-15190 State: PUBLISHED Published: 2018-08-10T17:00:00 Last Updated: 2024-08-05T09:46:25.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15190-vikas-chaudhary/
CVE ID: CVE-2018-15191 State: PUBLISHED Published: 2018-08-10T17:00:00 Last Updated: 2024-08-05T09:46:25.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall hotel-booking-script 2.0.4 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, or Address field. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2018-15191-vikas-chaudhary/
CVE ID: CVE-2018-15192 State: PUBLISHED Published: 2018-08-08T02:00:00Z Last Updated: 2024-09-16T17:22:51.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/issues/5366 - https://github.com/go-gitea/gitea/issues/4624
CVE ID: CVE-2018-15193 State: PUBLISHED Published: 2018-08-08T02:00:00Z Last Updated: 2024-09-16T19:05:24.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/issues/5367
CVE ID: CVE-2018-15197 State: PUBLISHED Published: 2018-08-08T03:00:00Z Last Updated: 2024-09-17T02:46:36.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/liu21st/onethink/issues/36
CVE ID: CVE-2018-15198 State: PUBLISHED Published: 2018-08-08T03:00:00Z Last Updated: 2024-09-17T01:40:47.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/liu21st/onethink/issues/36
CVE ID: CVE-2018-15199 State: PUBLISHED Published: 2018-08-08T03:00:00Z Last Updated: 2024-09-17T03:02:01.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auracms/AuraCMS/issues/1
CVE ID: CVE-2018-15202 State: PUBLISHED Published: 2018-08-08T04:00:00Z Last Updated: 2024-09-16T20:11:37.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/template/includes/crudTreatment.php that can add new users and add products. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Juunan06/eCommerce/issues/1
CVE ID: CVE-2018-15203 State: PUBLISHED Published: 2018-08-08T04:00:00Z Last Updated: 2024-09-16T17:39:14.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/add_page allows a CSRF attack to add pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ignitedcms/ignitedcms/issues/4
CVE ID: CVE-2018-15206 State: PUBLISHED Published: 2019-04-30T18:42:41 Last Updated: 2024-08-05T09:46:25.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf. Additional Analyst Notes: - CVE Program Container: References: - https://neetech18.blogspot.com/2019/03/cross-site-request-forgery-smartvista.html
CVE ID: CVE-2018-15207 State: PUBLISHED Published: 2019-04-30T18:45:23 Last Updated: 2024-08-05T09:46:25.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin. Additional Analyst Notes: - CVE Program Container: References: - https://neetech18.blogspot.com/2019/03/incorrect-access-control-smart-vista.html
CVE ID: CVE-2018-15208 State: PUBLISHED Published: 2019-04-30T18:47:44 Last Updated: 2024-08-05T09:46:25.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://neetech18.blogspot.com/2019/03/session-fixation-smart-vista-svfe-2.html
CVE ID: CVE-2018-15209 State: PUBLISHED Published: 2018-08-08T04:00:00 Last Updated: 2024-08-05T09:46:25.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4349 - http://bugzilla.maptools.org/show_bug.cgi?id=2808 - http://www.securityfocus.com/bid/105092