Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-10703 State: PUBLISHED Published: 2019-06-07T19:56:34 Last Updated: 2024-08-05T07:46:46.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_serverip" is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/samuelhuntle
CVE ID: CVE-2018-10704 State: PUBLISHED Published: 2020-03-12T20:23:03 Last Updated: 2024-08-05T07:46:46.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: yidashi yii2cmf 2.0 has XSS via the /search q parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yidashi/yii2cmf - http://testh5shanglv.minshengec.com:1024/phpmyadmin/doc/yii2cmf_xss.htm
CVE ID: CVE-2018-10705 State: PUBLISHED Published: 2018-05-09T03:00:00 Last Updated: 2024-08-05T07:46:46.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Owned smart contract implementation for Aurora DAO (AURA), an Ethereum ERC20 token, allows attackers to acquire contract ownership because the setOwner function is declared as public. An attacker can then conduct a lockBalances() denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://peckshield.com/2018/05/03/ownerAnyone/
CVE ID: CVE-2018-10706 State: PUBLISHED Published: 2018-05-10T17:00:00 Last Updated: 2024-08-05T07:46:46.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in the transferMulti function of a smart contract implementation for Social Chain (SCA), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets, aka the "multiOverflow" issue. Additional Analyst Notes: - CVE Program Container: References: - https://peckshield.com/2018/05/10/multiOverflow/
CVE ID: CVE-2018-10709 State: PUBLISHED Published: 2018-10-30T18:00:00 Last Updated: 2024-08-05T07:46:46.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write CR register values. This could be leveraged in a number of ways to ultimately run code with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities - https://www.exploit-db.com/exploits/45716/
CVE ID: CVE-2018-10710 State: PUBLISHED Published: 2018-10-30T18:00:00 Last Updated: 2024-08-05T07:46:46.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities - https://www.exploit-db.com/exploits/45716/
CVE ID: CVE-2018-10711 State: PUBLISHED Published: 2018-10-30T18:00:00 Last Updated: 2024-08-05T07:46:46.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write Machine Specific Registers (MSRs). This could be leveraged to execute arbitrary ring-0 code. Additional Analyst Notes: - CVE Program Container: References: - https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities - https://www.exploit-db.com/exploits/45716/
CVE ID: CVE-2018-10712 State: PUBLISHED Published: 2018-10-30T18:00:00 Last Updated: 2024-08-05T07:46:46.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities - https://www.exploit-db.com/exploits/45716/
CVE ID: CVE-2018-10713 State: PUBLISHED Published: 2018-05-03T16:00:00Z Last Updated: 2024-09-16T18:43:49.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'read' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'read <node_name>' function and cause memory corruption. Furthermore, it is possible to redirect the flow of the program and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kgsdy/D-Link-DSL-3782-EU
CVE ID: CVE-2018-10716 State: PUBLISHED Published: 2018-05-03T17:00:00Z Last Updated: 2024-09-16T16:48:32.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe allow local users to bypass intended process protections, and consequently terminate processes, because WM_CLOSE is not properly considered. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rebol0x6c/2345_msg_poc
CVE ID: CVE-2018-10717 State: PUBLISHED Published: 2018-05-03T17:00:00Z Last Updated: 2024-09-16T20:36:55.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file, a different vulnerability than CVE-2018-10677. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/ngiflib/issues/3 - https://github.com/miniupnp/ngiflib/commit/cf429e0a2fe26b5f01
ferences: - https://github.com/miniupnp/ngiflib/issues/3 - https://github.com/miniupnp/ngiflib/commit/cf429e0a2fe26b5f01ce0c8e9b79432e94509b6e
CVE ID: CVE-2018-10718 State: PUBLISHED Published: 2018-05-03T18:00:00 Last Updated: 2024-08-05T07:46:46.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute arbitrary code via crafted packets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/momo5502/cod-exploit - https://momo5502.com/blog/?p=34 - https://www.exploit-db.com/exploits/44987/
CVE ID: CVE-2018-10722 State: PUBLISHED Published: 2018-05-04T00:00:00 Last Updated: 2024-08-05T07:46:46.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cylance CylancePROTECT before 1470, an unprivileged local user can obtain SYSTEM privileges because users have Modify access to the %PROGRAMFILES%\Cylance\Desktop\log folder, the CyUpdate process grants users Modify access to new files created in this folder, and a new file can be a symlink chain to a pathname of an arbitrary DLL that CyUpdate uses. Additional Analyst Notes: - CVE Program Container: References: - https://www.atredis.com/blog/cylance-privilege-escalation-vulnerability
CVE ID: CVE-2018-10723 State: PUBLISHED Published: 2018-05-05T22:00:00 Last Updated: 2024-08-05T07:46:46.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/llandeilocymro/2438a0b5aba8b387c86d7e3181ecbe76
CVE ID: CVE-2018-10726 State: PUBLISHED Published: 2018-05-04T15:00:00Z Last Updated: 2024-09-16T20:01:32.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/datenstrom/yellow/issues/321
CVE ID: CVE-2018-10727 State: PUBLISHED Published: 2019-10-29T17:33:59 Last Updated: 2024-08-05T07:46:46.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Fabrik/fabrik/issues/2033
CVE ID: CVE-2018-10728 State: PUBLISHED Published: 2018-05-17T19:00:00 Last Updated: 2024-08-05T07:46:46.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows (a different vulnerability than CVE-2018-10731). Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02 - http://www.securityfocus.com/bid/104231 - https://cert.vde.com/de-de/advisories/vde-2018-006
CVE ID: CVE-2018-10729 State: PUBLISHED Published: 2018-05-17T19:00:00 Last Updated: 2024-08-05T07:46:46.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/de-de/advisories/vde-2018-005 - https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02 - http://www.securityfocus.com/bid/104231
CVE ID: CVE-2018-10730 State: PUBLISHED Published: 2018-05-17T19:00:00 Last Updated: 2024-08-05T07:46:46.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02 - https://cert.vde.com/de-de/advisories/vde-2018-004 - http://www.securityfocus.com/bid/104231
CVE ID: CVE-2018-10731 State: PUBLISHED Published: 2018-05-17T19:00:00 Last Updated: 2024-08-05T07:46:46.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies (a different vulnerability than CVE-2018-10728). Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02 - https://cert.vde.com/de-de/advisories/vde-2018-007 - http://www.securityfocus.com/bid/104231
CVE ID: CVE-2018-10732 State: PUBLISHED Published: 2018-05-28T17:00:00 Last Updated: 2024-08-05T07:46:46.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: The REST API in Dataiku DSS before 4.2.3 allows remote attackers to obtain sensitive information (i.e., determine if a username is valid) because of profile pictures visibility. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alt3kx/CVE-2018-10732 - https://doc.dataiku.com/dss/latest/release_notes/4.2.html#security
CVE ID: CVE-2018-10733 State: PUBLISHED Published: 2018-05-04T16:00:00 Last Updated: 2024-08-05T07:46:46.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead to a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3505 - https://access.redhat.com/errata/RHSA-2018:3140 - https://bugzilla.redhat.com/show_bug.cgi?id=1574844 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00005.html - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2018-10734 State: PUBLISHED Published: 2018-05-08T07:00:00 Last Updated: 2024-08-05T07:46:46.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a Print_Password function call in certain circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hucmosin/MyBook/blob/master/fu/DVR.pdf - https://github.com/hucmosin/MyBook/blob/master/KONGTOP_DVR_devices_vulnerability_report-CVE-2018-10734.pdf - https://github.com/hucmosin/Python_Small_Tool/blob/master/other/DVR_POC.py
CVE ID: CVE-2018-10735 State: PUBLISHED Published: 2018-05-16T13:00:00 Last Updated: 2024-08-05T07:46:46.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97265
CVE ID: CVE-2018-10736 State: PUBLISHED Published: 2018-05-16T13:00:00 Last Updated: 2024-08-05T07:46:46.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97266
CVE ID: CVE-2018-10737 State: PUBLISHED Published: 2018-05-16T13:00:00 Last Updated: 2024-08-05T07:46:47.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97267
CVE ID: CVE-2018-10738 State: PUBLISHED Published: 2018-05-16T13:00:00 Last Updated: 2024-08-05T07:46:46.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97268
CVE ID: CVE-2018-10739 State: PUBLISHED Published: 2018-05-04T17:00:00Z Last Updated: 2024-09-16T20:41:33.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe allows local users to bypass intended process protections, and consequently terminate process, because WM_SYSCOMMAND is not properly considered. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rebol0x6c/2345_wm_syscommand
CVE ID: CVE-2018-10740 State: PUBLISHED Published: 2018-05-04T18:00:00 Last Updated: 2024-08-05T07:46:46.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Axublog 1.1.0 allows remote Code Execution as demonstrated by injection of PHP code (contained in the webkeywords parameter) into the cmsconfig.php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axublog/axublog/issues/1
CVE ID: CVE-2018-10746 State: PUBLISHED Published: 2018-05-04T18:00:00Z Last Updated: 2024-09-16T23:57:01.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'get' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'get <node_name attr>' function and cause memory corruption. Furthermore, it is possible to redirect the flow of the program and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kgsdy/D-Link-DSL-3782-EU/blob/master/get.md
CVE ID: CVE-2018-10747 State: PUBLISHED Published: 2018-05-04T18:00:00Z Last Updated: 2024-09-16T17:09:05.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as an 'unset' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'unset <node_name>' function and cause memory corruption. Furthermore, it is possible to redirect the flow of the program and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kgsdy/D-Link-DSL-3782-EU/blob/master/unset.md
CVE ID: CVE-2018-10748 State: PUBLISHED Published: 2018-05-04T18:00:00Z Last Updated: 2024-09-16T22:21:02.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'show' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'show <node_name>' function and cause memory corruption. Furthermore, it is possible to redirect the flow of the program and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kgsdy/D-Link-DSL-3782-EU/blob/master/show.md
CVE ID: CVE-2018-10749 State: PUBLISHED Published: 2018-05-04T18:00:00Z Last Updated: 2024-09-16T19:52:01.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'commit' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'commit <node_name>' function and cause memory corruption. Furthermore, it is possible to redirect the flow of the program and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kgsdy/D-Link-DSL-3782-EU/blob/master/commit.md
CVE ID: CVE-2018-10750 State: PUBLISHED Published: 2018-05-04T18:00:00Z Last Updated: 2024-09-17T03:37:34.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'staticGet' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'staticGet <node_name attr>' function and cause memory corruption. Furthermore, it is possible to redirect the flow of the program and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kgsdy/D-Link-DSL-3782-EU/blob/master/staticGet.md
CVE ID: CVE-2018-10751 State: PUBLISHED Published: 2018-05-29T20:00:00 Last Updated: 2024-08-05T07:46:46.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of the WbXml payload. This is due to an integer overflow in memory allocation for this string. The Samsung ID is SVE-2018-11463. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44724/ - http://packetstormsecurity.com/files/147841/Samsung-Galaxy-S7-Edge-OMACP-WbXml-String-Extension-Processing-Overflow.html - https://security.samsungmobile.co
/147841/Samsung-Galaxy-S7-Edge-OMACP-WbXml-String-Extension-Processing-Overflow.html - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2018-10752 State: PUBLISHED Published: 2018-05-05T02:00:00 Last Updated: 2024-08-05T07:46:46.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45225/ - https://pastebin.com/ZGr5tyP2
CVE ID: CVE-2018-10753 State: PUBLISHED Published: 2018-05-05T02:00:00 Last Updated: 2024-08-05T07:46:46.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the delayed_output function in music.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leesavide/abcm2ps/issues/16 - https://drive.google.com/drive/u/2/folders/1DvBEh5D-eW4UkvX3947UQh62i7hUIFN1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSTB65NYYCKU7O6RF5B6CYY5IA6C
://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSTB65NYYCKU7O6RF5B6CYY5IA6CA66Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6DUTXB4EC3TQHTTAAIBKJ54GJTF6Y7V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGDXW2I3MY3QH4PJXLJET5QZZXMXTNWO/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00015.html
CVE ID: CVE-2018-10754 State: REJECTED Published: 2018-05-05T02:00:00 Last Updated: 2019-08-30T17:27:07 Description: No description available.
CVE ID: CVE-2018-10755 State: REJECTED Published: 2018-05-29T21:00:00 Last Updated: 2018-05-29T20:57:01 Description: No description available.
CVE ID: CVE-2018-10756 State: PUBLISHED Published: 2020-05-15T15:56:21 Last Updated: 2024-08-05T07:46:46.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/transmission/transmission/commit/2123adf8e5e1c2b48791f9d22fc8c747e974180e - https://tomrichards.net/2020/05/cve-2018-10756-transmission/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVAG2HNKNRLWOAC
sion/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVAG2HNKNRLWOACFN5F2ANJD2SQ53WI7/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00022.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CD3GLZ5URIK74RCGLSH72IVLDIJJMLQC/ - https://security.gentoo.org/glsa/202007-07 - https://lists.debian.org/debian-lts-announce/2020/08/msg00001.html
CVE ID: CVE-2018-10757 State: PUBLISHED Published: 2018-05-05T19:00:00 Last Updated: 2024-08-05T07:46:46.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44589/ - https://github.com/dukereborn/cmum/commit/c89158ec646c4e8e95587b650f6fd86b502ff8b5 - https://packetstormsecurity.com/files/147501/cspmysqlum231-sql.txt
CVE ID: CVE-2018-10758 State: PUBLISHED Published: 2018-05-05T19:00:00Z Last Updated: 2024-09-17T03:43:20.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datenstrom/yellow/issues/322