Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-20997 State: PUBLISHED Published: 2019-08-26T17:12:03 Last Updated: 2024-08-05T12:19:27.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2018-0010.html
CVE ID: CVE-2018-20998 State: PUBLISHED Published: 2019-08-26T17:11:29 Last Updated: 2024-08-05T12:19:27.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2018-0011.html
CVE ID: CVE-2018-20999 State: PUBLISHED Published: 2019-08-26T14:25:58 Last Updated: 2024-08-05T12:19:27.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2018-0012.html - https://github.com/brycx/orion/issues/46
CVE ID: CVE-2018-21000 State: PUBLISHED Published: 2019-08-26T14:29:49 Last Updated: 2024-08-05T12:19:27.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2018-0013.html - https://github.com/nabijaczleweli/safe-transmute-rs/pull/36
CVE ID: CVE-2018-21001 State: PUBLISHED Published: 2019-08-27T11:18:05 Last Updated: 2024-08-05T12:19:27.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: The anycomment plugin before 0.0.33 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/anycomment/#developers
CVE ID: CVE-2018-21002 State: PUBLISHED Published: 2019-08-27T11:24:58 Last Updated: 2024-08-05T12:19:27.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: The js-support-ticket plugin before 2.0.6 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/js-support-ticket/#developers
CVE ID: CVE-2018-21003 State: PUBLISHED Published: 2019-08-27T11:26:17 Last Updated: 2024-08-05T12:19:27.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: The buddyforms plugin before 2.2.8 for WordPress has SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/buddyforms/#developers - https://wpvulndb.com/vulnerabilities/9829
CVE ID: CVE-2018-21004 State: PUBLISHED Published: 2019-08-27T11:40:36 Last Updated: 2024-08-05T12:19:27.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/rsvpmaker/#developers - https://plugins.trac.wordpress.org/log/rsvpmaker/tags/5.6.4 - https://wpvulndb.com/vulnerabilities/9831
CVE ID: CVE-2018-21005 State: PUBLISHED Published: 2019-08-27T11:54:00 Last Updated: 2024-08-05T12:19:27.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bbp-move-topics plugin before 1.1.6 for WordPress has code injection. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/bbp-move-topics/#developers
CVE ID: CVE-2018-21006 State: PUBLISHED Published: 2019-08-27T11:56:05 Last Updated: 2024-08-05T12:19:27.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/bbp-move-topics/#developers
CVE ID: CVE-2018-21007 State: PUBLISHED Published: 2019-08-29T11:20:24 Last Updated: 2024-08-05T12:19:27.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/woo-confirmation-email/#developers - https://wpvulndb.com/vulnerabilities/9847
CVE ID: CVE-2018-21008 State: PUBLISHED Published: 2019-09-04T20:33:24 Last Updated: 2024-08-05T12:19:27.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abd39c6ded9db53aa44c2540092bdd5fb6590fa8 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.7 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http://lists.opensuse
.x/ChangeLog-4.16.7 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html - https://security.netapp.com/advisory/ntap-20191004-0001/ - https://usn.ubuntu.com/4162-1/ - https://usn.ubuntu.com/4163-1/ - https://usn.ubuntu.com/4163-2/ - https://usn.ubuntu.com/4162-2/ - http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
CVE ID: CVE-2018-21009 State: PUBLISHED Published: 2019-09-05T03:24:29 Last Updated: 2024-08-05T12:19:27.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/commit/0868c499a9f5f37f8df5c9fef03c37496b40fc8a - https://lists.debian.org/debian-lts-announce/2019/09/msg00033.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html
CVE ID: CVE-2018-21010 State: PUBLISHED Published: 2019-09-05T12:52:29 Last Updated: 2024-08-05T12:19:27.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/10/msg00009.html - https://security.gentoo.org/glsa/202101-29 - https://www.oracle.com//security-alerts/cpujul2021.html - https://github.com/uclouvain/openjpeg/commit/2e5ab1d9987831c981ff05862e8ccf1381ed58ea
CVE ID: CVE-2018-21011 State: PUBLISHED Published: 2019-09-09T12:03:43 Last Updated: 2024-08-05T12:19:27.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/charitable/#developers - https://www.wpcharitable.com/release-notes-security-release-1-5-14/
CVE ID: CVE-2018-21012 State: PUBLISHED Published: 2019-09-09T12:04:56 Last Updated: 2024-08-05T12:19:27.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cf7-invisible-recaptcha/#developers - https://www.pluginvulnerabilities.com/2018/05/17/reflected-cross-site-scripting-xss-vulnerability-in-cf7-invisible-recaptcha/
CVE ID: CVE-2018-21013 State: PUBLISHED Published: 2019-09-09T12:07:11 Last Updated: 2024-08-05T12:19:27.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9024
CVE ID: CVE-2018-21014 State: PUBLISHED Published: 2019-09-09T12:09:11 Last Updated: 2024-08-05T12:19:26.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9007
CVE ID: CVE-2018-21015 State: PUBLISHED Published: 2019-09-16T12:58:44 Last Updated: 2024-08-05T12:19:27.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVC_DuplicateConfig() at isomedia/avc_ext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. There is "cfg_new->AVCLevelIndication = cfg->AVCLevelIndication;" but cfg could be NULL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1179 - https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html
CVE ID: CVE-2018-21016 State: PUBLISHED Published: 2019-09-16T12:58:33 Last Updated: 2024-08-05T12:19:27.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: audio_sample_entry_AddBox() at isomedia/box_code_base.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1180 - https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html
CVE ID: CVE-2018-21017 State: PUBLISHED Published: 2019-09-16T12:58:00 Last Updated: 2024-08-05T12:19:27.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC 0.7.1 has a memory leak in dinf_Read in isomedia/box_code_base.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1183 - https://github.com/gpac/gpac/commit/d2371b4b204f0a3c0af51ad4e9b491144dd1225c
CVE ID: CVE-2018-21018 State: PUBLISHED Published: 2019-09-22T14:22:43 Last Updated: 2024-08-05T12:19:27.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tootsuite/mastodon/releases/tag/v2.6.2 - https://github.com/tootsuite/mastodon/releases/tag/v2.6.3 - https://github.com/tootsuite/mastodon/pull/9329 - https://github.com/tootsuite/mastodon/pull/9381
CVE ID: CVE-2018-21019 State: PUBLISHED Published: 2019-09-23T15:14:13 Last Updated: 2024-08-05T12:19:27.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/home-assistant/home-assistant/pull/13836 - https://github.com/home-assistant/home-assistant/releases/tag/0.67.0
CVE ID: CVE-2018-21020 State: PUBLISHED Published: 2019-10-08T12:08:47 Last Updated: 2024-08-05T12:19:27.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/7084 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2018-21021 State: PUBLISHED Published: 2019-10-08T12:11:52 Last Updated: 2024-08-05T12:19:27.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/7086 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2018-21022 State: PUBLISHED Published: 2019-10-08T12:14:26 Last Updated: 2024-08-05T12:19:27.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/7087 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2018-21023 State: PUBLISHED Published: 2019-10-08T12:17:15 Last Updated: 2024-08-05T12:19:27.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/7083 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - https://github.com/centreon/centreon/pull/7271 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2018-21024 State: PUBLISHED Published: 2019-10-08T14:32:56 Last Updated: 2024-08-05T12:19:27.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2019/10/08/1 - https://github.com/centreon/centreon/pull/7085 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2018-21025 State: PUBLISHED Published: 2019-10-08T12:18:39 Last Updated: 2024-08-05T12:19:27.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/issues/7082 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2018-21026 State: PUBLISHED Published: 2019-11-12T17:42:33 Last Updated: 2024-08-05T12:19:27.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information. Additional Analyst Notes: - CVE Program Container: References: - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/index.html - https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-124/
CVE ID: CVE-2018-21027 State: PUBLISHED Published: 2019-10-11T19:28:42 Last Updated: 2024-08-05T12:19:27.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpg/boa/pull/1 - https://github.com/gpg/boa/pull/1/commits/e139b87835994d007fbd64eead6c1455d7b8cf4e
CVE ID: CVE-2018-21028 State: PUBLISHED Published: 2019-10-11T19:29:33 Last Updated: 2024-08-05T12:19:27.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpg/boa/pull/1 - https://github.com/gpg/boa/pull/1/commits/e139b87835994d007fbd64eead6c1455d7b8cf4e
CVE ID: CVE-2018-21029 State: PUBLISHED Published: 2019-10-30T21:46:51 Last Updated: 2024-08-05T12:19:27.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/systemd/systemd/issues/9397 - https://blog.cloudflare.com
tes: - CVE Program Container: References: - https://github.com/systemd/systemd/issues/9397 - https://blog.cloudflare.com/dns-encryption-explained/ - https://github.com/systemd/systemd/blob/v243/src/resolve/resolved-dnstls-gnutls.c#L62-L63 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NLJVOJMB6ANDILRLDZK26YGLYBEPHKY/ - https://security.netapp.com/advisory/ntap-20191122-0002/ - https://github.com/systemd/systemd/pull/13870 - https://github.com/systemd/systemd/blob/v243/man/resolved.conf.xml#L196-L207 - https://github.com/systemd/systemd/blob/v239/man/resolved.conf.xml#L199-L207 - https://tools.ietf.org/html/rfc7858#section-4.1
CVE ID: CVE-2018-21030 State: PUBLISHED Published: 2019-10-31T14:52:45 Last Updated: 2024-08-05T12:19:27.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyter/notebook/pull/3341 - https://github.com/jupyter/notebook/releases/tag/5.5.0 - https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
CVE ID: CVE-2018-21031 State: PUBLISHED Published: 2019-11-18T16:30:56 Last Updated: 2024-08-05T12:19:27.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product and version. Further research indicated that Tautulli is the correct affected product. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/GerardFuguet/status/1009937529573912576 - https://www.elladod
- CVE Program Container: References: - https://twitter.com/GerardFuguet/status/1009937529573912576 - https://www.elladodelmal.com/2018/08/shodan-es-de-cine-hacking-tautulli-un.html - https://forums.plex.tv/t/security-regarding-cve-2018-21031/493286 - https://www.exploit-db.com/docs/47790
CVE ID: CVE-2018-21032 State: PUBLISHED Published: 2020-02-14T15:51:21 Last Updated: 2024-08-05T12:19:27.450Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi Device Manager and Hitachi Compute Systems Manager. Additional Analyst Notes: - CVE Program Container: References: - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/ - https://www.hitachi.co.jp/Prod/comp/soft1/gl
: References: - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/ - https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-128/
CVE ID: CVE-2018-21033 State: PUBLISHED Published: 2020-02-14T15:51:17 Last Updated: 2024-08-05T12:19:27.469Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Syst
orage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager. Additional Analyst Notes: - CVE Program Container: References: - http://www.hitachi.co.jp/Prod/comp/soft1/global/security/ - https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-128/
CVE ID: CVE-2018-21034 State: PUBLISHED Published: 2020-04-09T16:18:37 Last Updated: 2024-08-05T12:19:27.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/blob/a1afe44066fcd0a0ab90a02a23177164bbad42cf/util/diff/diff.go#L399 - https://github.com/argoproj/argo-cd/issues/470 - https://github.com/argoproj/argo-cd/pull/3088 - https://www.soluble.ai/blog/argo-cves-2020
CVE ID: CVE-2018-21035 State: PUBLISHED Published: 2020-02-28T19:17:43 Last Updated: 2024-08-05T12:19:27.472Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption). Additional Analyst Notes: - CVE Program Container: References: - https://codereview.qt-project.org/c/qt/qtwebsockets/+/284735 - https://bugreports.qt.io/browse/QTBUG-70693
CVE ID: CVE-2018-21036 State: PUBLISHED Published: 2020-07-21T13:14:55 Last Updated: 2024-08-05T12:19:27.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/balderdashy/sails-hook-sockets/commit/ff02114eaec090ee51db48435cc32d451662606e - https://github.com/balderdashy/sails-hook-sockets/commit/0533a4864b1920fd8fbb5287bc0889193c5faf44 - https://github.com/balderdashy/sails/blob/56f8276f6501a144a03d1f
ckets/commit/0533a4864b1920fd8fbb5287bc0889193c5faf44 - https://github.com/balderdashy/sails/blob/56f8276f6501a144a03d1f0f28df4ccdb4ad82e2/CHANGELOG.md - http://www.openwall.com/lists/oss-security/2020/07/19/1
CVE ID: CVE-2018-21037 State: PUBLISHED Published: 2020-03-17T14:53:17 Last Updated: 2024-08-05T12:19:27.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/issues/638
CVE ID: CVE-2018-21038 State: PUBLISHED Published: 2020-04-08T16:18:53 Last Updated: 2024-08-05T12:19:27.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with N(7.x) software. The Secure Folder app's startup logic allows authentication bypass. The Samsung ID is SVE-2018-11628 (December 2018). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb