Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-17037 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blackstar24/UCMS/blob/master/level.md
CVE ID: CVE-2018-17039 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/24
CVE ID: CVE-2018-17042 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in dbf2txt through 2012-07-19. It is a infinite loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bcsanches/dbf2txt/issues/2 - https://github.com/grandnew/software-vulnerabilities/tree/master/dbf2txt#infinite-loop
CVE ID: CVE-2018-17043 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in doc2txt through 2014-03-19. It is a heap-based buffer overflow in the function Storage::init in Storage.cpp, called from parse_doc in parse_doc.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tsfn/doc2txt/issues/1 - https://github.com/grandnew/software-vulnerabilities/tree/master/doc2txt#heap-buffer-overflow-in-function-storageinit
CVE ID: CVE-2018-17044 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/3
CVE ID: CVE-2018-17045 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksi_users.php?act=update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maelosoki/MaeloStore/issues/1
CVE ID: CVE-2018-17046 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: translate man before 2018-08-21 has XSS via containers/outputBox/outputBox.vue and store/index.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magic-FE/translate-man/issues/49
CVE ID: CVE-2018-17048 State: PUBLISHED Published: 2019-05-16T14:19:46 Last Updated: 2024-08-05T10:39:59.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/badongdyc/fangfacms/commits/master - http://www.fangfacms.com/ - http://www.cnvd.org.cn/flaw/show/CNVD-2018-19263
CVE ID: CVE-2018-17049 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TREYWANGCQU/LANKERS/issues/1
CVE ID: CVE-2018-17050 State: PUBLISHED Published: 2018-09-21T17:00:00 Last Updated: 2024-08-05T10:39:59.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mintToken function of a smart contract implementation for PolyAi (AI), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/n0pn0pn0p/smart_contract_-vulnerability/blob/master/PolyAi.md
CVE ID: CVE-2018-17051 State: PUBLISHED Published: 2018-09-14T07:00:00 Last Updated: 2024-08-05T10:39:59.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/adilinden/cisco-config-manager/issues/3
CVE ID: CVE-2018-17053 State: PUBLISHED Published: 2018-10-03T18:00:00 Last Updated: 2024-08-05T10:39:59.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17054. Additional Analyst Notes: - CVE Program Container: References: - https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/ - https://knowledgebase.progress.com/articles/Article/Security-Advisory-fo
ss-story-of-a-responsible-disclosure-process/ - https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018
CVE ID: CVE-2018-17054 State: PUBLISHED Published: 2018-10-03T18:00:00 Last Updated: 2024-08-05T10:39:59.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17053. Additional Analyst Notes: - CVE Program Container: References: - https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/ - https://knowledgebase.progress.com/articles/Article/Security-Advisory-fo
CVE ID: CVE-2018-17055 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:39:59.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads. Additional Analyst Notes: - CVE Program Container: References: - https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/ - https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018
CVE ID: CVE-2018-17056 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:39:59.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/ - https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018
CVE ID: CVE-2018-17057 State: PUBLISHED Published: 2018-09-14T20:00:00 Last Updated: 2024-08-05T10:39:59.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tecnickcom/TCPDF/commit/1861e33fe05f653b67d070f7c106463e7a5c26ed - http://seclists.org/fulldisclosure/2019/Mar/36 - http://packetstormsecurity.com/files/152200/TCPDF-6.2.19-Deserialization-Remote-Code-Execution.html - https://github.com/LimeSurvey/LimeSurvey/commit/1cdd78d27697b3150bb44aaa7af1a81062a591a5 - https://w
de-Execution.html - https://github.com/LimeSurvey/LimeSurvey/commit/1cdd78d27697b3150bb44aaa7af1a81062a591a5 - https://www.exploit-db.com/exploits/46634/ - http://packetstormsecurity.com/files/152360/LimeSurvey-Deserialization-Remote-Code-Execution.html - https://contao.org/en/news/security-vulnerability-cve-2018-17057.html
CVE ID: CVE-2018-17058 State: PUBLISHED Published: 2020-03-02T13:32:47 Last Updated: 2024-08-05T10:39:59.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary file upload vulnerability in the picture-upload feature of ProductEdit.aspx. An authenticated attacker may bypass the frontend filename validation and upload an arbitrary file via FileUploader.aspx.cs in FileUploader.aspx by using empty w and h parameters. This file may contain arbitrary aspx code that may be executed by accessing /Jec/ProductImages/<number>/<filename>. Accessing the file once uploaded does not require authenticati
uted by accessing /Jec/ProductImages/<number>/<filename>. Accessing the file once uploaded does not require authentication. Additional Analyst Notes: - CVE Program Container: References: - http://cyber-crime.ru/cve/CVE-2018-17058.html
CVE ID: CVE-2018-17060 State: PUBLISHED Published: 2018-10-08T16:00:00 Last Updated: 2024-08-05T10:39:59.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory. NOTE: this product has been obsolete since June 2013. Additional Analyst Notes: - CVE Program Container: References: - https://www.telerik.com/support/code-library/security-alert-for-the-obsolete-telerik-extensions-for-asp-net-mvc
CVE ID: CVE-2018-17061 State: PUBLISHED Published: 2018-09-15T19:00:00 Last Updated: 2024-08-05T10:39:59.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: BullGuard Safe Browsing before 18.1.355.9 allows XSS on Google, Bing, and Yahoo! pages via domains indexed in search results. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40Mthirup/hacking-your-own-antivirus-for-fun-and-profit-safe-browsing-gone-wrong-365db9d1d3f7 - https://www.bullguard.com/about/release-notes
CVE ID: CVE-2018-17062 State: PUBLISHED Published: 2018-09-16T17:00:00 Last Updated: 2024-08-05T10:39:59.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SeaCMS 6.64. XSS exists in admin_video.php via the action, area, type, yuyan, jqtype, v_isunion, v_recycled, v_ismoney, or v_ispsd parameter. Additional Analyst Notes: - CVE Program Container: References: - https://secwk.blogspot.com/2018/09/seacms-664-xss-vulnerability.html
CVE ID: CVE-2018-17063 State: PUBLISHED Published: 2018-09-15T21:00:00 Last Updated: 2024-08-05T10:39:59.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/NTPSyncWithHost route. This could lead to command injection via shell metacharacters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/tree/master/D-Link/DIR-816/cmd_injection_3
CVE ID: CVE-2018-17064 State: PUBLISHED Published: 2018-09-15T21:00:00 Last Updated: 2024-08-05T10:39:59.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/sylogapply route. This could lead to command injection via the syslogIp parameter after /goform/clearlog is invoked. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/tree/master/D-Link/DIR-816/cmd_injection_2
CVE ID: CVE-2018-17065 State: PUBLISHED Published: 2018-09-15T21:00:00 Last Updated: 2024-08-05T10:39:59.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/DDNS route, a very long password could lead to a stack-based buffer overflow and overwrite the return address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/tree/master/D-Link/DIR-816/stack_overflow_1
CVE ID: CVE-2018-17066 State: PUBLISHED Published: 2018-09-15T21:00:00 Last Updated: 2024-08-05T10:39:59.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/form2systime.cgi route. This could lead to command injection via shell metacharacters in the datetime parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/tree/master/D-Link/DIR-816/cmd_injection_0
CVE ID: CVE-2018-17067 State: PUBLISHED Published: 2018-09-15T21:00:00 Last Updated: 2024-08-05T10:39:59.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. A very long password to /goform/formLogin could lead to a stack-based buffer overflow and overwrite the return address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/tree/master/D-Link/DIR-816/stack_overflow_0
CVE ID: CVE-2018-17068 State: PUBLISHED Published: 2018-09-15T21:00:00 Last Updated: 2024-08-05T10:39:59.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/Diagnosis route. This could lead to command injection via shell metacharacters in the sendNum parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/tree/master/D-Link/DIR-816/cmd_injection_1
CVE ID: CVE-2018-17069 State: PUBLISHED Published: 2018-09-15T21:00:00 Last Updated: 2024-08-05T10:39:59.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UNL-CMS 7.59. A CSRF attack can create new content via ?q=node%2Fadd%2Farticle&render=overlay&render=overlay. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/unlcms/UNL-CMS/issues/941
CVE ID: CVE-2018-17070 State: PUBLISHED Published: 2018-09-15T21:00:00 Last Updated: 2024-08-05T10:39:59.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/unlcms/UNL-CMS/issues/941
CVE ID: CVE-2018-17071 State: PUBLISHED Published: 2018-09-18T21:00:00 Last Updated: 2024-08-05T10:39:59.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entry_number. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a ticket at a low price by directly calling the fallback function with small msg.value, because the developer set the currency unit incorrectly. Therefore, it allows attackers to always win and get rewards. Additional Analyst Notes: - CVE
urrency unit incorrectly. Therefore, it allows attackers to always win and get rewards. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17071
CVE ID: CVE-2018-17072 State: PUBLISHED Published: 2018-09-16T02:00:00 Last Updated: 2024-08-05T10:39:59.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: JSON++ through 2016-06-15 has a buffer over-read in yyparse() in json.y. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tunnuz/json/issues/11
CVE ID: CVE-2018-17073 State: PUBLISHED Published: 2018-09-16T02:00:00 Last Updated: 2024-08-05T10:39:59.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: wernsey/bitmap before 2018-08-18 allows a NULL pointer dereference via a 4-bit image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wernsey/bitmap/issues/1
CVE ID: CVE-2018-17074 State: PUBLISHED Published: 2018-09-16T02:00:00 Last Updated: 2024-08-05T10:39:59.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wordpress-feed-statistics/#developers - https://hackerone.com/reports/22142 - https://plugins.trac.wordpress.org/browser/wordpress-feed-statistics/trunk/feed-statistics.php?rev=960868 - https://wpvulndb.com/vulnerabilities/7543
CVE ID: CVE-2018-17075 State: PUBLISHED Published: 2018-09-16T02:00:00 Last Updated: 2024-08-05T10:39:59.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/net/commit/aaf60122140d3fcf75376d319f0554393160eb50 - https://bugs.chromium.org/p/chromium/issues/detail?id=829668 - https://github.com/golang/go/issues/27016 - https://list
https://bugs.chromium.org/p/chromium/issues/detail?id=829668 - https://github.com/golang/go/issues/27016 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
CVE ID: CVE-2018-17076 State: PUBLISHED Published: 2018-09-16T02:00:00 Last Updated: 2024-08-05T10:39:59.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPP through 2.25 will try to use more memory space than is available on the stack, leading to a segmentation fault or possibly unspecified other impact via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/logological/gpp/issues/26
CVE ID: CVE-2018-17077 State: PUBLISHED Published: 2018-09-16T02:00:00 Last Updated: 2024-08-05T10:39:59.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in yiqicms through 2016-11-20. There is stored XSS in comment.php because a length limit can be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wacj1425/yiqicms/issues/1
CVE ID: CVE-2018-17079 State: PUBLISHED Published: 2019-06-19T17:37:42 Last Updated: 2024-08-05T10:39:59.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ZRLOG 2.0.1. There is a Stored XSS vulnerability in the nickname field of the comment area. Additional Analyst Notes: - CVE Program Container: References: - https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 - https://github.com/94fzb/zrlog/issues/38
CVE ID: CVE-2018-17081 State: PUBLISHED Published: 2018-09-26T21:00:00 Last Updated: 2024-08-05T10:39:59.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/himanshurahi/e107_2.1.9_CSRF_POC
CVE ID: CVE-2018-17082 State: PUBLISHED Published: 2018-09-16T15:00:00 Last Updated: 2024-08-05T10:39:59.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c. Additional Analyst Notes: - CVE Program Container: References: - http://php.net/ChangeLog-5.php - http://php.net/ChangeLog-7.php - https://www.debian.org/security/2018/dsa-4353 - https://github.com/php/php-src/commit/23b057742e3cf199612fa8050ae86
hp - https://www.debian.org/security/2018/dsa-4353 - https://github.com/php/php-src/commit/23b057742e3cf199612fa8050ae86cae675e214e - https://lists.debian.org/debian-lts-announce/2018/09/msg00020.html - https://bugs.php.net/bug.php?id=76582 - https://security.gentoo.org/glsa/201812-01 - https://security.netapp.com/advisory/ntap-20180924-0001/ - https://access.redhat.com/errata/RHSA-2019:2519 - https://www.tenable.com/security/tns-2019-07
CVE ID: CVE-2018-17085 State: PUBLISHED Published: 2018-09-16T17:00:00 Last Updated: 2024-08-05T10:39:59.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr. Additional Analyst Notes: - CVE Program Container: References: - http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-usersphp.html
CVE ID: CVE-2018-17086 State: PUBLISHED Published: 2018-09-16T17:00:00 Last Updated: 2024-08-05T10:39:59.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName. Additional Analyst Notes: - CVE Program Container: References: - http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-shareswitchphp.html
CVE ID: CVE-2018-17088 State: PUBLISHED Published: 2018-09-16T17:00:00 Last Updated: 2024-08-05T10:39:59.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.or
8-16554 gpsinfo.c vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907925 - https://lists.debian.org/debian-lts-announce/2019/12/msg00037.html
CVE ID: CVE-2018-17090 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazy_adresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing <textarea> followed by <script></script> tags. Additional Analyst Notes: - CVE Program Container: References: - http://www.safecomp.com/blog/donlinkage.html
CVE ID: CVE-2018-17091 State: PUBLISHED Published: 2018-09-16T21:00:00 Last Updated: 2024-08-05T10:39:59.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DonLinkage 6.6.8. It allows remote attackers to obtain potentially sensitive information via a direct request for files/temporary.txt. Additional Analyst Notes: - CVE Program Container: References: - http://www.safecomp.com/blog/donlinkage.html