Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-6316 State: PUBLISHED Published: 2018-02-15T23:00:00 Last Updated: 2024-08-05T06:01:48.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ivanti Endpoint Security (formerly HEAT Endpoint Management and Security Suite) 8.5 Update 1 and earlier allows an authenticated user with low privileges and access to the local network to bypass application whitelisting when using the Application Control module on Ivanti Endpoint Security in lockdown mode. Additional Analyst Notes: - CVE Program Container: References: - https://community.ivanti.com/docs/DOC-65656
CVE ID: CVE-2018-6317 State: PUBLISHED Published: 2018-02-02T21:00:00 Last Updated: 2024-08-05T06:01:48.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackers to read memory or cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40res1n/claymore-dual-gpu-miner-10-5-format-strings-vulnerability-916ab3d2db30 - https://www.exploit-db.com/exploits/43972/
CVE ID: CVE-2018-6318 State: PUBLISHED Published: 2018-02-02T21:00:00 Last Updated: 2024-08-05T06:01:48.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using a payload that runs from NTDLL.DLL (so, it's run in userland), but the driver doesn't perform any validation of this DLL (not its signature, not its hash, etc.). A person can change this DLL in a local way, or with a remote connection, to a malicious DLL with the same name -- and when the product is used, this malicious DLL will be loaded, aka a DLL Hijacking attack. Additional Analyst No
me -- and when the product is used, this malicious DLL will be loaded, aka a DLL Hijacking attack. Additional Analyst Notes: - CVE Program Container: References: - https://29wspy.ru/exploits/CVE-2018-6318.pdf
CVE ID: CVE-2018-6319 State: PUBLISHED Published: 2018-02-02T21:00:00 Last Updated: 2024-08-05T06:01:48.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument. This argument is a memory address: if a caller passes a NULL pointer or a random invalid address, the driver will cause a Blue Screen of Death. If a program or malware does this at boot time, it can cause a persistent denial of service on the machine. Additional Analyst Notes: - CVE Program Container: References: - https://29wspy.ru/exploits/CVE-2018-6319.pdf
CVE ID: CVE-2018-6320 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-08-05T06:01:48.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.2RX before 5.2R9 and 5.4RX before 5.4R2 wherein an http(s) Host header received from the browser is trusted without validation. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877
CVE ID: CVE-2018-6321 State: PUBLISHED Published: 2018-03-12T21:00:00 Last Updated: 2024-08-05T06:01:48.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unquoted Windows search path vulnerability in the panda_url_filtering service in Panda Global Protection 17.0.1 allows local users to gain privileges via a malicious artefact. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/25
CVE ID: CVE-2018-6322 State: PUBLISHED Published: 2018-03-12T21:00:00 Last Updated: 2024-08-05T06:01:48.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panda Global Protection 17.0.1 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of \.\pipe\PSANMSrvcPpal -- an "insecurely created named pipe." Ensures full access to Everyone users group. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/26
CVE ID: CVE-2018-6323 State: PUBLISHED Published: 2018-01-26T08:00:00 Last Updated: 2024-08-05T06:01:48.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22746 - http://www.securityfocus.com/bid/102821 - https://www.exp
ces: - https://sourceware.org/bugzilla/show_bug.cgi?id=22746 - http://www.securityfocus.com/bid/102821 - https://www.exploit-db.com/exploits/44035/ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
CVE ID: CVE-2018-6324 State: PUBLISHED Published: 2018-02-16T04:00:00 Last Updated: 2024-08-05T06:01:48.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103208 - http://oscarhjelm.com/blag/2018/02/f-secure-radar-login-page-unvalidated-redirect-vulnerability/
CVE ID: CVE-2018-6328 State: PUBLISHED Published: 2018-03-14T19:00:00 Last Updated: 2024-08-05T06:01:48.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45559/ - https://support.unitrends.com/UnitrendsBackup/s/article/000006002 - https://www.exploit-db.com/exploits/44297/ - https://support.unitrends.com/UnitrendsBackup/s/article/000001150
CVE ID: CVE-2018-6329 State: PUBLISHED Published: 2018-03-14T19:00:00 Last Updated: 2024-08-05T06:01:48.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://support.unitrends.com/UnitrendsBackup/s/article/000006003 - https://www.exploit-db.com/exploits/44297/ - https://support.unitrends.com/UnitrendsBackup/s/article/000001150 - https://www.exploit-db.
oit-db.com/exploits/44297/ - https://support.unitrends.com/UnitrendsBackup/s/article/000001150 - https://www.exploit-db.com/exploits/45913/
CVE ID: CVE-2018-6330 State: PUBLISHED Published: 2019-03-28T15:41:02 Last Updated: 2024-08-05T06:01:48.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.itblog.gbonanno.de/cve-2018-6330-laravel-sql-injection/ - https://github.com/laravel/framework/blob/5.4/CHANGELOG-5.4.md
CVE ID: CVE-2018-6331 State: PUBLISHED Published: 2018-12-31T23:00:00.000Z Last Updated: 2025-05-06T15:46:07.371Z Vendors: Facebook Products: Buck Problem Types: CWE-502 Description: Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf
CVE ID: CVE-2018-6332 State: PUBLISHED Published: 2018-12-03T14:00:00.000Z Last Updated: 2025-05-06T19:01:27.181Z Vendors: Facebook Products: HHVM Problem Types: CWE-400 Description: A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This affects all supported versions of HHVM (3.24.3 and 3.21.7 and below) when using the proxygen server to handle HTTP2 requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hhvm.com/blog/2018/03/15/hhvm-3.25.html
CVE ID: CVE-2018-6333 State: PUBLISHED Published: 2018-12-31T23:00:00.000Z Last Updated: 2025-05-06T14:39:21.844Z Vendors: Facebook Products: Nuclide Problem Types: CWE-79 Description: The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/nuclide/commit/65f6bbd683404be1bb569b8d1be84b5d4c74a324
CVE ID: CVE-2018-6334 State: PUBLISHED Published: 2018-12-31T20:00:00.000Z Last Updated: 2025-05-06T16:48:40.461Z Vendors: Facebook Products: HHVM Problem Types: CWE-621 Description: Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/hhvm/commit/6937de5544c3eead3466b75020d8382080ed0cff - https://hhvm.com/blog/2018/03/30/hhvm-3.25.2.
github.com/facebook/hhvm/commit/6937de5544c3eead3466b75020d8382080ed0cff - https://hhvm.com/blog/2018/03/30/hhvm-3.25.2.html
CVE ID: CVE-2018-6335 State: PUBLISHED Published: 2018-12-31T20:00:00.000Z Last Updated: 2025-05-06T19:02:13.156Z Vendors: Facebook Products: HHVM Problem Types: CWE-400 Description: A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. This affects all supported versions of HHVM (3.25.2, 3.24.6, and 3.21.10 and below) when using the proxygen server to handle HTTP2 requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hhvm.com/blog/2018/05/04/hhvm-3.25.3.html - https://github.com/facebook/hhvm/commit/4cb57dd753a339654ca464c139db9871fe961d56
CVE ID: CVE-2018-6336 State: PUBLISHED Published: 2018-12-31T20:00:00.000Z Last Updated: 2025-05-06T19:00:51.800Z Vendors: Facebook Products: osquery Problem Types: CWE-254 Description: An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute. This issue affects osquery prior to v3.2.7 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.okta.com/security-blog/2018/06/issues-around-third-party-a
Container: - CISA ADP Vulnrichment: References: - https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/
CVE ID: CVE-2018-6337 State: PUBLISHED Published: 2018-12-31T22:00:00.000Z Last Updated: 2025-05-06T16:39:21.216Z Vendors: Facebook Products: HHVM, folly Problem Types: CWE-212 Description: folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html - https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f
com/blog/2018/05/24/hhvm-3.26.3.html - https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f - https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8
CVE ID: CVE-2018-6339 State: PUBLISHED Published: 2019-06-14T17:02:57 Last Updated: 2024-08-05T06:01:48.697Z Vendors: Facebook Products: WhatsApp for Android, WhatsApp Business for Android Problem Types: CWE-121 Description: When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and was fixed in version 2.18.295. It also affects WhatsApp Business for Android starting in version v2.18.103 and was fixed in version v2.18.150. Additional Analyst Notes: - CVE Prog
iness for Android starting in version v2.18.103 and was fixed in version v2.18.150. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2018-6339/
CVE ID: CVE-2018-6340 State: PUBLISHED Published: 2018-12-31T22:00:00.000Z Last Updated: 2025-05-06T19:00:01.711Z Vendors: Facebook Products: HHVM Problem Types: CWE-125 Description: The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hhvm.com/blog/2018/12/18/hhvm-3.30.1.html - https://github.com/facebook/hhvm/commit/4bff3bfbe90d10451e4638c2118d1ad1117bb3e3
CVE ID: CVE-2018-6341 State: PUBLISHED Published: 2018-12-31T22:00:00.000Z Last Updated: 2025-05-06T16:54:17.932Z Vendors: Facebook Products: react-dom Problem Types: CWE-79 Description: React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html - https://twitter.c
iner: - CISA ADP Vulnrichment: References: - https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html - https://twitter.com/reactjs/status/1024745321987887104
CVE ID: CVE-2018-6342 State: PUBLISHED Published: 2018-12-31T22:00:00.000Z Last Updated: 2025-05-06T16:07:37.832Z Vendors: Facebook Products: react-dev-utils Problem Types: CWE-78 Description: react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.
nches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/create-react-app/releases/tag/v1.1.5 - https://github.com/facebook/create-react-app/pull/4866
CVE ID: CVE-2018-6343 State: PUBLISHED Published: 2018-12-31T22:00:00.000Z Last Updated: 2025-05-06T16:05:12.414Z Vendors: Facebook Products: Proxygen Problem Types: CWE-476 Description: Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/proxygen/commit/0600ebe59c3e82cd012def77ca9ca1918da74a71
CVE ID: CVE-2018-6344 State: PUBLISHED Published: 2018-12-31T22:00:00.000Z Last Updated: 2025-05-06T16:02:35.127Z Vendors: Facebook Products: WhatsApp for Android, WhatsApp for iOS, WhatsApp for Windows Phone Problem Types: CWE-122 Description: A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used to cause denial of service. It affects WhatsApp for Android prior to v2.18.293, WhatsApp for iOS prior to v2.18.93, and WhatsApp for Windows Phone prior to v2.18.172. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://googleprojectzero.blogspot.com/2018/12/adventures-
CVE Program Container: - CISA ADP Vulnrichment: References: - https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-3.html - http://www.securityfocus.com/bid/106365
CVE ID: CVE-2018-6345 State: PUBLISHED Published: 2019-01-15T22:00:00 Last Updated: 2024-08-05T06:01:48.683Z Vendors: Facebook Products: HHVM Problem Types: CWE-122 Description: The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hhvm/commit/190ffdf6c8b1ec443be202c7d69e63a7e3da25e3 - https://hhvm.com/
iner: References: - https://github.com/facebook/hhvm/commit/190ffdf6c8b1ec443be202c7d69e63a7e3da25e3 - https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html
CVE ID: CVE-2018-6346 State: PUBLISHED Published: 2018-12-31T22:00:00.000Z Last Updated: 2025-05-06T16:00:14.553Z Vendors: Facebook Products: Proxygen Problem Types: CWE-400 Description: A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen prior to v2018.12.31.00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/proxygen/commit/52cf331743ebd74194d6343a6c2ec52bb917c982
CVE ID: CVE-2018-6347 State: PUBLISHED Published: 2018-12-31T22:00:00.000Z Last Updated: 2025-05-06T15:53:44.034Z Vendors: Facebook Products: Proxygen Problem Types: CWE-400 Description: An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/proxygen/commit/223e0aa6bc7590e86af1e917185a2e0efe160711
CVE ID: CVE-2018-6349 State: PUBLISHED Published: 2019-06-14T17:02:57 Last Updated: 2024-08-05T06:01:48.760Z Vendors: Facebook Products: WhatsApp for Android, WhatsApp Business for Android Problem Types: CWE-121 Description: When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for Android prior to 2.18.248 and WhatsApp Business for Android prior to 2.18.132. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2018-6349/ - http://www.securityfocus.com/bid/108804
CVE ID: CVE-2018-6350 State: PUBLISHED Published: 2019-06-14T17:02:57 Last Updated: 2024-08-05T06:01:48.744Z Vendors: Facebook Products: WhatsApp for Android, WhatsApp Business for Android, WhatsApp for iOS, WhatsApp Business for iOS, WhatsApp for Windows Phone Problem Types: CWE-125 Description: An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224. Additional Analyst Notes: - CVE Program Container: References:
.100.2, and WhatsApp for Windows Phone prior to 2.18.224. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2018-6350/ - http://www.securityfocus.com/bid/108803
CVE ID: CVE-2018-6352 State: PUBLISHED Published: 2018-01-27T15:00:00 Last Updated: 2024-08-05T06:01:48.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1539237
CVE ID: CVE-2018-6353 State: PUBLISHED Published: 2018-01-27T15:00:00Z Last Updated: 2024-09-17T00:45:57.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering attacks in which a user pastes code that they do not understand and (2) code pasted by a physically proximate attacker at an unattended workstation, which makes it easier for attackers to steal Bitcoin via hook code that runs at a later time when the wallet password has been entered, a different vulnerability than CVE-2018-1000022. Additional Analyst Notes: - CVE Program Container: Refer
been entered, a different vulnerability than CVE-2018-1000022. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spesmilo/electrum/issues/3678 - https://github.com/spesmilo/electrum/pull/3700
CVE ID: CVE-2018-6354 State: PUBLISHED Published: 2018-01-27T15:00:00Z Last Updated: 2024-09-17T02:20:58.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/formspree/formspree/commit/5f18eeaaa459bee9a58f70cdf7c46adb1ef34ea7
CVE ID: CVE-2018-6355 State: PUBLISHED Published: 2018-01-30T17:00:00 Last Updated: 2024-08-05T06:01:48.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: /goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/MayurUdiniya/597169f582e506b610beb4e84fd8c8fc