Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-5963 State: PUBLISHED Published: 2018-01-25T16:00:00 Last Updated: 2024-08-05T05:47:56.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter. Additional Analyst Notes: - CVE Program Container: References: - https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/ - http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Jan/80
CVE ID: CVE-2018-5964 State: PUBLISHED Published: 2018-01-25T16:00:00 Last Updated: 2024-08-05T05:47:56.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter. Additional Analyst Notes: - CVE Program Container: References: - https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/ - http://seclists.org/fulldisclosure/2018/Jan/82 - http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html
CVE ID: CVE-2018-5965 State: PUBLISHED Published: 2018-01-25T16:00:00 Last Updated: 2024-08-05T05:47:56.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter. Additional Analyst Notes: - CVE Program Container: References: - https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/ - http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Jan/83
CVE ID: CVE-2018-5967 State: PUBLISHED Published: 2018-01-25T08:00:00 Last Updated: 2024-08-05T05:47:56.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/145513/Netis-WF2419-HTML-Injection.html
CVE ID: CVE-2018-5968 State: PUBLISHED Published: 2018-01-22T04:00:00 Last Updated: 2024-08-05T05:47:56.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0479 - https://access.redhat.com/errata/RHSA-2018:0481 - https://access.redhat.com/errata/RHSA-2018:1525 - https://access.redhat.com/errata/RHSA-2018
com/errata/RHSA-2018:0481 - https://access.redhat.com/errata/RHSA-2018:1525 - https://access.redhat.com/errata/RHSA-2018:0480 - https://www.debian.org/security/2018/dsa-4114 - https://access.redhat.com/errata/RHSA-2018:0478 - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:3149 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us - https://security.netapp.com/advisory/ntap-20180423-0002/ - https://github.com/FasterXML/jackson-databind/issues/1899
CVE ID: CVE-2018-5969 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demonstrated by adding an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43867/
CVE ID: CVE-2018-5970 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44116
CVE ID: CVE-2018-5971 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44122
CVE ID: CVE-2018-5972 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listing URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43868/
CVE ID: CVE-2018-5973 State: PUBLISHED Published: 2018-01-25T17:00:00 Last Updated: 2024-08-05T05:47:56.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter, or the suppliers.php IndustryID or CategoryID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43870/ - http://packetstormsecurity.com/files/146071/Professional-Local-Directory-Script-1.0-SQL-Injection.html
CVE ID: CVE-2018-5974 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44126
CVE ID: CVE-2018-5975 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44127
CVE ID: CVE-2018-5976 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43862/
CVE ID: CVE-2018-5977 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43861/
CVE ID: CVE-2018-5978 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43865/
CVE ID: CVE-2018-5979 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43864/
CVE ID: CVE-2018-5980 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44128
CVE ID: CVE-2018-5981 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44112
CVE ID: CVE-2018-5982 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= request. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44105
CVE ID: CVE-2018-5983 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44118
CVE ID: CVE-2018-5984 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the category/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43866/
CVE ID: CVE-2018-5985 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43860/
CVE ID: CVE-2018-5986 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43863/
CVE ID: CVE-2018-5987 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay action, the searchVal parameter in a view=search action, or the uid parameter in a view=likes action. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44131
CVE ID: CVE-2018-5988 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T05:47:56.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43869/
CVE ID: CVE-2018-5989 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue to CVE-2011-5099. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44132
CVE ID: CVE-2018-5990 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44107
CVE ID: CVE-2018-5991 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44111
CVE ID: CVE-2018-5992 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44129
CVE ID: CVE-2018-5993 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44106
CVE ID: CVE-2018-5994 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resume request. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44120
CVE ID: CVE-2018-5995 State: PUBLISHED Published: 2018-08-07T18:00:00 Last Updated: 2024-08-05T05:47:56.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pcpu_embed_first_chunk function in mm/percpu.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a "pages/cpu" printk call. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105049 - https://github.com/johnsonwangqize/cve-linux/blob/master/CVE-2018-5995.md - https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html - https://sec
an-lts-announce/2019/05/msg00041.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html - https://seclists.org/bugtraq/2019/Aug/18 - https://www.debian.org/security/2019/dsa-4497 - https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
CVE ID: CVE-2018-5996 State: PUBLISHED Published: 2018-01-31T18:00:00 Last Updated: 2025-01-10T18:55:21.411785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive. Additional Analyst Notes: - CVE Program Container: References: - https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ - http://www.securitytracker.com/id/1040831 - https://0patch.blogspot.si/2018/02/two-i
mory-corruptions-via-rar-and-zip/ - http://www.securitytracker.com/id/1040831 - https://0patch.blogspot.si/2018/02/two-interesting-micropatches-for-7-zip.html - https://github.com/p7zip-project/p7zip/issues/8 - https://github.com/p7zip-project/p7zip/issues/32
CVE ID: CVE-2018-5997 State: PUBLISHED Published: 2018-01-25T17:00:00 Last Updated: 2024-08-05T05:47:56.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a path traversal vulnerability, it is possible to upload a file on a filesystem with root privileges: this will lead to remote code execution as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43871/
CVE ID: CVE-2018-5999 State: PUBLISHED Published: 2018-01-22T20:00:00 Last Updated: 2024-08-05T05:47:56.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt - https://www.exploit-db.com/exploits/44176/ - https://blogs.securiteam.com/index.php/archives/3589 - https://www.exploit-db.com/exploits/43881/ - https://raw.githubusercontent.com/pedrib/PoC/master/exploits/m
hives/3589 - https://www.exploit-db.com/exploits/43881/ - https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb
CVE ID: CVE-2018-6000 State: PUBLISHED Published: 2018-01-22T20:00:00 Last Updated: 2024-08-05T05:47:56.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999. Additional Analyst Notes: - CVE Program Container: References: - https:
ted attackers in conjunction with CVE-2018-5999. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt - https://www.exploit-db.com/exploits/44176/ - https://blogs.securiteam.com/index.php/archives/3589 - https://www.exploit-db.com/exploits/43881/ - https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb
CVE ID: CVE-2018-6001 State: PUBLISHED Published: 2018-01-22T20:00:00Z Last Updated: 2024-09-17T01:27:05.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter). Additional Analyst Notes: - CVE Program Container: References: - http://www.defensecode.com/advisories/DC-2018-01-002_WordPress_Soundy_Audio_Playlist_Plugin_Advisory.pdf
CVE ID: CVE-2018-6002 State: PUBLISHED Published: 2018-01-22T20:00:00Z Last Updated: 2024-09-16T18:09:05.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter). Additional Analyst Notes: - CVE Program Container: References: - http://www.defensecode.com/advisories/DC-2018-01-001_WordPress_Soundy_Background_Music_Plugin_Advisory.pdf
CVE ID: CVE-2018-6003 State: PUBLISHED Published: 2018-01-22T20:00:00 Last Updated: 2024-08-05T05:47:56.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gnutls/libtasn1/commit/946565d8eb05fbf7970ea366e817581bb5a90910 - https://bugzilla.suse.com/show_bug.cgi?id=1076832 - https://bugzilla.redhat.com/show_bug.cgi?id=1535926 - https://www.debian.org/security/2018/dsa-4106 - http://git.savannah.nongnu.org/cgit/libtasn1.gi
how_bug.cgi?id=1535926 - https://www.debian.org/security/2018/dsa-4106 - http://git.savannah.nongnu.org/cgit/libtasn1.git/commit/?id=c593ae84cfcde8fea45787e53950e0ac71e9ca97 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2018-6004 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44110
CVE ID: CVE-2018-6005 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44125
CVE ID: CVE-2018-6006 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T05:47:56.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44119
CVE ID: CVE-2018-6007 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T05:47:56.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43912/ - https://packetstormsecurity.com/files/146135/Joomla-JS-Support-Ticket-1.1.0-Cross-Site-Request-Forgery.html
CVE ID: CVE-2018-6008 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T05:47:56.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43913/ - https://packetstormsecurity.com/files/146137/Joomla-Jtag-Members-Directory-5.3.7-Arbitrary-File-Download.html
CVE ID: CVE-2018-6009 State: PUBLISHED Published: 2018-01-22T22:00:00 Last Updated: 2024-08-05T05:47:56.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yiisoft/yii2/commit/6c0540aa2d6e0fe0fa89e4fd35bba4be5d6cece7
CVE ID: CVE-2018-6010 State: PUBLISHED Published: 2018-01-22T22:00:00 Last Updated: 2024-08-05T05:47:56.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yiisoft/yii2/pull/15534 - https://github.com/yiisoft/yii2/commit/6b0be47e0fa9c532e03b07b4369050582fcf5c7a - https://github.com/yiisoft/yii2/issues/14711