Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-15552 State: PUBLISHED Published: 2018-09-07T22:00:00 Last Updated: 2024-08-05T09:54:03.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-15552
CVE ID: CVE-2018-15553 State: PUBLISHED Published: 2018-08-20T00:00:00 Last Updated: 2024-08-05T09:54:03.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters in the smbdUserid or smbdPasswd field. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Aug/75
CVE ID: CVE-2018-15555 State: PUBLISHED Published: 2019-06-28T14:34:51 Last Updated: 2024-08-05T09:54:03.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by using the enabled onboard UART headers. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Jun/1 - http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2019/Jun/1
CVE ID: CVE-2018-15556 State: PUBLISHED Published: 2019-06-27T16:55:25 Last Updated: 2024-08-05T09:54:03.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "root" and an empty password by using the enabled onboard UART headers. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Jun/1 - http://seclists.org/fulldisclosure/2019/Jun/1 - http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html
CVE ID: CVE-2018-15557 State: PUBLISHED Published: 2019-06-27T16:52:48 Last Updated: 2024-08-05T09:54:03.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 devices. An attacker can statically set his/her IP to anything on the 169.254.1.0/24 subnet, and obtain root access by connecting to 169.254.1.2 port 23 with telnet/netcat. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Jun/2 - http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2019/Jun/2
CVE ID: CVE-2018-15559 State: PUBLISHED Published: 2018-08-20T00:00:00 Last Updated: 2024-08-05T09:54:03.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: The editor in Xiuno BBS 4.0.4 allows stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://bbs.xiuno.com/thread-148095.htm
CVE ID: CVE-2018-15560 State: PUBLISHED Published: 2018-08-20T00:00:00 Last Updated: 2024-08-05T09:54:03.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes. Additional Analyst Notes: - CVE Program Container: References: - https://whitehatck01.blogspot.com/2018/08/integer-overflow-vulnerability-in.html - https://github.com/Legrandin/pycryptodome/issues/198
CVE ID: CVE-2018-15562 State: PUBLISHED Published: 2018-08-29T19:00:00 Last Updated: 2024-08-05T10:01:53.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149109/CMS-ISWEB-3.5.3-Cross-Site-Scripting.html
CVE ID: CVE-2018-15563 State: PUBLISHED Published: 2018-10-02T18:00:00 Last Updated: 2024-08-05T10:01:53.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: _core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2018090261
CVE ID: CVE-2018-15564 State: PUBLISHED Published: 2018-08-20T01:00:00 Last Updated: 2024-08-05T10:01:53.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daveismyname/simple-cms/issues/4
CVE ID: CVE-2018-15565 State: PUBLISHED Published: 2018-08-20T01:00:00 Last Updated: 2024-08-05T10:01:53.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daveismyname/simple-cms/issues/2 - https://github.com/daveismyname/simple-cms/issues/3
CVE ID: CVE-2018-15566 State: PUBLISHED Published: 2018-08-20T01:00:00 Last Updated: 2024-08-05T10:01:53.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fmsdwifull/tp5cms/issues/2
CVE ID: CVE-2018-15567 State: PUBLISHED Published: 2018-08-20T01:00:00 Last Updated: 2024-08-05T10:01:53.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMSUno before 1.5.3 has XSS via the title field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/boiteasite/cmsuno/issues/7
CVE ID: CVE-2018-15568 State: PUBLISHED Published: 2018-08-20T01:00:00 Last Updated: 2024-08-05T10:01:53.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fmsdwifull/tp5cms/issues/3
CVE ID: CVE-2018-15569 State: PUBLISHED Published: 2018-08-20T01:00:00 Last Updated: 2024-08-05T10:01:53.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: my little forum 2.4.12 allows CSRF for deletion of users. Additional Analyst Notes: - CVE Program Container: References: - http://owendarlene.com/csrf-my-little-forum/
CVE ID: CVE-2018-15570 State: PUBLISHED Published: 2018-08-20T01:00:00 Last Updated: 2024-08-05T10:01:53.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caokang/waimai/issues/4
CVE ID: CVE-2018-15571 State: PUBLISHED Published: 2018-08-28T17:00:00 Last Updated: 2024-08-05T10:01:53.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection. Additional Analyst Notes: - CVE Program Container: References: - https://hackpuntes.com/cve-2018-15571-wordpress-plugin-export-users-to-csv-1-1-1-csv-injection/ - https://www.exploit-db.com/exploits/45206/
CVE ID: CVE-2018-15572 State: PUBLISHED Published: 2018-08-20T02:00:00 Last Updated: 2024-08-05T10:01:54.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fdf82a7856b32d905c39afc85e34364491e46346 - https://usn.ubuntu.com/3776-1/ - https://usn.ubuntu.com/3776-2/ - https://usn.ubuntu.com/3777-1/ - https://g
491e46346 - https://usn.ubuntu.com/3776-1/ - https://usn.ubuntu.com/3776-2/ - https://usn.ubuntu.com/3777-1/ - https://github.com/torvalds/linux/commit/fdf82a7856b32d905c39afc85e34364491e46346 - https://usn.ubuntu.com/3775-1/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://www.debian.org/security/2018/dsa-4308 - https://usn.ubuntu.com/3775-2/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.1 - https://usn.ubuntu.com/3777-2/ - https://usn.ubuntu.com/3777-3/
CVE ID: CVE-2018-15573 State: PUBLISHED Published: 2018-08-20T02:00:00 Last Updated: 2024-08-05T10:01:54.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Reprise License Manager (RLM) through 12.2BL2. Attackers can use the web interface to read and write data to any file on disk (as long as rlm.exe has access to it) via /goform/edit_lf_process with file content in the lfdata parameter and a pathname in the lf parameter. By default, the web interface is on port 5054, and does not require authentication. NOTE: the vendor has stated "We do not consider this a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bitther
e do not consider this a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bittherapy.net/rce-with-arbitrary-file-write-and-xss-in-reprise-license-manager/ - http://seclists.org/fulldisclosure/2021/Dec/18
CVE ID: CVE-2018-15574 State: PUBLISHED Published: 2018-08-20T02:00:00 Last Updated: 2024-11-14T20:35:19.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/edit_lf_get_data lf parameter via GET or POST. NOTE: the vendor has stated "We do not consider this a vulnerability." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bittherapy.net/rce-with-arbitrary-file-write-and-xss-in-reprise-license-manager/ - https://reprisesoftware.com/docs/whats-new.html
CVE ID: CVE-2018-15576 State: PUBLISHED Published: 2018-08-24T21:00:00 Last Updated: 2024-08-05T10:01:53.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploited for remote code execution in the decrypt function, if the attacker knows the key. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149018/Easylogin-Pro-1.3.0-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/45227/
CVE ID: CVE-2018-15580 State: PUBLISHED Published: 2019-04-26T19:10:05 Last Updated: 2024-08-05T10:01:53.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-4182a3e8b74f6eb325c45862f8f26e76
CVE ID: CVE-2018-15581 State: PUBLISHED Published: 2019-04-26T19:01:03 Last Updated: 2024-08-05T10:01:53.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-4280d95d6643b5d9673962736ada210b
CVE ID: CVE-2018-15582 State: PUBLISHED Published: 2019-04-26T19:13:56 Last Updated: 2024-08-05T10:01:53.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-737f14a5f5bdad53c5ce9b3ec628bf6d - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-72e9a967d5cebb96734e6f6984091e66
CVE ID: CVE-2018-15583 State: PUBLISHED Published: 2019-03-25T20:19:33 Last Updated: 2024-08-05T10:01:53.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gnuboard/gnuboard5/commits/master?after=831219e2c233b2d721a049b7aeb054936d000dc2+69 - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-6e31fc60ba119c0f830f8a22fe1925dc
CVE ID: CVE-2018-15584 State: PUBLISHED Published: 2019-04-26T19:06:56 Last Updated: 2024-08-05T10:01:54.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-0e9aa589be0cec73df5f154aa40f5b06 - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-22d0b3c0987a60483473990fc07f1886
CVE ID: CVE-2018-15585 State: PUBLISHED Published: 2019-03-27T19:01:33 Last Updated: 2024-08-05T10:01:53.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gnuboard/gnuboard5/blob/b1fc952c7600b825c4b02e2789ddafdea18c8d13/adm/newwinform.php - https://github.com/gnuboard/gnuboard5/blob/b1fc952c7600b825c4b02e2789ddafdea18c8d13/adm/newwinformupdate.php - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e27
4b02e2789ddafdea18c8d13/adm/newwinformupdate.php - https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13
CVE ID: CVE-2018-15586 State: PUBLISHED Published: 2019-02-11T17:00:00 Last Updated: 2024-08-05T10:01:54.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/enigmail/bugs/849/ - http://www.openwall.com/lists/oss-security/2019/04/30/4 - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://git
stormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
CVE ID: CVE-2018-15587 State: PUBLISHED Published: 2019-02-11T17:00:00 Last Updated: 2024-08-05T10:01:54.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.gnome.org/show_bug.cgi?id=796424 - https://lists.debian.org/debian-lts-announce/2019/04/msg00027.html - http://www.openwall.com/lists/oss-security/2019/04/30/4 - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecu
w.openwall.com/lists/oss-security/2019/04/30/4 - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00061.html - https://usn.ubuntu.com/3998-1/ - https://www.debian.org/security/2019/dsa-4457 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00024.html - https://seclists.org/bugtraq/2019/Jun/7
CVE ID: CVE-2018-15588 State: PUBLISHED Published: 2019-02-11T17:00:00 Last Updated: 2024-08-05T10:01:53.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email. Additional Analyst Notes: - CVE Program Container: References: - https://updates.mailmate-app.com/release_notes - http://www.openwall.com/lists/oss-security/2019/04/30/4 - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
CVE ID: CVE-2018-15590 State: PUBLISHED Published: 2018-10-15T16:00:00 Last Updated: 2024-08-05T10:01:53.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Workspace Control before 10.3.0.0 and RES One Workspace, when file and folder security are configured. A local authenticated user can bypass file and folder security restriction by leveraging an unspecified attack vector. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2018/Oct/10 - https://community.ivanti.com/docs/DOC-69682 - https://www.securify.nl/en/advisory/SFY20180803/ivanti-workspace-control-data-security-bypass-via-localhost-unc-path.html
ttps://www.securify.nl/en/advisory/SFY20180803/ivanti-workspace-control-data-security-bypass-via-localhost-unc-path.html - http://seclists.org/fulldisclosure/2018/Oct/2 - http://packetstormsecurity.com/files/149617/Ivanti-Workspace-Control-UNC-Path-Data-Security-Bypass.html
CVE ID: CVE-2018-15591 State: PUBLISHED Published: 2018-10-15T16:00:00 Last Updated: 2024-08-05T10:01:54.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can bypass Application Whitelisting restrictions to execute arbitrary code by leveraging multiple unspecified attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Oct/4 - https://community.ivanti.com/docs/DOC-69684 - http://packetstormsecurity.com/files/149614/Ivanti-Workspace-Control-Application-PowerGrid-SEE-Whitelist-Bypass.html - https://
packetstormsecurity.com/files/149614/Ivanti-Workspace-Control-Application-PowerGrid-SEE-Whitelist-Bypass.html - https://seclists.org/bugtraq/2018/Oct/8 - https://www.securify.nl/en/advisory/SFY20180806/ivanti-workspace-control-application-whitelist-bypass-via-powergrid-_see-command-line-argument.html
CVE ID: CVE-2018-15592 State: PUBLISHED Published: 2018-10-15T16:00:00 Last Updated: 2024-08-05T10:01:53.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can execute processes with elevated privileges via an unspecified attack vector. Additional Analyst Notes: - CVE Program Container: References: - https://community.ivanti.com/docs/DOC-69692 - http://packetstormsecurity.com/files/149615/Ivanti-Workspace-Control-Named-Pipe-Privilege-Escalation.html - https://seclists.org/bugtraq/2018/Oct/7 - http://seclists.org/fulldisclosure/2018/Oct/1 - https://www.securify.n
.html - https://seclists.org/bugtraq/2018/Oct/7 - http://seclists.org/fulldisclosure/2018/Oct/1 - https://www.securify.nl/en/advisory/SFY20180802/ivanti-workspace-control-local-privilege-escalation-via-named-pipe.html
CVE ID: CVE-2018-15593 State: PUBLISHED Published: 2018-10-15T16:00:00 Last Updated: 2024-08-05T10:01:53.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can decrypt the encrypted datastore or relay server password by leveraging an unspecified attack vector. Additional Analyst Notes: - CVE Program Container: References: - https://www.securify.nl/en/advisory/SFY20180804/stored-credentials-ivanti-workspace-control-can-be-retrieved-from-registry.html - http://seclists.org/fulldisclosure/2018/Oct/3 - https://seclists.org/bugtraq/2018/Oct/5 - http://packetstormsecu
.html - http://seclists.org/fulldisclosure/2018/Oct/3 - https://seclists.org/bugtraq/2018/Oct/5 - http://packetstormsecurity.com/files/149616/Ivanti-Workspace-Control-Registry-Stored-Credentials.html - https://community.ivanti.com/docs/DOC-69693
CVE ID: CVE-2018-15594 State: PUBLISHED Published: 2018-08-20T08:00:00 Last Updated: 2024-08-05T10:01:54.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3776-1/ - https://twitter.com/grsecurity/status/1029324426142199808 - https://usn.ubuntu.com/3776-2/ - https://usn.ubuntu.com/3777-1/ - https://usn.ubuntu.com/3775-1/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://github.
- https://usn.ubuntu.com/3775-1/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://github.com/torvalds/linux/commit/5800dc5c19f34e6e03b5adab1282535cb102fafd - https://www.debian.org/security/2018/dsa-4308 - https://usn.ubuntu.com/3775-2/ - http://www.securityfocus.com/bid/105120 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.1 - http://www.securitytracker.com/id/1041601 - https://usn.ubuntu.com/3777-2/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5800dc5c19f34e6e03b5adab1282535cb102fafd - https://usn.ubuntu.com/3777-3/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html - https://access.redha
n.ubuntu.com/3777-3/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029
CVE ID: CVE-2018-15596 State: PUBLISHED Published: 2018-08-28T19:00:00 Last Updated: 2024-08-05T10:01:53.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can generate a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15. The thread titles (within title elements of the generated XML documents) aren't sanitized, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45393/ - https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/