Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-18510 State: PUBLISHED Published: 2019-04-26T16:13:22 Last Updated: 2024-08-05T11:08:21.900Z Vendors: Mozilla Products: Firefox Problem Types: Web content can link to internal about:crashcontent and about:crashparent pages Description: The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purposes. This issue allows for a non-persistent denial of service (DOS) attack by a malicious site which links to these pages. This vulnerability affects Firefox < 64. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ -
tional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2018-29/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1507702
CVE ID: CVE-2018-18511 State: PUBLISHED Published: 2019-04-26T16:13:22 Last Updated: 2024-08-05T11:08:21.991Z Vendors: Mozilla Products: Firefox Problem Types: Cross-origin theft of images with ImageBitmapRenderingContext Description: Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox < 65.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-04/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1526218 - https://seclists.org/bugtraq/2019
urity/advisories/mfsa2019-04/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1526218 - https://seclists.org/bugtraq/2019/May/56 - https://seclists.org/bugtraq/2019/May/59 - https://www.debian.org/security/2019/dsa-4448 - https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html - https://access.redhat.com/errata/RHSA-2019:1265 - https://access.redhat.com/errata/RHSA-2019:1267 - https://access.redhat.com/errata/RHSA-2019:1269 - https://www.debian.org/security/2019/dsa-4451 - https://seclists.org/bugtraq/2019/May/67 - https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html - https://usn.ubuntu.com/3997-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg000
/05/msg00038.html - https://usn.ubuntu.com/3997-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html - https://access.redhat.com/errata/RHSA-2019:1310 - https://access.redhat.com/errata/RHSA-2019:1308 - https://access.redhat.com/errata/RHSA-2019:1309 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html
CVE ID: CVE-2018-18512 State: PUBLISHED Published: 2019-04-26T16:13:22 Last Updated: 2024-08-05T11:08:21.990Z Vendors: Mozilla Products: Thunderbird Problem Types: Use-after-free during sound notifications Description: A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed, although the sound is still being played asynchronously, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1482659
CVE ID: CVE-2018-18513 State: PUBLISHED Published: 2019-04-26T16:13:22 Last Updated: 2024-08-05T11:08:22.015Z Vendors: Mozilla Products: Thunderbird Problem Types: DOS and crash with crafted S/MIME message or XPI package Description: A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service (DOS) attack because Thunderbird reopens the last seen message on restart, triggering the crash again. This vulnerability affects Thunderbird < 60.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-03/ - https://bugzilla.mozilla.org/show_bug.cgi?i
er: References: - https://www.mozilla.org/security/advisories/mfsa2019-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1533300
CVE ID: CVE-2018-18514 State: REJECTED Published: 2020-01-09T14:29:31 Last Updated: 2020-01-09T14:29:31 Description: No description available.
CVE ID: CVE-2018-18515 State: REJECTED Published: 2020-01-09T14:30:46 Last Updated: 2020-01-09T14:30:46 Description: No description available.
CVE ID: CVE-2018-18516 State: REJECTED Published: 2020-01-09T14:31:22 Last Updated: 2020-01-09T14:31:22 Description: No description available.
CVE ID: CVE-2018-18517 State: PUBLISHED Published: 2018-10-24T21:00:00 Last Updated: 2024-08-05T11:15:58.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105725 - https://support.citrix.com/article/CTX239002 - http://www.securitytracker.com/id/1042023
CVE ID: CVE-2018-18519 State: PUBLISHED Published: 2018-11-19T08:00:00 Last Updated: 2024-08-05T11:15:58.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe" file because of insecure permissions for the BUILTIN\Users group. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilsani/rd/tree/master/security-advisories/bestxsoftware/cve-2018-18519
CVE ID: CVE-2018-18520 State: PUBLISHED Published: 2018-10-19T17:00:00 Last Updated: 2024-08-05T11:15:58.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://sourceware.org/ml/elfutils-
: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html - https://sourceware.org/bugzilla/show_bug.cgi?id=23787 - https://usn.ubuntu.com/4012-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html - https://access.redhat.com/errata/RHSA-2019:2197 - https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html
CVE ID: CVE-2018-18521 State: PUBLISHED Published: 2018-10-19T17:00:00 Last Updated: 2024-08-05T11:15:58.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html - https://sourceware.org/bugzilla/show_bug.cgi?id=23786 - https://usn.
eware.org/ml/elfutils-devel/2018-q4/msg00055.html - https://sourceware.org/bugzilla/show_bug.cgi?id=23786 - https://usn.ubuntu.com/4012-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html - https://access.redhat.com/errata/RHSA-2019:2197 - https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html
CVE ID: CVE-2018-18524 State: PUBLISHED Published: 2019-05-13T13:02:05 Last Updated: 2024-08-05T11:15:58.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution command on the victim's computer. Additional Analyst Notes: - CVE Program Container: References: - https://evernote.com/intl/en/security/updates - https://paper.seebug.org/737/
CVE ID: CVE-2018-18527 State: PUBLISHED Published: 2018-10-19T19:00:00 Last Updated: 2024-08-05T11:15:58.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: OwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45637/
CVE ID: CVE-2018-18529 State: PUBLISHED Published: 2018-10-19T20:00:00Z Last Updated: 2024-09-16T22:20:52.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.kingkk.com/2018/10/Thinkphp-%E8%81%9A%E5%90%88%E6%9F%A5%E8%AF%A2%E6%BC%8F%E6%B4%9E/#ThinkPHP3-lt-3-2-4
CVE ID: CVE-2018-18530 State: PUBLISHED Published: 2018-10-19T20:00:00Z Last Updated: 2024-09-17T00:35:42.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.kingkk.com/2018/10/Thinkphp-%E8%81%9A%E5%90%88%E6%9F%A5%E8%AF%A2%E6%BC%8F%E6%B4%9E/#ThinkPHP5-lt-5-1-25
CVE ID: CVE-2018-18531 State: PUBLISHED Published: 2018-10-19T20:00:00Z Last Updated: 2024-09-17T04:10:30.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (rather than SecureRandom) function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force approach. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/penggle/kaptcha/issues/3
CVE ID: CVE-2018-18535 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T11:15:58.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers (MSRs). This could be leveraged to execute arbitrary ring-0 code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106250 - http://packetstormsecurity.com/files/150893/ASUS-Driver-Privilege-Escalation.html - https://www.secureauth.com/labs/advisories/asus-drivers-elevation-privilege-vulnerabilities - http://seclists.org/fulldisclosure/2018/Dec/3
uth.com/labs/advisories/asus-drivers-elevation-privilege-vulnerabilities - http://seclists.org/fulldisclosure/2018/Dec/34
CVE ID: CVE-2018-18536 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T11:15:58.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106250 - http://packetstormsecurity.com/files/150893/ASUS-Driver-Privilege-Escalation.html - https://www.secureauth.com/labs/advisories/asus-drivers-elevation-privilege-vulnerabilities - http://seclists
ion.html - https://www.secureauth.com/labs/advisories/asus-drivers-elevation-privilege-vulnerabilities - http://seclists.org/fulldisclosure/2018/Dec/34
CVE ID: CVE-2018-18537 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T11:15:58.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106250 - http://packetstormsecurity.com/files/150893/ASUS-Driver-Privilege-Escalation.html - https://www.secureauth.com/labs/advisories/asus-drivers-elevation-privilege-vulnerabilities - http://seclists.org/fulldisclosure/2018/Dec/34
CVE ID: CVE-2018-18540 State: PUBLISHED Published: 2018-10-20T21:00:00 Last Updated: 2024-08-05T11:15:59.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeaKKi 2.7 allows XSS via a crafted onerror attribute for a picture's URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Teakki/issue/issues/24
CVE ID: CVE-2018-18541 State: PUBLISHED Published: 2018-10-20T22:00:00 Last Updated: 2024-08-05T11:15:59.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. Additional Analyst Notes: - CVE Program Container: References: - https://teeworlds.com/?page=news&id=12544 - https://github.com/teeworlds/teeworlds/issues/1536 - https://bugs.debian.org/911487 - https://www.debian.org/security/
- https://github.com/teeworlds/teeworlds/issues/1536 - https://bugs.debian.org/911487 - https://www.debian.org/security/2018/dsa-4329 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00046.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00077.html
CVE ID: CVE-2018-18544 State: PUBLISHED Published: 2018-10-21T01:00:00 Last Updated: 2024-08-05T11:15:58.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1360 - http://hg.code.sf.net/p/graphicsmagick/code/file/233618f8fe82/ChangeLog - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-18545 State: PUBLISHED Published: 2018-10-21T01:00:00 Last Updated: 2024-08-05T11:15:59.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FiyoCMS/FiyoCMS/issues/14
CVE ID: CVE-2018-18546 State: PUBLISHED Published: 2018-10-21T01:00:00Z Last Updated: 2024-09-17T00:22:01.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/top-think/thinkphp/commit/9748cb80d2f24c89218f358ca2f5ab88ee33396f - https://98587329.github.io/2018/10/09/thinkphp%E6%B3%A8%E5%85%A5%E5%88%86%E6%9E%90/
CVE ID: CVE-2018-18547 State: PUBLISHED Published: 2018-10-24T21:00:00 Last Updated: 2024-08-05T11:16:00.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dir_a parameter, or the filename to the list/directory/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://numanozdemir.com/vesta-vulns.txt - http://packetstormsecurity.com/files/149897/VestaCP-0.9.8-22-Cross-Site-Scripting.html
CVE ID: CVE-2018-18548 State: PUBLISHED Published: 2018-10-24T21:00:00 Last Updated: 2024-08-05T11:15:59.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager. Additional Analyst Notes: - CVE Program Container: References: - https://numanozdemir.com/ajenti-xss.txt - https://www.exploit-db.com/exploits/45691/ - http://packetstormsecurity.com/files/149898/AjentiCP-1.2.23.13-Cross-Site-Scripting.html
CVE ID: CVE-2018-18550 State: PUBLISHED Published: 2018-10-21T23:00:00Z Last Updated: 2024-09-16T19:20:20.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: ServersCheck Monitoring Software before 14.3.4 allows SQL Injection by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://serverscheck.com/monitoring-software/release.asp
CVE ID: CVE-2018-18551 State: PUBLISHED Published: 2018-10-24T22:00:00 Last Updated: 2024-08-05T11:15:59.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type parameter, sensors.html device parameter, report.html location parameter, group_delete.html group parameter, report_save.html query parameter, sensors.html location parameter, or group_delete.html group parameter. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/CVE-2018-18551-SERVERSCHECK-MONITORING-SOFTWARE-CROSS-SITE-SCRIPTING.tx
es: - http://hyp3rlinx.altervista.org/advisories/CVE-2018-18551-SERVERSCHECK-MONITORING-SOFTWARE-CROSS-SITE-SCRIPTING.txt - http://packetstormsecurity.com/files/149914/ServersCheck-Monitoring-Software-14.3.3-Cross-Site-Scripting.html
CVE ID: CVE-2018-18552 State: PUBLISHED Published: 2018-10-24T22:00:00 Last Updated: 2024-08-05T11:15:59.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: ServersCheck Monitoring Software through 14.3.3 allows local users to cause a denial of service (menu functionality loss) by creating an LNK file that points to a second LNK file, if this second LNK file is associated with a Start menu. Ultimately, this behavior comes from a Directory Traversal bug (via the sensor_details.html id parameter) that allows creating empty files in arbitrary directories. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149907/ServersCheck-Monitor
l Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149907/ServersCheck-Monitoring-Software-14.3.3-Arbitrary-File-Write-DoS.html - http://hyp3rlinx.altervista.org/advisories/CVE-2018-18552-SERVERSCHECK-MONITORING-SOFTWARE-ARBITRARY-FILE-WRITE-DOS.txt
CVE ID: CVE-2018-18553 State: PUBLISHED Published: 2018-10-22T01:00:00 Last Updated: 2024-08-05T11:15:59.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leanote/leanote/issues/822
CVE ID: CVE-2018-18555 State: PUBLISHED Published: 2018-12-17T18:00:00 Last Updated: 2024-08-05T11:15:59.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account. Additional Analyst Notes: - CVE Program Container: References: - https://blog.vyos.io/the-operator-leve
y their account. Additional Analyst Notes: - CVE Program Container: References: - https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases
CVE ID: CVE-2018-18556 State: PUBLISHED Published: 2018-12-17T18:00:00 Last Updated: 2024-08-05T11:15:59.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://blog.vyos.io/the-operator-level-is-proved-insecu
dditional Analyst Notes: - CVE Program Container: References: - https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases - https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users/ - http://packetstormsecurity.com/files/159234/VyOS-restricted-shell-Escape-Privilege-Escalation.html
CVE ID: CVE-2018-18557 State: PUBLISHED Published: 2018-10-22T16:00:00 Last Updated: 2024-08-05T11:15:59.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3864-1/ - https://www.debian.org/security/2018/dsa-4349 - https://www.exploit-db.com/exploits/45694/ - https://git
u.com/3864-1/ - https://www.debian.org/security/2018/dsa-4349 - https://www.exploit-db.com/exploits/45694/ - https://gitlab.com/libtiff/libtiff/merge_requests/38 - https://lists.debian.org/debian-lts-announce/2018/10/msg00019.html - https://usn.ubuntu.com/3906-2/ - https://security.gentoo.org/glsa/201904-15 - https://gitlab.com/libtiff/libtiff/commit/681748ec2f5ce88da5f9fa6831e1653e46af8a66 - https://access.redhat.com/errata/RHSA-2019:2053 - https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2018-18557
CVE ID: CVE-2018-18558 State: PUBLISHED Published: 2019-05-13T12:49:59 Last Updated: 2024-08-05T11:15:58.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacker to bypass secure boot checks and execute arbitrary code, by crafting an application binary that overwrites a bootloader code segment in process_segment in components/bootloader_support/src/esp_image_format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerabilit
attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espressif/esp-idf/releases - https://www.espressif.com/en/news/Espressif_Product_Security_Advisory_Concerning_Secure_Boot_%28CVE-2018-18558%29