Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-18606 State: PUBLISHED Published: 2018-10-23T17:00:00 Last Updated: 2024-08-05T11:15:59.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105754 - https://security.netapp.com/advisory/ntap-20
Program Container: References: - http://www.securityfocus.com/bid/105754 - https://security.netapp.com/advisory/ntap-20190307-0003/ - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=45a0eaf77022963d639d6d19871dbab7b79703fc - https://sourceware.org/bugzilla/show_bug.cgi?id=23806 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-18607 State: PUBLISHED Published: 2018-10-23T17:00:00 Last Updated: 2024-08-05T11:16:00.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105754 - https://security.netapp.com/advisory/ntap-201903
gram Container: References: - http://www.securityfocus.com/bid/105754 - https://security.netapp.com/advisory/ntap-20190307-0003/ - https://sourceware.org/bugzilla/show_bug.cgi?id=23805 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=102def4da826b3d9e169741421e5e67e8731909a - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-18608 State: PUBLISHED Published: 2018-10-23T18:00:00Z Last Updated: 2024-09-16T20:43:38.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ky-j/dedecms/files/2504649/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7.SP2.docx - https://github.com/ky-j/dedecms/iss
es/2504649/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7.SP2.docx - https://github.com/ky-j/dedecms/issues/8
CVE ID: CVE-2018-18619 State: PUBLISHED Published: 2018-11-29T22:00:00 Last Updated: 2024-08-05T11:16:00.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter. NOTE: The product is discontinued. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Nov/30 - http://packetstormsecurity.com/files/150261/Advanced-Comment-System-1.0-SQL-Injecti
sts.org/fulldisclosure/2018/Nov/30 - http://packetstormsecurity.com/files/150261/Advanced-Comment-System-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/45853/
CVE ID: CVE-2018-18621 State: PUBLISHED Published: 2018-10-24T22:00:00 Last Updated: 2024-08-05T11:15:59.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email link (in .txt format) is modified and then renamed with a .html or .wssp extension. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149916/CommuniGatePro-Pronto-Webmail-6.2-Cross-Site-Scripting.html - https://drive.google.com/drive/folders/1irWaVi-AySHFFMap5pF1_7hk6mTeemDT
CVE ID: CVE-2018-18622 State: PUBLISHED Published: 2018-10-23T18:00:00Z Last Updated: 2024-09-17T03:18:45.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public&a=doregister username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caokang/waimai/issues/8
CVE ID: CVE-2018-18623 State: PUBLISHED Published: 2020-06-02T16:38:25 Last Updated: 2024-08-05T11:15:59.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/pull/11813 - https://security.netapp.com/advisory/ntap-20200608-0008/ - https://github.com/grafana/grafana/issues/15293 - https://github.com/grafana/grafana/releases/tag/v6.0.0
CVE ID: CVE-2018-18624 State: PUBLISHED Published: 2020-06-02T16:40:23 Last Updated: 2024-08-05T11:16:00.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/pull/11813 - https://security.netapp.com/advisory/ntap-20200608-0008/
CVE ID: CVE-2018-18625 State: PUBLISHED Published: 2020-06-02T16:41:00 Last Updated: 2024-08-05T11:16:00.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/pull/11813 - https://security.netapp.com/advisory/ntap-20200608-0008/
CVE ID: CVE-2018-18626 State: PUBLISHED Published: 2018-10-23T19:00:00Z Last Updated: 2024-09-16T20:57:21.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because del_action() in admin/model/database.class.php mishandles this parameter. Additional Analyst Notes: - CVE Program Container: References: - http://str3am.me/2018/10/23/CVE_01/#more
CVE ID: CVE-2018-18628 State: PUBLISHED Published: 2018-10-23T20:00:00Z Last Updated: 2024-09-16T20:48:19.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pippo-java/pippo/issues/458
CVE ID: CVE-2018-18629 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T11:15:59.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search path vulnerability in the keybase-redirector application allows a local, unprivileged user on Linux to gain root privileges via a Trojan horse binary. Additional Analyst Notes: - CVE Program Container: References: - https://keybase.io/docs/secadv/kb002 - https://blog.mirch.io/2018/12/21/cve-2018-18629-keybase-linux-privilege-escalation/ - https://hackerone.com/reports/426944
CVE ID: CVE-2018-18630 State: PUBLISHED Published: 2019-09-06T16:24:48 Last Updated: 2024-08-05T11:15:59.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local system access to execute unauthorized arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-19-241-01 - https://www.hipaajournal.com/code-execution-vulnerability-identified-in-change-healthcare-cardiology-devices/
CVE ID: CVE-2018-18631 State: PUBLISHED Published: 2019-05-29T21:28:56 Last Updated: 2024-08-05T11:15:59.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://bugzilla.zimbra.com/show_bug.cgi?id=109020
CVE ID: CVE-2018-18635 State: PUBLISHED Published: 2018-10-24T21:00:00 Last Updated: 2024-08-05T11:15:59.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MailCleaner/MailCleaner/issues/53 - https://github.com/MailCleaner/MailCleaner/commit/5f90a52785672fc688c1f85e472e84b8a0d008d8
CVE ID: CVE-2018-18636 State: PUBLISHED Published: 2018-10-24T21:00:00 Last Updated: 2024-08-05T11:15:59.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/149785/D-Link-DSL-2640T-Cross-Site-Scripting.html - https://cxsecurity.com/issue/WLB-2018100107
CVE ID: CVE-2018-18638 State: PUBLISHED Published: 2018-10-24T22:00:00 Last Updated: 2024-08-05T11:15:59.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/security-in-a-vacuum-hacking-the-neato-botvac-connected-part-1/
CVE ID: CVE-2018-18640 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:15:59.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through Browser Caching. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/51423 - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE ID: CVE-2018-18641 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:15:59.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of Sensitive Information. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/51113 - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE ID: CVE-2018-18642 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:16:00.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/52551 - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE ID: CVE-2018-18643 State: PUBLISHED Published: 2019-04-25T20:17:10 Last Updated: 2024-08-05T11:15:59.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/ - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/53385
CVE ID: CVE-2018-18644 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:16:00.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows Information Exposure via a Gitlab Prometheus integration. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/ - https://gitlab.com/gitlab-org/gitlab-ee/issues/7528
CVE ID: CVE-2018-18645 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:16:00.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exposure via unsubscribe links in email replies. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/24498 - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE ID: CVE-2018-18646 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:15:59.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/51142 - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE ID: CVE-2018-18647 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:16:00.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/ - https://gitlab.com/gitlab-org/gitlab-ee/issues/7538
CVE ID: CVE-2018-18648 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:15:59.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through an Error Message. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/50975 - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE ID: CVE-2018-18649 State: PUBLISHED Published: 2018-11-29T15:00:00 Last Updated: 2024-08-05T11:15:59.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/53072 - https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE ID: CVE-2018-18650 State: PUBLISHED Published: 2018-10-25T13:00:00Z Last Updated: 2024-09-17T04:09:01.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xpdf 4.00. XRef::readXRefStream in XRef.cc allows attackers to launch a denial of service (Integer Overflow) via a crafted /Size value in a pdf file, as demonstrated by pdftohtml. This is mainly caused by the program attempting a malloc operation for a large amount of memory. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41219&p=41747#p41747
CVE ID: CVE-2018-18651 State: PUBLISHED Published: 2018-10-25T13:00:00Z Last Updated: 2024-09-16T22:19:56.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xpdf 4.00. catalog->getNumPages() in AcroForm.cc allows attackers to launch a denial of service (hang caused by large loop) via a specific pdf file, as demonstrated by pdftohtml. This is mainly caused by a large number after the /Count field in the file. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41219&p=41747#p41747
CVE ID: CVE-2018-18652 State: PUBLISHED Published: 2018-10-25T23:00:00 Last Updated: 2024-08-05T11:16:00.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS18-003.html - http://www.securityfocus.com/bid/105737
CVE ID: CVE-2018-18653 State: PUBLISHED Published: 2018-10-26T00:00:00 Last Updated: 2024-08-05T11:16:00.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Secure Boot restrictions and execute untrusted code by loading arbitrary kernel modules. This occurs because a modified kernel/module.c, in conjunction with certain configuration options, leads to mishandling of the result of signature verification. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1798863 - https://usn.ubuntu.com/3835-1/ - https://
s: - CVE Program Container: References: - https://launchpad.net/bugs/1798863 - https://usn.ubuntu.com/3835-1/ - https://usn.ubuntu.com/3832-1/
CVE ID: CVE-2018-18654 State: PUBLISHED Published: 2018-10-26T00:00:00Z Last Updated: 2024-09-16T18:04:18.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crossroads 2.81 does not properly handle the /tmp directory during a build of xr. A local attacker can first create a world-writable subdirectory in a certain location under the /tmp directory, wait until a user process copies xr there, and then replace the entire contents of this subdirectory to include a Trojan horse xr. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/911877
CVE ID: CVE-2018-18655 State: PUBLISHED Published: 2018-10-26T00:00:00Z Last Updated: 2024-09-16T17:54:11.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting. Additional Analyst Notes: - CVE Program Container: References: - https://telescoper.wordpress.com/2018/10/18/a-breakthrough-for-a-bigot/#comment-339386 - https://bugs.debian.org/911842
CVE ID: CVE-2018-18656 State: PUBLISHED Published: 2018-10-26T12:00:00Z Last Updated: 2024-09-17T03:53:43.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PureVPN client before 6.1.0 for Windows stores Login Credentials (username and password) in cleartext. The location of such files is %PROGRAMDATA%\purevpn\config\login.conf. Additionally, all local users can read this file. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/Resources/SpiderLabs-Blog/Credential-Leak-Flaws-in-Windows-PureVPN-Client/
CVE ID: CVE-2018-18657 State: PUBLISHED Published: 2018-10-26T13:00:00Z Last Updated: 2024-09-17T01:50:32.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-18 Unauthenticated Sensitive Information Disclosure via /gateway/services/EdgeServiceImpl issue. Additional Analyst Notes: - CVE Program Container: References: - https://support.arcserve.com/s/article/360001392563?language=en_US - https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/ - https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en
sure/ - https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US
CVE ID: CVE-2018-18658 State: PUBLISHED Published: 2018-10-26T13:00:00Z Last Updated: 2024-09-16T17:54:24.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-20 Unauthenticated Sensitive Information Disclosure via /UDPUpdates/Config/FullUpdateSettings.xml issue. Additional Analyst Notes: - CVE Program Container: References: - https://support.arcserve.com/s/article/360001392563?language=en_US - https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/ - https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?lan
e-disclosure/ - https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US
CVE ID: CVE-2018-18659 State: PUBLISHED Published: 2018-10-26T13:00:00Z Last Updated: 2024-09-16T22:50:24.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue. Additional Analyst Notes: - CVE Program Container: References: - https://support.arcserve.com/s/article/360001392563?language=en_US - https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/ - https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US
CVE ID: CVE-2018-18660 State: PUBLISHED Published: 2018-10-26T13:00:00Z Last Updated: 2024-09-16T22:19:50.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue. Additional Analyst Notes: - CVE Program Container: References: - https://support.arcserve.com/s/article/360001392563?language=en_US - https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/ - https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US