Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-3785 State: PUBLISHED Published: 2018-08-17T13:00:00 Last Updated: 2024-08-05T04:50:30.850Z Vendors: https://github.com/stevemao Products: git-dummy-commit Problem Types: CWE-78 Description: A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/341710
CVE ID: CVE-2018-3786 State: PUBLISHED Published: 2018-08-24T20:00:00Z Last Updated: 2024-09-16T17:59:02.562Z Vendors: Egg Products: egg-scripts Problem Types: CWE-77 Description: A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eggjs/egg-scripts/pull/26 - https://hackerone.com/reports/388936 - https://github.com/eggjs/egg-scripts/blob/2.8.1/History.md
CVE ID: CVE-2018-3787 State: PUBLISHED Published: 2018-08-31T16:00:00Z Last Updated: 2024-09-16T18:03:37.666Z Vendors: HackerOne Products: simplehttpserver Problem Types: CWE-22 Description: Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/357109
CVE ID: CVE-2018-3809 State: PUBLISHED Published: 2018-06-01T19:00:00Z Last Updated: 2024-09-17T00:52:19.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/330650
CVE ID: CVE-2018-3810 State: PUBLISHED Published: 2018-01-01T06:00:00 Last Updated: 2024-08-05T04:57:22.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code. Additional Analyst Notes: - CVE Program Container: References
thenticated user to successfully update the inserted code. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/smart-google-code-inserter/#developers - https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.html - https://wpvulndb.com/vulnerabilities/8987 - https://www.exploit-db.com/exploits/43420/
CVE ID: CVE-2018-3811 State: PUBLISHED Published: 2018-01-01T06:00:00 Last Updated: 2024-08-05T04:57:22.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8988 - https://wordpress.org/plugins/smart-google-code-i
m Container: References: - https://wpvulndb.com/vulnerabilities/8988 - https://wordpress.org/plugins/smart-google-code-inserter/#developers - https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.html - https://www.exploit-db.com/exploits/43420/
CVE ID: CVE-2018-3813 State: PUBLISHED Published: 2018-01-01T20:00:00 Last Updated: 2024-08-05T04:57:22.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USER_ID and AVI_USER_PASSWORD fields via a direct request. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.cl/2018/01/brickstream-recuento-y-seguimiento-de.html
CVE ID: CVE-2018-3814 State: PUBLISHED Published: 2018-01-01T20:00:00 Last Updated: 2024-08-05T04:57:22.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Snowty/myCVE/blob/master/CraftCMS-2.6.3000/README.md
CVE ID: CVE-2018-3815 State: PUBLISHED Published: 2018-01-08T05:00:00 Last Updated: 2024-08-05T04:57:22.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol Validation attack that leads to an email spoofing attack, allowing a malicious authenticated attacker to send a message from any source email address. The attack uses an HTTP POST request to a /Session URI, and interchanges the XML From and To elements. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/145724/communiga
Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/145724/communigatepro62-spoof
CVE ID: CVE-2018-3817 State: PUBLISHED Published: 2018-03-30T20:00:00 Last Updated: 2024-08-05T04:57:22.973Z Vendors: Elastic Products: Logstash Problem Types: CWE-532 Description: When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763
CVE ID: CVE-2018-3818 State: PUBLISHED Published: 2018-03-30T20:00:00 Last Updated: 2024-08-05T04:57:23.014Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763 - http://www.securityfocus.com/bid/102734
CVE ID: CVE-2018-3819 State: PUBLISHED Published: 2018-03-30T20:00:00 Last Updated: 2024-08-05T04:57:22.975Z Vendors: Elastic Products: Kibana Problem Types: CWE-601 Description: The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683
CVE ID: CVE-2018-3820 State: PUBLISHED Published: 2018-03-30T20:00:00 Last Updated: 2024-08-05T04:57:24.036Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683
CVE ID: CVE-2018-3821 State: PUBLISHED Published: 2018-03-30T20:00:00 Last Updated: 2024-08-05T04:57:23.975Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683
CVE ID: CVE-2018-3822 State: PUBLISHED Published: 2018-03-30T20:00:00 Last Updated: 2024-08-05T04:57:23.752Z Vendors: Elastic Products: X-Pack Security Problem Types: CWE-287 Description: X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacker might have been able to impersonate a legitimate user if the SAML Identity Provider allows for self registration with arbitrary identifiers and the attacker can register an account which an identifier that shares a suffix with a legitimate account. Both of those conditions must be true in order to exploit this flaw. Additional Analyst Notes: - CVE P
gitimate account. Both of those conditions must be true in order to exploit this flaw. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-2-3-security-update/124848
CVE ID: CVE-2018-3823 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:23.727Z Vendors: Elastic Products: Elasticsearch X-Pack Machine Learning Problem Types: CWE-79 Description: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-
Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422 - https://www.elastic.co/community/security
CVE ID: CVE-2018-3824 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:24.004Z Vendors: Elastic Products: Elasticsearch X-Pack Machine Learning Problem Types: CWE-79 Description: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-2-4
user. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422 - https://www.elastic.co/community/security
CVE ID: CVE-2018-3825 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:24.044Z Vendors: Elastic Products: Elastic Cloud Enterprise (ECE) Problem Types: CWE-321 Description: In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co
ts if their cluster ID is known. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
CVE ID: CVE-2018-3826 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:24.440Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-200 Description: In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777
CVE ID: CVE-2018-3827 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:23.966Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-532 Description: A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777
CVE ID: CVE-2018-3828 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:24.513Z Vendors: Elastic Products: Elastic Cloud Enterprise Problem Types: CWE-532 Description: Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to the logging cluster may obtain leaked credentials and perform authenticated actions using these credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/communit
sing these credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
CVE ID: CVE-2018-3829 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:23.572Z Vendors: Elastic Products: Elastic Cloud Enterprise Problem Types: CWE-285 Description: In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An attacker with access to the previous runner ID and IP address of the coordinator-host could add a allocator to an existing ECE install to gain access to other clusters data. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-
: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
CVE ID: CVE-2018-3830 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:24.498Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035 - https://access.redhat.com/errata/RHSA-2018:3537 - https://www.elastic.co/community/security
CVE ID: CVE-2018-3831 State: PUBLISHED Published: 2018-09-19T19:00:00 Last Updated: 2024-08-05T04:57:24.076Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-200 Description: Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security
alyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035 - https://www.elastic.co/community/security
CVE ID: CVE-2018-3832 State: PUBLISHED Published: 2018-08-23T14:00:00Z Last Updated: 2024-09-17T03:28:53.011Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Insteon Products: Insteon Problem Types: leftover debug code Description: An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger this vulnerability, an attacker can upload an MPFS binary via the '/mpfsupload' HTTP form and later on upload the firmware via a POST re
ty, an attacker can upload an MPFS binary via the '/mpfsupload' HTTP form and later on upload the firmware via a POST request to 'firmware.htm'. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0511
CVE ID: CVE-2018-3833 State: PUBLISHED Published: 2018-08-23T14:00:00Z Last Updated: 2024-09-17T02:26:41.031Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Insteon Products: Insteon Problem Types: Improper Access Control Description: An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed and thus allows for flashing older firmware images. To trigger this vulnerability, an attacker needs to impersonate the remote server '
for flashing older firmware images. To trigger this vulnerability, an attacker needs to impersonate the remote server 'cache.insteon.com' and serve any signed firmware image. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512
CVE ID: CVE-2018-3834 State: PUBLISHED Published: 2018-08-02T19:00:00 Last Updated: 2024-08-05T04:57:23.574Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H) Vendors: Insteon Products: Insteon Problem Types: Improper Access Control Description: An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going to be installed and thus allows for flashing any signed firmware into any MCU. Since the device contains different and incompatible MCUs,
nd thus allows for flashing any signed firmware into any MCU. Since the device contains different and incompatible MCUs, flashing one firmware to the wrong MCU will result in a permanent brick condition. To trigger this vulnerability, an attacker needs to impersonate the remote server "cache.insteon.com" and serve a signed firmware image. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0513
CVE ID: CVE-2018-3835 State: PUBLISHED Published: 2018-01-29T20:00:00Z Last Updated: 2024-09-16T16:42:37.311Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Talos Products: Walt Disney Animation Studios PTEX Problem Types: buffer overflow Description: An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX. The vulnerability is present in the reading of a file without proper parameter checking. The value read in, is not verified to be valid and its use can lead to a buffer overflow, potentially resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: -
fer overflow, potentially resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0515
CVE ID: CVE-2018-3836 State: PUBLISHED Published: 2018-04-24T19:00:00Z Last Updated: 2024-09-16T16:22:40.419Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dan Bloomberg Products: Leptonica Problem Types: arbitrary code execution Description: An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An attacker can provide a malicious path as input to an application that passes attacker data to this function to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References:
ker data to this function to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/02/msg00019.html - https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0516
CVE ID: CVE-2018-3837 State: PUBLISHED Published: 2018-04-10T21:00:00Z Last Updated: 2024-09-16T17:58:09.920Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Cisco Systems, Inc. Products: Simple Direct Media Problem Types: Heap Based-Overflow Description: An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted PCX image can cause an out-of-bounds read on the heap, resulting in information disclosure . An attacker can display a specially crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https
ally crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4177 - https://www.debian.org/security/2018/dsa-4184 - https://security.gentoo.org/glsa/201903-17 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0519 - https://www.starwindsoftware.com/security/sw-20191008-0001/
CVE ID: CVE-2018-3838 State: PUBLISHED Published: 2018-04-10T21:00:00Z Last Updated: 2024-09-16T18:44:14.602Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Cisco Systems, Inc. Products: Simple DirectMedia Problem Types: Heap Based-Overflow Description: An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian
image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4177 - https://www.debian.org/security/2018/dsa-4184 - https://security.gentoo.org/glsa/201903-17 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0520