Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-11053 State: PUBLISHED Published: 2018-06-26T22:00:00Z Last Updated: 2024-09-16T17:03:39.073Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H) Vendors: Dell EMC Products: iDRAC Service Module Problem Types: Improper File Permission Vulnerability Description: Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privileged operating system user or process could modify the host file and potentially redirect traffic from the intended destination to sites hos
m user or process could modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104567 - http://www.dell.com/support/article/us/en/19/sln310281/ism-dell-emc-idrac-service-module-improper-file-permission-vulnerability?lang=en
CVE ID: CVE-2018-11054 State: PUBLISHED Published: 2018-08-31T18:00:00 Last Updated: 2024-08-05T07:54:36.640Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RSA Products: BSAFE Micro Edition Suite Problem Types: integer overflow vulnerability Description: RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/46 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul
ure/2018/Aug/46 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2018-11055 State: PUBLISHED Published: 2018-08-31T18:00:00 Last Updated: 2024-08-05T07:54:36.580Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: RSA Products: BSAFE Micro Edition Suite Problem Types: Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability Description: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized
zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/46 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2018-11056 State: PUBLISHED Published: 2018-08-31T18:00:00 Last Updated: 2024-08-05T07:54:36.548Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: RSA Products: BSAFE Micro Edition Suite, BSAFE Crypto-C Micro Edition Problem Types: Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability Description: RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would exhaust the stack, pot
hen parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would exhaust the stack, potentially causing a Denial Of Service. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/46 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2018-11057 State: PUBLISHED Published: 2018-08-31T18:00:00 Last Updated: 2024-08-05T07:54:36.548Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: RSA Products: BSAFE Micro Edition Suite Problem Types: Covert Timing Channel vulnerability Description: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/46 - https://www.
onal Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/46 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2018-11058 State: PUBLISHED Published: 2018-09-14T20:00:00 Last Updated: 2024-08-05T07:54:36.479Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RSA Products: BSAFE Micro Edition Suite, BSAFE Crypto-C Micro Edition Problem Types: Buffer Over-Read vulnerability Description: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would result in such issue. Additional Analyst Notes: - CVE Program Contain
use maliciously constructed ASN.1 data that would result in such issue. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Aug/46 - http://www.securityfocus.com/bid/108106 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2018-11059 State: PUBLISHED Published: 2018-07-24T19:00:00Z Last Updated: 2024-09-16T19:14:28.788Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: Dell EMC Products: RSA Archer Problem Types: Stored Cross-Site Scripting Vulnerability Description: RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context o
ss the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104892 - http://www.securitytracker.com/id/1041359 - http://seclists.org/fulldisclosure/2018/Jul/69
CVE ID: CVE-2018-11060 State: PUBLISHED Published: 2018-07-24T19:00:00Z Last Updated: 2024-09-16T16:58:13.454Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: RSA Archer Problem Types: REST API Authorization Bypass Vulnerability Description: RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user could potentially exploit this vulnerability to elevate their privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104892 - http://www.securitytracker.com/id/1041359 - http://seclists.org/fulldisclosure/
ttp://www.securityfocus.com/bid/104892 - http://www.securitytracker.com/id/1041359 - http://seclists.org/fulldisclosure/2018/Jul/69
CVE ID: CVE-2018-11061 State: PUBLISHED Published: 2018-08-24T15:00:00Z Last Updated: 2024-09-17T01:06:59.417Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell EMC Products: RSA NetWitness, RSA Security Analytics Problem Types: server-side template injection vulnerability Description: RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execu
henticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execute arbitrary commands on the server with root privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041542 - http://seclists.org/fulldisclosure/2018/Aug/32 - http://www.securityfocus.com/bid/105134 - http://www.securitytracker.com/id/1041541
CVE ID: CVE-2018-11062 State: PUBLISHED Published: 2018-11-02T22:00:00Z Last Updated: 2024-09-16T18:04:27.800Z Vendors: Dell EMC Products: Integrated Data Protection Appliance Problem Types: Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability Description: Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default passwords may potentially log in to the system and gain read and write access to certain system files. Additional Ana
lt passwords may potentially log in to the system and gain read and write access to certain system files. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Oct/53 - http://www.securityfocus.com/bid/105764
CVE ID: CVE-2018-11063 State: PUBLISHED Published: 2018-08-10T20:00:00Z Last Updated: 2024-09-16T19:57:24.083Z Vendors: Dell Products: Wyse Management Suite Problem Types: Unquoted Service Path Vulnerabilities Description: Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affected software installs multiple services incorrectly by specifying the paths to the service executables without quotes. This could potentially allow a low-privileged local user to execute arbitrary executables with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/19/sln313398/dell-wyse-management
tes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/19/sln313398/dell-wyse-management-suite-multiple-unquoted-service-path-vulnerabilities?lang=en
CVE ID: CVE-2018-11064 State: PUBLISHED Published: 2018-10-05T21:00:00Z Last Updated: 2024-09-16T22:55:44.290Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: Dell EMC Unity, Dell EMC UnityVSA Problem Types: Incorrect File Permissions Description: Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability to alter multiple library files in service tools that might result in arbitrary code execution with elevated privileges. No user file systems are directly affected by this
at might result in arbitrary code execution with elevated privileges. No user file systems are directly affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Sep/55 - http://www.securityfocus.com/bid/105447
CVE ID: CVE-2018-11065 State: PUBLISHED Published: 2018-08-24T15:00:00Z Last Updated: 2024-09-16T17:32:44.141Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell EMC Products: RSA Archer Problem Types: SQL injection vulnerability Description: The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injection vulnerability. A malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to read certain data. Embedded WorkPoint is upgraded to version 4.10.16, which contains a fix for the vulnerability. Additional Analyst N
ata. Embedded WorkPoint is upgraded to version 4.10.16, which contains a fix for the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041540 - http://seclists.org/fulldisclosure/2018/Aug/31 - http://www.securityfocus.com/bid/105128
CVE ID: CVE-2018-11066 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-17T03:43:20.412Z Vendors: Dell EMC Products: Avamar, Integrated Data Protection Appliance Problem Types: Remote Code Execution Vulnerability Description: Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain a Remote Code Execution vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary commands on the server. Additional Analyst Notes: - CVE Program Container: References: - http:/
ity to execute arbitrary commands on the server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105968 - https://seclists.org/fulldisclosure/2018/Nov/49 - https://www.vmware.com/security/advisories/VMSA-2018-0029.html - http://www.securitytracker.com/id/1042153
CVE ID: CVE-2018-11067 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-17T00:11:44.344Z Vendors: Dell EMC Products: Avamar, Integrated Data Protection Appliance Problem Types: Open Redirection Vulnerability Description: Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The v
direct application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Nov/49 - https://www.vmware.com/security/advisories/VMSA-2018-0029.html - http://www.securityfocus.com/bid/105969 - http://www.securitytracker.com/id/1042153
CVE ID: CVE-2018-11068 State: PUBLISHED Published: 2018-09-11T19:00:00Z Last Updated: 2024-09-16T23:30:36.808Z Severity: LOW (CVSS 3.9 CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell EMC Products: RSA BSAFE SSL-J Problem Types: Improper Clearing of Heap Memory Before Release ('Heap Inspection') Vulnerability Description: RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physical access to the system to recover sensitive key material. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041614 - https://seclists.org/fulldisclosure/2018/Sep/7
CVE ID: CVE-2018-11069 State: PUBLISHED Published: 2018-09-11T19:00:00Z Last Updated: 2024-09-16T19:35:24.862Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell EMC Products: RSA BSAFE SSL-J Problem Types: Covert Timing Channel Vulnerability Description: RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041614 - https://seclists.org/fulldisclosure/2018/Sep/7
CVE ID: CVE-2018-11070 State: PUBLISHED Published: 2018-09-11T19:00:00Z Last Updated: 2024-09-16T19:36:17.519Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell EMC Products: RSA BSAFE Crypto-J, RSA BSAFE SSL-J Problem Types: Covert Timing Channel Vulnerability Description: RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS #1 unpadding operations, also known as a Bleichenbacher attack. A remote attacker may be able to recover a RSA key. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041615 - http://www.securit
nal Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041615 - http://www.securitytracker.com/id/1041614 - https://seclists.org/fulldisclosure/2018/Sep/7
CVE ID: CVE-2018-11071 State: PUBLISHED Published: 2018-09-18T21:00:00 Last Updated: 2024-08-05T07:54:36.649Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell EMC Products: Isilon OneFS, IsilonSD Edge Problem Types: remote process crash vulnerability Description: Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 contain a remote process crash vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to crash the isi_drive_d process by sending specially crafted input data to the affected
lly exploit this vulnerability to crash the isi_drive_d process by sending specially crafted input data to the affected system. This process will then be restarted. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Sep/19
CVE ID: CVE-2018-11072 State: PUBLISHED Published: 2018-10-02T13:00:00Z Last Updated: 2024-09-16T19:57:00.694Z Vendors: Dell EMC Products: Dell Digital Delivery Problem Types: DLL Injection Vulnerability Description: Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection Vulnerability. A local authenticated malicious user with advance knowledge of the application workflow could potentially load and execute a malicious DLL with administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln313559/dell-digital-delivery-dll-injection-vulnerability?lang=en
CVE ID: CVE-2018-11073 State: PUBLISHED Published: 2018-09-28T18:00:00Z Last Updated: 2024-09-17T01:20:47.843Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: RSA Products: Authentication Manager Problem Types: stored cross-site scripting vulnerability Description: RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed i
hen other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Sep/39 - http://www.securitytracker.com/id/1041697 - http://www.securityfocus.com/bid/105410
CVE ID: CVE-2018-11074 State: PUBLISHED Published: 2018-09-28T18:00:00Z Last Updated: 2024-09-16T23:36:47.316Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: RSA Products: Authentication Manager Problem Types: DOM-based cross-site scripting vulnerability Description: RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser
ion user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Sep/39 - http://www.securitytracker.com/id/1041697 - http://www.securityfocus.com/bid/105410
CVE ID: CVE-2018-11075 State: PUBLISHED Published: 2018-09-28T18:00:00Z Last Updated: 2024-09-17T00:30:53.695Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: RSA Products: Authentication Manager Problem Types: Reflected cross-site scripting vulnerability Description: RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application
by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application, which code is then executed by the victim's web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Sep/39 - http://www.securitytracker.com/id/1041697 - http://www.securityfocus.com/bid/105410
CVE ID: CVE-2018-11076 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-16T20:32:06.321Z Vendors: Dell EMC Products: Avamar, Integrated Data Protection Appliance Problem Types: Remote Code Execution Vulnerability Description: Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client package. The private key could potentially be used by an unauthenticated attacker on the same data-link layer to initiate a MITM attack on management consol
tially be used by an unauthenticated attacker on the same data-link layer to initiate a MITM attack on management console users. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Nov/50 - https://www.vmware.com/security/advisories/VMSA-2018-0029.html - http://www.securityfocus.com/bid/105972 - http://www.securitytracker.com/id/1042153