Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-12010 State: PUBLISHED Published: 2019-02-11T15:00:00 Last Updated: 2024-08-05T08:24:03.541Z Vendors: Qualcomm, Inc. Products: Android for MSM, Firefox OS for MSM, QRD Android Problem Types: Stack-based Overflow in Core Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Absence of length sanity check may lead to possible stack overflow resulting in memory corruption in trustzone region. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/security-bulletin/2019/01/07/january-2019-code-aurora-security-bulletin
CVE ID: CVE-2018-12011 State: PUBLISHED Published: 2019-02-11T15:00:00 Last Updated: 2024-08-05T08:24:03.743Z Vendors: Qualcomm, Inc. Products: Android for MSM, Firefox OS for MSM, QRD Android Problem Types: Information Exposure in Core Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Uninitialized data for socket address leads to information exposure. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/security-bulletin/2019/01/07/january-2019-code-aurora-security-bulletin
CVE ID: CVE-2018-12012 State: PUBLISHED Published: 2019-05-24T16:44:16 Last Updated: 2024-08-05T08:24:03.622Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Problem Types: Untrusted Pointer Dereference Issue in QTEE Description: While updating blacklisting region shared buffered memory region is not validated against newly updated black list, causing boot-up to be compromised in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial
Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SXR1130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12012
CVE ID: CVE-2018-12013 State: PUBLISHED Published: 2019-05-24T16:44:16 Last Updated: 2024-08-05T08:24:03.731Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Problem Types: Untrusted Pointer Dereference Issue in QTEE Description: Improper authentication in locked memory region can lead to unprivilged access to the memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdra
s Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12013
CVE ID: CVE-2018-12014 State: PUBLISHED Published: 2019-02-11T15:00:00 Last Updated: 2024-08-05T08:24:03.704Z Vendors: Qualcomm, Inc. Products: Android for MSM, Firefox OS for MSM, QRD Android Problem Types: Use After Free in HLOS Data Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Null pointer dereference vulnerability may occur due to missing NULL assignment in NAT module of freed pointer. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/security-bulletin/2019/01/07/january-2019-code-aurora-security-bulletin - http://www.securityfocus.com/bid/106496
CVE ID: CVE-2018-12015 State: PUBLISHED Published: 2018-06-07T13:00:00 Last Updated: 2024-08-05T08:24:03.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104423 - http://www.securitytracker.com/id/1041048 - https://www.debian.org/security/2018/dsa-4226 - https://usn.ubuntu.com/3684-1/ - https://usn.ubuntu.com/3684-2/ - https://seclists.org/bugtraq/
security/2018/dsa-4226 - https://usn.ubuntu.com/3684-1/ - https://usn.ubuntu.com/3684-2/ - https://seclists.org/bugtraq/2019/Mar/42 - http://seclists.org/fulldisclosure/2019/Mar/49 - https://access.redhat.com/errata/RHSA-2019:2097 - https://www.oracle.com/security-alerts/cpujul2020.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834 - https://security.netapp.com/advisory/ntap-20180927-0001/ - https://support.apple.com/kb/HT209600
CVE ID: CVE-2018-12016 State: PUBLISHED Published: 2018-06-07T14:00:00Z Last Updated: 2024-09-16T17:04:08.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ldpreload/Disclosure/blob/master/EpiphanyDoS.txt
CVE ID: CVE-2018-12018 State: PUBLISHED Published: 2018-07-05T02:00:00 Last Updated: 2024-08-05T08:24:03.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereu
of Death) issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/releases/tag/v1.8.11 - https://github.com/ethereum/go-ethereum/commit/a5237a27eaf81946a3edb4fafe13ed6359d119e4 - https://github.com/ethereum/go-ethereum/pull/16891 - https://peckshield.com/2018/06/27/EPoD/
CVE ID: CVE-2018-12019 State: PUBLISHED Published: 2018-06-13T23:00:00 Last Updated: 2024-08-05T08:24:03.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2018/06/13/10 - https://www.enigmail.net/index.php/en/download/changelog - http://www.openwall.com/lists/oss-security/2019/04/30/
3/10 - https://www.enigmail.net/index.php/en/download/changelog - http://www.openwall.com/lists/oss-security/2019/04/30/4 - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
CVE ID: CVE-2018-12020 State: PUBLISHED Published: 2018-06-08T21:00:00 Last Updated: 2024-08-05T08:24:03.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3675-2/ - https://access.redhat.co
ditional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3675-2/ - https://access.redhat.com/errata/RHSA-2018:2180 - https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html - http://openwall.com/lists/oss-security/2018/06/08/2 - https://www.debian.org/security/2018/dsa-4222 - https://access.redhat.com/errata/RHSA-2018:2181 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://www.debian.org/security/2018/dsa-4224 - http://www.securityfocus.com/bid/104450 - https://www.debian.org/security/2018/dsa-4223 - https://usn.ubuntu.com/3675-3/ - http://www.securitytracker.com/id/1041051 - htt
www.debian.org/security/2018/dsa-4223 - https://usn.ubuntu.com/3675-3/ - http://www.securitytracker.com/id/1041051 - https://usn.ubuntu.com/3675-1/ - https://dev.gnupg.org/T4012 - http://www.openwall.com/lists/oss-security/2019/04/30/4 - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://usn.ubuntu.com/3964-1/ - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf - https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html
CVE ID: CVE-2018-12021 State: PUBLISHED Published: 2018-07-05T18:00:00 Last Updated: 2024-08-05T08:24:03.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/singularityware/singularity/releases/tag/2.5.2 - http://www.openwall.com/lists/oss-security/2019/05/16/1
CVE ID: CVE-2018-12022 State: PUBLISHED Published: 2019-03-17T18:14:21 Last Updated: 2024-08-05T08:24:03.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0782 - https://access.redhat.com/errata
CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0782 - https://access.redhat.com/errata/RHSA-2019:0877 - https://access.redhat.com/errata/RHBA-2019:0959 - https://access.redhat.com/errata/RHSA-2019:1107 - https://access.redhat.com/errata/RHSA-2019:1108 - https://access.redhat.com/errata/RHSA-2019:1106 - https://access.redhat.com/errata/RHSA-2019:1140 - https://www.debian.org/security/2019/dsa-4452 - https://seclists.org/bugtraq/2019/May/68 - https://access.redhat.com/errata/RHSA-2019:1782 - https://access.redhat.com/errata/RHSA-2019:1797 - http://www.securityfocus.com/bid/107585 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/err
ttp://www.securityfocus.com/bid/107585 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - https://access.redhat.com/errata/RHSA-2019:2804 - https://access.redhat.com/errata/RHSA-2019:2858 - https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3002 - https://access.redhat.com/errata/RHSA-2019:3140 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd
pache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3892 - https://access.redhat.com/errata/RHSA-2019:4037 - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/secu
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/ - https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf - https://security.netapp.com/advisory/ntap-20190530-0003/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugzilla.redhat.com/show_bug.cgi?id=1671098 - https://github.com/FasterXML/jackson-databind/issues/2052 - https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e
github.com/FasterXML/jackson-databind/issues/2052 - https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a
CVE ID: CVE-2018-12023 State: PUBLISHED Published: 2019-03-17T17:57:52 Last Updated: 2024-08-05T08:24:03.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0782 - https://access.redhat.com/errata/RHSA-2019:0877 - https://access.redhat.c
ps://access.redhat.com/errata/RHSA-2019:0782 - https://access.redhat.com/errata/RHSA-2019:0877 - https://access.redhat.com/errata/RHBA-2019:0959 - https://access.redhat.com/errata/RHSA-2019:1107 - https://access.redhat.com/errata/RHSA-2019:1108 - https://access.redhat.com/errata/RHSA-2019:1106 - https://access.redhat.com/errata/RHSA-2019:1140 - https://www.debian.org/security/2019/dsa-4452 - https://seclists.org/bugtraq/2019/May/68 - https://access.redhat.com/errata/RHSA-2019:1782 - https://access.redhat.com/errata/RHSA-2019:1797 - https://access.redhat.com/errata/RHSA-2019:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - https://access.redhat.com/errata/RHSA-2019:2804 - https://acce
:1822 - https://access.redhat.com/errata/RHSA-2019:1823 - https://access.redhat.com/errata/RHSA-2019:2804 - https://access.redhat.com/errata/RHSA-2019:2858 - https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3002 - https://access.redhat.com/errata/RHSA-2019:3140 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists
he.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3892 - https://access.redhat.com/errata/RHSA-2019:4037 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.or
/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/ - https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf - http://www.securityfocus.com/bid/105659 - https://github.com/FasterXML/jackson-databind/issues/2058 - https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a - https://security.netapp.com/advisory/ntap-20190530-0003/ - https://www.orac
t/28badf7ef60ac3e7ef151cd8e8ec010b8479226a - https://security.netapp.com/advisory/ntap-20190530-0003/ - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2018-12025 State: PUBLISHED Published: 2018-06-11T10:00:00 Last Updated: 2024-08-05T08:24:03.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: The transferFrom function of a smart contract implementation for FuturXE (FXE), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equal to allowed value, the transfer session would stop execution by returning false. This makes no sense, because the transferFrom() function should require the transferring value to not exceed the allowed value in the first place. Sup
he transferFrom() function should require the transferring value to not exceed the allowed value in the first place. Suppose this function asks for the allowed value to be smaller than the input. Then, the attacker could easily ignore the allowance: after this condition, the `allowed[from][msg.sender] -= value;` would cause an underflow because the allowed part is smaller than the value. The attacker could transfer any amount of FuturXe tokens of any accounts to an appointed account (the `_to` address) because the allowed value is initialized to 0, and the attacker could bypass this restriction even without the victim's private key. Additional Analyst Notes: - CVE Program Container: Referenc
pass this restriction even without the victim's private key. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/secbit-media/bugged-smart-contract-f-e-how-could-someone-mess-up-with-boolean-d2251defd6ff
CVE ID: CVE-2018-12026 State: PUBLISHED Published: 2018-06-17T20:00:00 Last Updated: 2024-08-05T08:24:03.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.phusion.nl/passenger-5-3-2 - https://security.gentoo.org/glsa/201807-02
CVE ID: CVE-2018-12027 State: PUBLISHED Published: 2018-06-17T20:00:00 Last Updated: 2024-08-05T08:24:03.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said socket are writable by a normal user that is not the application's user, then that non-application user can swap that directory with something else, resulting in traffic being redirected to a non-application user's process through
p that directory with something else, resulting in traffic being redirected to a non-application user's process through an alternative Unix domain socket. Additional Analyst Notes: - CVE Program Container: References: - https://blog.phusion.nl/passenger-5-3-2 - https://security.gentoo.org/glsa/201807-02
CVE ID: CVE-2018-12028 State: PUBLISHED Published: 2018-06-17T20:00:00 Last Updated: 2024-08-05T08:24:03.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID. Additional Analyst Notes: - CVE Program Container: References: - https://blog.phusion.nl/passenger-5-3-2 - https://security.gentoo.org/glsa/20180
- CVE Program Container: References: - https://blog.phusion.nl/passenger-5-3-2 - https://security.gentoo.org/glsa/201807-02
CVE ID: CVE-2018-12029 State: PUBLISHED Published: 2018-06-17T20:00:00 Last Updated: 2024-08-05T08:24:03.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https
root's crontab file allows privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.phusion.nl/passenger-5-3-2 - https://security.gentoo.org/glsa/201807-02 - https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc - https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html
CVE ID: CVE-2018-12030 State: PUBLISHED Published: 2018-06-15T16:00:00 Last Updated: 2024-08-05T08:24:03.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chevereto Free before 1.0.13 has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://edricteo.com/chevereto-free-xss-vulnerability-in-version-1.0.12/ - https://github.com/Chevereto/Chevereto-Free/commit/159daeab6adfe828bd06e6e74f5b647bf9b1bb70
CVE ID: CVE-2018-12031 State: PUBLISHED Published: 2018-06-07T16:00:00Z Last Updated: 2024-09-16T20:52:06.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EmreOvunc/Eaton-Intelligent-Power-Manager-Local-File-Inclusion