Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-17497 State: PUBLISHED Published: 2019-03-19T19:47:41.609309Z Last Updated: 2024-09-16T17:47:55.765Z Severity: HIGH (CVSS 8.4 CVSS:3.0/I:H/AV:L/A:H/PR:N/UI:N/S:U/C:H/AC:L/E:U/RL:O/RC:C) Vendors: VisitorPass Products: eVisitorPass Problem Types: Gain Access Description: eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/149657
CVE ID: CVE-2018-17499 State: PUBLISHED Published: 2019-03-19T19:47:41.650066Z Last Updated: 2024-09-16T16:18:57.425Z Severity: LOW (CVSS 2.9 CVSS:3.0/AC:H/C:L/I:N/PR:N/A:N/AV:L/S:U/UI:N/RC:C/E:U/RL:O) Vendors: Envoy Products: Envoy Passport for iPhone, Envoy Passport for Android Problem Types: Obtain Information Description: Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibm
ther sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/149659
CVE ID: CVE-2018-17500 State: PUBLISHED Published: 2019-03-19T19:47:41.688775Z Last Updated: 2024-09-16T22:15:54.339Z Severity: LOW (CVSS 2.9 CVSS:3.0/C:L/AC:H/I:N/AV:L/A:N/PR:N/UI:N/S:U/RL:O/E:U/RC:C) Vendors: Envoy Products: Envoy Passport for iPhone, Envoy Passport for Android Problem Types: Obtain Information Description: Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilit
tion. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/149660
CVE ID: CVE-2018-17502 State: PUBLISHED Published: 2019-03-19T19:47:41.729466Z Last Updated: 2024-09-16T23:01:30.023Z Severity: MEDIUM (CVSS 4 CVSS:3.0/PR:N/A:N/AV:L/I:N/S:U/UI:N/AC:L/C:L/E:U/RL:O/RC:C) Vendors: Los Trigos, Inc Products: The Receptionist for iPad Problem Types: Obtain Information Description: The Receptionist for iPad could allow a local attacker to obtain sensitive information, caused by an error in the contact.json file. An attacker could exploit this vulnerability to obtain the contact names, phone numbers and emails. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/149662
CVE ID: CVE-2018-17532 State: PUBLISHED Published: 2018-10-15T19:00:00 Last Updated: 2024-08-05T10:47:05.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Oct/27 - http://packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.html - https://github.co
tp://packetstormsecurity.com/files/149777/Teltonika-RUT9XX-Unauthenticated-OS-Command-Injection.html - https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-01_Teltonika_OS_Command_Injection
CVE ID: CVE-2018-17533 State: PUBLISHED Published: 2018-10-15T19:00:00 Last Updated: 2024-08-05T10:47:04.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180410-01_Teltonika_Cross_Site_Scripting - http://seclists.org/fulldisclosure/2018/Oct/29 - http://packetstormsecurity.com/files/149781/Teltonika-RUT9XX-Reflected-Cross-Site-Scripting.html
CVE ID: CVE-2018-17534 State: PUBLISHED Published: 2018-10-15T19:00:00 Last Updated: 2024-08-05T10:47:04.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Oct/28 - http://packetstormsecurity.com/files/149779/Teltonika-RUT9XX-Missing-Access-Control-To-UART-Root-Terminal.html - https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-
Access-Control-To-UART-Root-Terminal.html - https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-02_Teltonika_Incorrect_Access_Control
CVE ID: CVE-2018-17536 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T20:16:24.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE ID: CVE-2018-17537 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T16:28:21.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists. . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/
CVE ID: CVE-2018-17538 State: PUBLISHED Published: 2018-09-26T08:00:00 Last Updated: 2024-08-05T10:54:09.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: Axon (formerly TASER International) Evidence Sync 3.15.89 is vulnerable to process injection. NOTE: the vendor's position is that this CVE is not associated with information that supports any finding of any type of vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GitHubAssessments/CVE_Assessment_05_2018/blob/master/Evidence_Sync_Report.pdf - https://raw.githubusercontent.com/GitHubAssessments/CVE_Assessment_05_2018/master/Evidence_Sync_Report.pdf - https://github.com/GitHubAsse
usercontent.com/GitHubAssessments/CVE_Assessment_05_2018/master/Evidence_Sync_Report.pdf - https://github.com/GitHubAssessments/CVE_Assessment_05_2018/blob/master/Evidence_Review_Report.pdf
CVE ID: CVE-2018-17539 State: PUBLISHED Published: 2018-12-28T15:00:00 Last Updated: 2024-08-05T10:54:09.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BGP daemon (bgpd) in all IP Infusion ZebOS versions to 7.10.6 and all OcNOS versions to 1.3.3.145 allow remote attackers to cause a denial of service attack via an autonomous system (AS) path containing 8 or more autonomous system number (ASN) elements. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K17264695 - http://www.securityfocus.com/bid/106367
CVE ID: CVE-2018-17540 State: PUBLISHED Published: 2018-10-03T20:00:00 Last Updated: 2024-08-05T10:54:09.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4309 - https://lists.debian.org/debian-lts-announce/2018/10/msg00001.html - https://www.strongswan.org/blog/2018/10/01/strongswan-vulnerability-%28cve-2018-17540%29.html - https://usn.ubuntu.com/3774-1/ - https://download.strongswan.org/security/CVE-2018-17540/ - https://security.gentoo.org/glsa/201811-16 - http://lists.opensuse.org
ownload.strongswan.org/security/CVE-2018-17540/ - https://security.gentoo.org/glsa/201811-16 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html
CVE ID: CVE-2018-17542 State: PUBLISHED Published: 2019-02-11T20:00:00Z Last Updated: 2024-09-16T18:54:20.899Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: OAKlouds Products: MailSherlock Problem Types: SQL Injection Description: SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request. Additional Analyst Notes: - CVE Program Container: References: - https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?id=73 - https://twcert.org.tw/subpages/ServeThePublic/public_documen
ubpages/ServeThePublic/public_document_details.aspx?id=73 - https://twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=28
CVE ID: CVE-2018-17552 State: PUBLISHED Published: 2018-10-03T20:00:00 Last Updated: 2024-08-05T10:54:09.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45561/ - https://github.com/rapid7/metasploit-framework/pull/10704 - https://github.com/NavigateCMS/Navigate-CMS/commit/6df73ccca64253a5e81c23356943fae50ffc836f
CVE ID: CVE-2018-17553 State: PUBLISHED Published: 2018-10-03T20:00:00 Last Updated: 2024-08-05T10:54:09.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NavigateCMS/Navigate-CMS/commit/2bdcb8b3c5bb23851a2115db96585f1ac8cb2d1e - https://www.exploit-db.com/exploits/45561/ - https://github.com/rapid7/metasploit-framework/pull/10
db96585f1ac8cb2d1e - https://www.exploit-db.com/exploits/45561/ - https://github.com/rapid7/metasploit-framework/pull/10704
CVE ID: CVE-2018-17555 State: PUBLISHED Published: 2018-09-26T20:00:00Z Last Updated: 2024-09-16T17:57:51.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids parameter. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.com/2018/09/arris-tg2492lg-na-cable-modem-gateway.html
CVE ID: CVE-2018-17556 State: PUBLISHED Published: 2018-09-26T20:00:00Z Last Updated: 2024-09-17T00:56:55.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/modxcms/revolution/issues/14094
CVE ID: CVE-2018-17557 State: REJECTED Published: 2019-08-27T11:48:04 Last Updated: 2019-08-27T11:48:04 Description: No description available.
CVE ID: CVE-2018-17558 State: PUBLISHED Published: 2023-10-26T00:00:00 Last Updated: 2024-09-11T19:29:40.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.maride.cc/posts/abus/ - https://www.ccc.de/en/updates/2019/update-nicht-verfug
P Vulnrichment: References: - https://sec.maride.cc/posts/abus/ - https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen
CVE ID: CVE-2018-17559 State: PUBLISHED Published: 2023-10-26T00:00:00 Last Updated: 2024-09-11T14:27:23.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen - https://sec.maride.cc/posts/abus/#cve-2018-17559
CVE ID: CVE-2018-17560 State: PUBLISHED Published: 2019-06-28T17:46:02 Last Updated: 2024-08-05T10:54:10.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-2018-11-13-15-00-42 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://research.hisolutions.com/2019/06/web-vulnerabilities-are-coming-to-the-desktop-template-injections-lead-to-rce-in-teamwire/
CVE ID: CVE-2018-17562 State: PUBLISHED Published: 2018-10-03T20:00:00 Last Updated: 2024-08-05T10:54:09.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/call_details?oid= URI, allowing an attacker to extract the underlying database schema to further disclose other fax server information through different injection points. Additional Analyst Notes: - CVE Program Container: References: - https://securityshards.wordpress.com/2018/10/02/cve-2018-17562-faxfinder-5-0-5-8-sqlite-inejection-vulnerability/
CVE ID: CVE-2018-17563 State: PUBLISHED Published: 2019-04-01T20:49:10 Last Updated: 2024-08-05T10:54:10.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext. Additional Analyst Notes: - CVE Program Container: References: - http://grandstream.com/support/firmware - https://iridiumxor.wordpress.com/2019/01/03/three-simple-cves-for-a-good-voip-phone/
CVE ID: CVE-2018-17564 State: PUBLISHED Published: 2019-04-01T20:50:11 Last Updated: 2024-08-05T10:54:09.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device. Additional Analyst Notes: - CVE Program Container: References: - http://grandstream.com/support/firmware - https://iridiumxor.wordpress.com/2019/01/03/three-simple-cves-for-a-good-voip-phone/
CVE ID: CVE-2018-17565 State: PUBLISHED Published: 2019-04-01T20:51:32 Last Updated: 2024-08-05T10:54:09.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell. Additional Analyst Notes: - CVE Program Container: References: - http://grandstream.com/support/firmware - https://iridiumxor.wordpress.com/2019/01/03/three-simple-cves-for-a-good-voip-phone/
CVE ID: CVE-2018-17566 State: PUBLISHED Published: 2018-09-26T21:00:00 Last Updated: 2024-08-05T10:54:10.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/top-think/think/issues/858
CVE ID: CVE-2018-17567 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:54:10.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jekyll/jekyll/pull/7224 - https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/ - https://lists.apache.org/thread.html/71da391f584b2fb301d2df0e491b279d87287e2fb4b11309f04ad984%40%3Ccommits.accumulo.apache.org%3E
CVE ID: CVE-2018-17568 State: PUBLISHED Published: 2018-09-26T22:00:00Z Last Updated: 2024-09-16T19:46:12.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/viabtc/viabtc_exchange_server/pull/131 - https://github.com/viabtc/viabtc_exchange_server/commit/4a7c27bfe98f409623d4d857894d017ff0672cc9#diff-0c23effa84a7b85053bac7981a8580c8
CVE ID: CVE-2018-17569 State: PUBLISHED Published: 2018-09-26T22:00:00Z Last Updated: 2024-09-17T04:28:59.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/viabtc/viabtc_exchange_server/pull/131 - https://github.com/viabtc/viabtc_exchange_server/commit/4a7c27bfe98f409623d4d857894d017ff0672cc9#diff-9fabc53ea796ec492aef432594298baa
CVE ID: CVE-2018-17570 State: PUBLISHED Published: 2018-09-26T22:00:00Z Last Updated: 2024-09-16T17:54:37.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/viabtc/viabtc_exchange_server/pull/131 - https://github.com/viabtc/viabtc_exchange_server/commit/4a7c27bfe98f409623d4d857894d017ff0672cc9#diff-515c81af848352583bff286d6224875f
CVE ID: CVE-2018-17571 State: PUBLISHED Published: 2018-09-28T05:00:00 Last Updated: 2024-08-05T10:54:10.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vanilla before 2.6.1 allows XSS via the email field of a profile. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/361957
CVE ID: CVE-2018-17572 State: PUBLISHED Published: 2020-03-02T19:31:54 Last Updated: 2024-08-05T10:54:10.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: InfluxDB 0.9.5 has Reflected XSS in the Write Data module. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Raghavrao29/1cb84f1f2d8ce993fd7b2d1366d35f48 - https://github.com/influxdata/influxdb/releases/tag/v0.9.6
CVE ID: CVE-2018-17573 State: PUBLISHED Published: 2018-09-28T05:00:00 Last Updated: 2024-08-05T10:54:10.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and fckeditor/editor/filemanager/connectors/uploadtest.html. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/149568/WordPress-WP-Insert-2.4.2-Arbitrary-File-Upload.html - https://cxsecurity.com/issue/WLB-2018090255
CVE ID: CVE-2018-17574 State: PUBLISHED Published: 2018-09-28T09:00:00 Last Updated: 2024-08-05T10:54:10.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/YMFE/yapi/issues/520
CVE ID: CVE-2018-17575 State: PUBLISHED Published: 2018-09-28T09:00:00 Last Updated: 2024-08-05T10:54:10.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWA SWA.JACAD 3.1.37 Build 024 has SQL Injection via the /academico/aluno/esqueci-minha-senha/ studentId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://lab.insightsecurity.com.br/swa-sistemas-academicos-cve/
CVE ID: CVE-2018-17580 State: PUBLISHED Published: 2018-09-28T09:00:00 Last Updated: 2024-08-05T10:54:10.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer over-read exists in the function fast_edit_packet() in the file send_packets.c of Tcpreplay v4.3.0 beta1. This can lead to Denial of Service (DoS) and potentially Information Exposure when the application attempts to process a crafted pcap file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay - https://github.com/appneta/tcpreplay/issues/485
CVE ID: CVE-2018-17581 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:54:09.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/460 - https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html - https://usn.ubuntu.com/3852-1/ - https://github.com/SegfaultMasters/covering360/blob/master/Exiv2 - https://access.redhat.com/errata/RHSA-2019:2101 - https://lists.debian.org/debian-lts-announce/20
60/blob/master/Exiv2 - https://access.redhat.com/errata/RHSA-2019:2101 - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE ID: CVE-2018-17582 State: PUBLISHED Published: 2018-09-28T09:00:00 Last Updated: 2024-08-05T10:54:10.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tcpreplay v4.3.0 beta1 contains a heap-based buffer over-read. The get_next_packet() function in the send_packets.c file uses the memcpy() function unsafely to copy sequences from the source buffer pktdata to the destination (*prev_packet)->pktdata. This will result in a Denial of Service (DoS) and potentially Information Exposure when the application attempts to process a file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/484 - https://github.com/SegfaultMasters
VE Program Container: References: - https://github.com/appneta/tcpreplay/issues/484 - https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay
CVE ID: CVE-2018-17583 State: PUBLISHED Published: 2019-04-15T19:38:22 Last Updated: 2024-08-05T10:54:10.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/17JSC97ecikWalB_ZTScNipFoud2aFXb5mXEZ7g-KIQI/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/csrf-multiple-stored-xss-in-wp-fastest.html - https://wpvulndb.com/vulnerabilities/9696