Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-17950 State: PUBLISHED Published: 2018-12-12T14:00:00 Last Updated: 2024-08-05T11:01:14.733Z Vendors: Micro Focus Products: NetIQ eDirectory 9.1 SP2 Problem Types: Improper Access Description: Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2 Additional Analyst Notes: - CVE Program Container: References: - https://www.netiq.com/documentation/edirectory-91/edirectory912_releasenotes/data/edirectory912_releasenotes.html
CVE ID: CVE-2018-17952 State: PUBLISHED Published: 2018-12-12T14:00:00 Last Updated: 2024-08-05T11:01:14.599Z Vendors: Micro Focus Products: NetIQ eDirectory 9.1 SP2 Problem Types: XSS Description: Cross site scripting vulnerability in eDirectory prior to 9.1 SP2 Additional Analyst Notes: - CVE Program Container: References: - https://www.netiq.com/documentation/edirectory-91/edirectory912_releasenotes/data/edirectory912_releasenotes.html
CVE ID: CVE-2018-17953 State: PUBLISHED Published: 2018-11-27T13:00:00Z Last Updated: 2024-09-16T17:28:34.555Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: SUSE Products: pam Problem Types: CWE-284 Description: A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1115640
CVE ID: CVE-2018-17954 State: PUBLISHED Published: 2020-04-03T07:05:13.265182Z Last Updated: 2024-09-16T20:02:21.821Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 Problem Types: CWE-269 Description: An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 c
t users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse
92022.cbd70e833-3.19.3, crowbar-. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1117080
CVE ID: CVE-2018-17955 State: PUBLISHED Published: 2019-03-15T20:00:00Z Last Updated: 2024-09-16T23:50:26.375Z Severity: LOW (CVSS 2.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SUSE Products: yast2-multipath Problem Types: CWE-377 Description: In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1117592
CVE ID: CVE-2018-17956 State: PUBLISHED Published: 2019-03-15T20:00:00Z Last Updated: 2024-09-17T02:01:08.906Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SUSE Products: yast2-samba-provision Problem Types: CWE-200 Description: In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provision, allowing local attackers to read them in the process list Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1117597
CVE ID: CVE-2018-17957 State: PUBLISHED Published: 2018-12-26T15:00:00Z Last Updated: 2024-09-16T20:27:58.944Z Severity: LOW (CVSS 3.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: SUSE Products: yast2-rmt Problem Types: CWE-214 Description: The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database. Additional Analyst Notes: - CVE Program Container: References: - https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00068.html - https://bugzilla.suse.com/show_bug.cgi?id=1117602
CVE ID: CVE-2018-17958 State: PUBLISHED Published: 2018-10-09T22:00:00 Last Updated: 2024-08-05T11:01:14.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/10/08/1 - https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03269.html - http://www.securityfocus.com/bid/105556 - https://lists.debian.org/debian-lts-announce/2019/01/msg00023.html - https://usn.ubuntu.com/3826-1/ - https://www.debian.org/security/2019/dsa-4454 - https://seclists.org/bugtraq/
23.html - https://usn.ubuntu.com/3826-1/ - https://www.debian.org/security/2019/dsa-4454 - https://seclists.org/bugtraq/2019/May/76 - https://access.redhat.com/errata/RHSA-2019:2425 - https://access.redhat.com/errata/RHSA-2019:2553
CVE ID: CVE-2018-17960 State: PUBLISHED Published: 2018-11-14T20:00:00 Last Updated: 2024-08-05T11:01:14.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. Additional Analyst Notes: - CVE Program Container: References: - https://ckeditor.com/blog/CKEditor-4.11-with-emoji-dropdown-and-auto-link-on-typing-released/ - https://ckeditor.com/cke4/release/CKEditor-4.11.0 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - http://www.securityfocus.com/bid/109205
CVE ID: CVE-2018-17961 State: PUBLISHED Published: 2018-10-15T16:00:00 Last Updated: 2024-08-05T11:01:14.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183. Additional Analyst Notes: - CVE Program Container: References: - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=a5a9bf8c6a63 - http://www.openwall.com/lists/oss-security/2018/10/09/4 - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=a6807394bd94 - https://bugs.ghostscript.com/show_bug.cgi?id
ttp://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=a6807394bd94 - https://bugs.ghostscript.com/show_bug.cgi?id=699816 - https://access.redhat.com/errata/RHSA-2018:3834 - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=a54c9e61e7d0 - https://usn.ubuntu.com/3803-1/ - https://www.debian.org/security/2018/dsa-4336 - https://lists.debian.org/debian-lts-announce/2018/10/msg00013.html - https://www.exploit-db.com/exploits/45573/ - https://bugs.chromium.org/p/project-zero/issues/detail?id=1682&desc=2
CVE ID: CVE-2018-17962 State: PUBLISHED Published: 2018-10-09T22:00:00 Last Updated: 2024-08-05T11:01:14.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/10/08/1 - https://www.debian.org/security/2018/dsa-4338 - https://usn.ubuntu.com/3826-1/ - https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03268.html - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https://access.redhat.com/errata/RHSA-2019:2892
CVE ID: CVE-2018-17963 State: PUBLISHED Published: 2018-10-09T22:00:00 Last Updated: 2024-08-05T11:01:14.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/10/08/1 - https://www.debian.org/security/2018/dsa-4338 - https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03267.html - https://usn.ubuntu.com/3826-1/ - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https
03267.html - https://usn.ubuntu.com/3826-1/ - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg06054.html - https://access.redhat.com/errata/RHSA-2019:2166 - https://access.redhat.com/errata/RHSA-2019:2425 - https://access.redhat.com/errata/RHSA-2019:2553
CVE ID: CVE-2018-17964 State: PUBLISHED Published: 2018-10-17T14:00:00 Last Updated: 2024-08-05T11:01:14.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aryanic HighPortal 12.5 has XSS via an Add Tags action. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/149823/HighPortal-12.5-Cross-Site-Scripting.html
CVE ID: CVE-2018-17965 State: PUBLISHED Published: 2018-10-03T18:00:00 Last Updated: 2024-08-05T11:01:14.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-28 has a memory leak vulnerability in WriteSGIImage in coders/sgi.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1052 - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-17966 State: PUBLISHED Published: 2018-10-03T18:00:00 Last Updated: 2024-08-05T11:01:14.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1050 - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-17967 State: PUBLISHED Published: 2018-10-03T18:00:00Z Last Updated: 2024-09-16T20:57:26.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1051
CVE ID: CVE-2018-17968 State: PUBLISHED Published: 2018-10-23T21:00:00 Last Updated: 2024-08-05T11:01:14.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: A gambling smart contract implementation for RuletkaIo, an Ethereum gambling game, generates a random value that is predictable by an external contract call. The developer wrote a random() function that uses a block timestamp and block hash from the Ethereum blockchain. This can be predicted by writing the same random function code in an exploit contract to determine the deadSeat value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17968
CVE ID: CVE-2018-17969 State: PUBLISHED Published: 2018-10-03T19:00:00Z Last Updated: 2024-09-17T01:31:06.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung SCX-6545X V2.00.03.01 03-23-2012 devices allows remote attackers to discover cleartext credentials via iso.3.6.1.4.1.236.11.5.11.81.10.1.5.0 and iso.3.6.1.4.1.236.11.5.11.81.10.1.6.0 SNMP requests. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.com/2018/10/samsung-printer-passwordleak.html
CVE ID: CVE-2018-17972 State: PUBLISHED Published: 2018-10-03T22:00:00 Last Updated: 2024-08-05T11:01:14.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3821-1/ - https://usn.ubuntu.com/3835-1/ - https://access.redhat.com/errata/RHSA-2019:0512 - https://usn.ubuntu.com/3880-1/ - https://usn.ubuntu.com/3871
3835-1/ - https://access.redhat.com/errata/RHSA-2019:0512 - https://usn.ubuntu.com/3880-1/ - https://usn.ubuntu.com/3871-5/ - https://usn.ubuntu.com/3871-4/ - http://www.securityfocus.com/bid/105525 - https://usn.ubuntu.com/3880-2/ - https://usn.ubuntu.com/3832-1/ - https://usn.ubuntu.com/3821-2/ - https://marc.info/?l=linux-fsdevel&m=153806242024956&w=2 - https://usn.ubuntu.com/3871-1/ - https://access.redhat.com/errata/RHSA-2019:0514 - https://usn.ubuntu.com/3871-3/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html - https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html - https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html - https://access.red
announce/2019/03/msg00034.html - https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html - https://access.redhat.com/errata/RHSA-2019:0831 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html - https://access.redhat.com/errata/RHSA-2019:2473 - https://support.f5.com/csp/article/K27673650?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2018-17974 State: PUBLISHED Published: 2018-10-03T22:00:00 Last Updated: 2024-08-05T11:01:14.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tcpreplay 4.3.0 beta1. A heap-based buffer over-read was triggered in the function dlt_en10mb_encode() of the file plugins/dlt_en10mb/en10mb.c, due to inappropriate values in the function memmove(). The length (pktlen + ctx -> l2len) can be larger than source value (packet + ctx->l2len) because the function fails to ensure the length of a packet is valid. This leads to Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/486
rvice. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/486 - https://github.com/SegfaultMasters/covering360/tree/master/tcpreplay
CVE ID: CVE-2018-17975 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:01:14.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/50744 - https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/
CVE ID: CVE-2018-17976 State: PUBLISHED Published: 2018-12-04T23:00:00 Last Updated: 2024-08-05T11:01:14.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic change descriptions. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/51581 - https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/
CVE ID: CVE-2018-17977 State: PUBLISHED Published: 2018-10-08T17:00:00 Last Updated: 2024-08-05T11:01:14.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which allows local users to cause a denial of service (memory consumption and system hang) by leveraging root access to execute crafted applications, as demonstrated on CentOS 7. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105539 - https://www.openwall.com/lists/oss-security/2018/10/05/5
CVE ID: CVE-2018-17980 State: PUBLISHED Published: 2018-10-15T19:00:00 Last Updated: 2024-08-05T11:01:14.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file, as demonstrated by a scenario where the .nxs file and the DLL are in the current working directory, and the Trojan horse code is executed. (The directory could, in general, be on a local filesystem or a network share.). Additional Analyst Notes: - CVE Program Container: References: - https://www.nomachine.com/TR10P08887 - https://www.exploit-db.com/exploits/45611/
CVE Program Container: References: - https://www.nomachine.com/TR10P08887 - https://www.exploit-db.com/exploits/45611/ - http://packetstormsecurity.com/files/149784/NoMachine-5.3.26-Remote-Code-Execution.html - http://hyp3rlinx.altervista.org/advisories/NOMACHINE-TROJAN-FILE-REMOTE-CODE-EXECUTION.txt
CVE ID: CVE-2018-17981 State: PUBLISHED Published: 2020-01-22T00:04:01 Last Updated: 2024-08-05T11:01:14.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter. Additional Analyst Notes: - CVE Program Container: References: - https://sku11army.blogspot.com/2020/01/lifesize-devices-allow-xss-via.html
CVE ID: CVE-2018-17983 State: PUBLISHED Published: 2018-10-04T23:00:00 Last Updated: 2024-08-05T11:01:14.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercurial-scm.org/repo/hg/rev/5405cb1a7901 - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.7.2_.282018-10-01.29
CVE ID: CVE-2018-17984 State: PUBLISHED Published: 2018-10-04T23:00:00 Last Updated: 2024-08-05T11:01:14.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access. Additional Analyst Notes: - CVE Program Container: References: - https://www.ispconfig.org/blog/ispconfig-3-1-13-released-important-security-bugfix/ - https://0x09al.github.io/security/ispconfig/exploit/vulnerability/2018/08/20/bug-or-backdoor-ispconfig-rce.html - https://github.com/0x09AL/0x09al.github.io/bl
nfig/exploit/vulnerability/2018/08/20/bug-or-backdoor-ispconfig-rce.html - https://github.com/0x09AL/0x09al.github.io/blob/master/_posts/2018-08-20-bug-or-backdoor-ispconfig-rce.markdown
CVE ID: CVE-2018-17985 State: PUBLISHED Published: 2018-10-04T23:00:00 Last Updated: 2024-08-05T11:01:14.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demangle_type function making recursive calls to itself in certain scenarios involving many 'P' characters. Additional Analyst Notes: - CVE Program Container: References: - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87335 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
se-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4326-1/ - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-17986 State: PUBLISHED Published: 2018-10-05T00:00:00Z Last Updated: 2024-09-16T18:56:16.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smiffy6969/razorCMS/issues/53
CVE ID: CVE-2018-17987 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T11:01:14.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUM_TILES equals the number of people who purchased a tile, which allows an attacker to control the awarding of the prize by being the last person to purchase a tile. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17987
CVE ID: CVE-2018-17988 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T11:01:14.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45530/ - https://github.com/AndyRixon/LayerBB/issues/51
CVE ID: CVE-2018-17989 State: PUBLISHED Published: 2019-04-01T20:48:16 Last Updated: 2024-08-05T11:01:14.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/New_GUI/Acl.asp" is requested. Additional Analyst Notes: - CVE Program Container: References: - https://c0mix.github.io/2019/D-Link-DIR-3782-SecAdvisory-OS-Command-Injection-and-Stored-XSS/
CVE ID: CVE-2018-17990 State: PUBLISHED Published: 2019-04-01T20:53:07 Last Updated: 2024-08-05T11:01:14.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter. Additional Analyst Notes: - CVE Program Container: References: - https://c0mix.github.io/2019/D-Link-DIR-3782-SecAdvisory-OS-Command-Injection-and-Stored-XSS/
CVE ID: CVE-2018-17996 State: PUBLISHED Published: 2019-03-17T18:56:56 Last Updated: 2024-08-05T11:01:14.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151694/LayerBB-1.1.2-Cross-Site-Request-Forgery.html - https://www.exploit-db.com/exploits/46379/ - https://github.com/AndyRixon/LayerBB/issues/38 - https://github.com/AndyRixon/LayerBB/commits/master
CVE ID: CVE-2018-17997 State: PUBLISHED Published: 2019-03-17T19:02:22 Last Updated: 2024-08-05T11:01:14.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: LayerBB 1.1.1 allows XSS via the titles of conversations (PMs). Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151015/LayerBB-1.1.1-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/46079/ - https://github.com/AndyRixon/LayerBB/commits/master
CVE ID: CVE-2018-18004 State: PUBLISHED Published: 2019-01-03T20:00:00 Last Updated: 2024-08-05T11:01:14.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vivotek-ip-camera-vulnerabilities-discovered-and-exploited-2e2531ecd244 - http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-006-v1.pdf