Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-20753 State: PUBLISHED Published: 2019-02-05T05:00:00.000Z Last Updated: 2025-10-21T23:45:43.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88 - https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
CVE ID: CVE-2018-20755 State: PUBLISHED Published: 2019-02-06T17:00:00 Last Updated: 2024-08-05T12:12:28.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/modxcms/revolution/issues/14102
CVE ID: CVE-2018-20756 State: PUBLISHED Published: 2019-02-06T17:00:00 Last Updated: 2024-08-05T12:12:27.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/modxcms/revolution/issues/14105
CVE ID: CVE-2018-20757 State: PUBLISHED Published: 2019-02-06T17:00:00 Last Updated: 2024-08-05T12:12:29.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/modxcms/revolution/issues/14104
CVE ID: CVE-2018-20758 State: PUBLISHED Published: 2019-02-06T17:00:00 Last Updated: 2024-08-05T12:12:28.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/modxcms/revolution/issues/14103
CVE ID: CVE-2018-20760 State: PUBLISHED Published: 2019-02-06T23:00:00 Last Updated: 2024-08-05T12:12:28.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html - https://github.com/gpac/gpac/commit/4c1360818fc8948e9307059fba4dc47ba8ad255d - https://github.com/gpac/gpac/issues/1177 - https://usn.ubuntu.com/3926-1/
CVE ID: CVE-2018-20761 State: PUBLISHED Published: 2019-02-06T23:00:00 Last Updated: 2024-08-05T12:12:28.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c in libgpac_static.a. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/commit/35ab4475a7df9b2a4bcab235e379c0c3ec543658 - https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html - https://github.com/gpac/gpac/issues/1186 - https://usn.ubuntu.com/3926-1/
CVE ID: CVE-2018-20762 State: PUBLISHED Published: 2019-02-06T23:00:00 Last Updated: 2024-08-05T12:12:28.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/commit/35ab4475a7df9b2a4bcab235e379c0c3ec543658 - https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html - https://github.com/gpac/gpac/issues/1187 - https://usn.ubuntu.com/3926-1/
CVE ID: CVE-2018-20763 State: PUBLISHED Published: 2019-02-06T23:00:00 Last Updated: 2024-08-05T12:12:29.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html - https://github.com/gpac/gpac/commit/1c449a34fe0b50aaffb881bfb9d7c5ab0bb18cdd - https://github.com/gpac/gpac/issues/1188 - https://usn.ubuntu.com/3926-1/
CVE ID: CVE-2018-20764 State: PUBLISHED Published: 2019-02-08T17:00:00 Last Updated: 2024-08-05T12:12:27.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow exists in HelpSystems tcpcrypt on Linux, used for BoKS encrypted telnet through BoKS version 6.7.1. Since tcpcrypt is setuid, exploitation leads to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://community.helpsystems.com/knowledge-base/fox-technologies/hotfix/515/
CVE ID: CVE-2018-20767 State: PUBLISHED Published: 2019-02-10T17:00:00Z Last Updated: 2024-09-17T03:22:29.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is authenticated remote command execution. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2018/07/cert_Security_Mini_Bulletin_XRX18Y_for_ConnectKey_EC78xx_v1.0.pdf
CVE ID: CVE-2018-20768 State: PUBLISHED Published: 2019-02-10T17:00:00Z Last Updated: 2024-09-17T03:03:48.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2018/07/cert_Security_Mini_Bulletin_XRX18Y_for_ConnectKey_EC78xx_v1.0.pdf
CVE ID: CVE-2018-20769 State: PUBLISHED Published: 2019-02-10T17:00:00Z Last Updated: 2024-09-17T01:56:14.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is a Local File Inclusion vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2018/07/cert_Security_Mini_Bulletin_XRX18Y_for_ConnectKey_EC78xx_v1.0.pdf
CVE ID: CVE-2018-20770 State: PUBLISHED Published: 2019-02-10T17:00:00Z Last Updated: 2024-09-16T23:01:16.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is Blind SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2018/07/cert_Security_Mini_Bulletin_XRX18Y_for_ConnectKey_EC78xx_v1.0.pdf
CVE ID: CVE-2018-20771 State: PUBLISHED Published: 2019-02-10T17:00:00Z Last Updated: 2024-09-16T20:17:09.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is unauthenticated Remote Command Execution. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2018/07/cert_Security_Mini_Bulletin_XRX18Y_for_ConnectKey_EC78xx_v1.0.pdf
CVE ID: CVE-2018-20772 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:28.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/24
CVE ID: CVE-2018-20773 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:27.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/23
CVE ID: CVE-2018-20774 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:28.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/26
CVE ID: CVE-2018-20775 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:28.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/27
CVE ID: CVE-2018-20776 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:29.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 provides a directory listing for a /public request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/21
CVE ID: CVE-2018-20777 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:27.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/25
CVE ID: CVE-2018-20778 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:28.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/28
CVE ID: CVE-2018-20779 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:27.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Traq 3.7.1 allows SQL Injection via a tickets?search= URI. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/149894
CVE ID: CVE-2018-20780 State: PUBLISHED Published: 2019-02-11T02:00:00 Last Updated: 2024-08-05T12:12:27.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: Traq 3.7.1 allows admin/users/new CSRF to create an admin account (aka group_id=1). Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/149894
CVE ID: CVE-2018-20781 State: PUBLISHED Published: 2019-02-12T17:00:00 Last Updated: 2024-08-05T12:12:28.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3894-1/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://gitlab.gnome.org/GNOME/gnome-keyring/tags/3.27.2 - https://gitlab.gnome.org/GNOME/gnome-keyring/issues/3 - https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919 - h
gitlab.gnome.org/GNOME/gnome-keyring/issues/3 - https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919 - https://bugzilla.gnome.org/show_bug.cgi?id=781486 - https://github.com/huntergregal/mimipenguin/tree/d95f1e08ce79783794f38433bbf7de5abd9792da - https://github.com/huntergregal/mimipenguin
CVE ID: CVE-2018-20782 State: PUBLISHED Published: 2019-02-17T18:00:00 Last Updated: 2024-08-05T12:12:28.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GloBee-Official/woocommerce-payment-api-plugin/pull/2 - https://www.exploit-db.com/exploits/46414/ - https://github.com/GloBee-Official/woocommerce-payment-api-plugin/issues/3
CVE ID: CVE-2018-20783 State: PUBLISHED Published: 2019-02-21T19:00:00 Last Updated: 2024-08-05T12:12:28.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c. Additional Analyst Notes: - CVE Program Container: References: - http://php.net/ChangeLog-5.php - http://php.net/ChangeLog-7.php - https://bugs.php.net/bug.php?id=77143 - http://lists.opensuse.org/opensuse-security-announc
://php.net/ChangeLog-7.php - https://bugs.php.net/bug.php?id=77143 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html - https://usn.ubuntu.com/3566-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html - https://access.redhat.com/errata/RHSA-2019:2519 - https://access.redhat.com/errata/RHSA-2019:3299
CVE ID: CVE-2018-20784 State: PUBLISHED Published: 2019-02-22T15:00:00 Last Updated: 2024-08-05T12:12:27.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/c40f7d74c741a907cfaeb73a7697081881c497d0 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c40f7d74c741a907cfaeb73a7697081881c497d0 - https://cdn.kernel.org
rg/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c40f7d74c741a907cfaeb73a7697081881c497d0 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.2 - https://access.redhat.com/errata/RHSA-2019:1959 - https://access.redhat.com/errata/RHSA-2019:1971 - https://usn.ubuntu.com/4115-1/ - https://usn.ubuntu.com/4118-1/ - https://usn.ubuntu.com/4211-2/ - https://usn.ubuntu.com/4211-1/
CVE ID: CVE-2018-20785 State: PUBLISHED Published: 2019-02-23T14:00:00 Last Updated: 2024-08-05T12:12:27.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, this does not completely reset the chip: memory contents are still in place. Also, it restarts into a boot menu that enables XMODEM upload and execution of an unsigned QNX IFS system image, thereby completing the bypass of secure boot. M
enables XMODEM upload and execution of an unsigned QNX IFS system image, thereby completing the bypass of secure boot. Moreover, the attacker can craft custom IFS data and write it to unused memory to extract all memory contents that had previously been present. This includes the original firmware and sensitive information such as Wi-Fi credentials. Additional Analyst Notes: - CVE Program Container: References: - https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners#t=745
CVE ID: CVE-2018-20786 State: PUBLISHED Published: 2019-02-24T14:00:00 Last Updated: 2024-08-05T12:12:27.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a denial of service (application crash), related to screen.c, state.c, and vterm.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vim/vim/commit/cd929f7ba8cc5b6d6dcf35c8b34124e969fed6b8 - https://github.com/vim/vim/issues/3711 - https://usn.ubuntu.com/4309-1/
CVE ID: CVE-2018-20787 State: PUBLISHED Published: 2019-02-25T04:00:00 Last Updated: 2024-08-05T12:12:28.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ft5x46 touchscreen driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS because of missing checks of the size argument in tpdbg_write in drivers/input/touchscreen/ft5x46/ft5x46_ts.c. This is exploitable for a device crash via a syscall by a crafted application on a rooted device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MiCode/Xiaomi_Kernel_OpenSource/issues/991
CVE ID: CVE-2018-20788 State: PUBLISHED Published: 2019-02-25T04:00:00 Last Updated: 2024-08-05T12:12:27.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/leds/leds-aw2023.c in the led driver for custom Linux kernels on the Xiaomi Redmi 6pro daisy-o-oss phone has several integer overflows because of a left-shifting operation when the right-hand operand can be equal to or greater than the integer length. This can be exploited by a crafted application for denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MiCode/Xiaomi_Kernel_OpenSource/issues/973
CVE ID: CVE-2018-20789 State: PUBLISHED Published: 2019-02-25T06:00:00 Last Updated: 2024-08-05T12:12:28.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass through the delete_folder action in execute.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45987
CVE ID: CVE-2018-20790 State: PUBLISHED Published: 2019-02-25T06:00:00 Last Updated: 2024-08-05T12:12:27.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass through the delete_file action in execute.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45987
CVE ID: CVE-2018-20791 State: PUBLISHED Published: 2019-02-25T06:00:00 Last Updated: 2024-08-05T12:12:28.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45987
CVE ID: CVE-2018-20792 State: PUBLISHED Published: 2019-02-25T06:00:00 Last Updated: 2024-08-05T12:12:27.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the get_file action in ajax_calls.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45987
CVE ID: CVE-2018-20793 State: PUBLISHED Published: 2019-02-25T06:00:00 Last Updated: 2024-08-05T12:12:28.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass, through the create_file action in execute.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45987
CVE ID: CVE-2018-20794 State: PUBLISHED Published: 2019-02-25T06:00:00 Last Updated: 2024-08-05T12:12:28.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the path parameter, through the save_img action in ajax_calls.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45987
CVE ID: CVE-2018-20795 State: PUBLISHED Published: 2019-02-25T06:00:00 Last Updated: 2024-08-05T12:12:27.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary files via path traversal with the path parameter, through the copy_cut action in ajax_calls.php and the paste_clipboard action in execute.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45987
CVE ID: CVE-2018-20796 State: PUBLISHED Published: 2019-02-26T02:00:00 Last Updated: 2024-08-05T12:12:28.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20190315-0002/ - https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html - http://www.securityfocus.com/bid/107160 - https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141 - https://support.f5.com/csp/article/K26346590?utm_sou
/bid/107160 - https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141 - https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2018-20797 State: PUBLISHED Published: 2019-02-27T17:00:00 Last Updated: 2024-08-05T12:12:27.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/podofo/tickets/34/
CVE ID: CVE-2018-20798 State: PUBLISHED Published: 2019-03-01T15:00:00 Last Updated: 2024-08-05T12:12:27.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durations implemented by sshguard, which might make it easier for attackers to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.pfsense.org/issues/9223
CVE ID: CVE-2018-20799 State: PUBLISHED Published: 2019-03-01T15:00:00 Last Updated: 2024-08-05T12:12:27.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH authentication (the behavior does not match the sshguard documentation), which might make it easier for attackers to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.pfsense.org/issues/9223