Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-20330 State: PUBLISHED Published: 2018-12-21T09:00:00 Last Updated: 2024-08-05T11:58:18.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled, as demonstrated by tjbench. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjpeg-turbo/libjpeg-turbo/issues/304 - https://usn.ubuntu.com/4190-1/
CVE ID: CVE-2018-20331 State: PUBLISHED Published: 2018-12-23T02:00:00 Last Updated: 2024-08-05T11:58:18.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x80002004 by the ssdt.sys kernel driver. The bug is caused by failure to properly validate the length of the user-supplied data. An attacker can leverage this vulnerability to execute arbitrary code in the context of the kernel, which could lead to pri
attacker can leverage this vulnerability to execute arbitrary code in the context of the kernel, which could lead to privilege escalation. A failed exploit could lead to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/150900
CVE ID: CVE-2018-20332 State: PUBLISHED Published: 2018-12-21T09:00:00 Last Updated: 2024-08-05T11:58:18.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download&file= followed by a full pathname, and listing of arbitrary directories is possible with /file?action=download&dir= followed by a full pathname. This is related to plugin/controllers/file.py in the e2openplugin-OpenWebif project. Additional Analyst Notes: - CVE Program Container: References: - https://danieltindall.me/openwebif-vulnerabilities - https://github.com/E2Op
tes: - CVE Program Container: References: - https://danieltindall.me/openwebif-vulnerabilities - https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/commit/a846b7664eda3a4c51a452e00638cf7337dc2013
CVE ID: CVE-2018-20333 State: PUBLISHED Published: 2020-03-20T00:11:15 Last Updated: 2024-08-05T11:58:19.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /update_applist.asp to see if a USB device is attached to the router and if there are apps installed on the router. Additional Analyst Notes: - CVE Program Container: References: - https://starlabs.sg/advisories/18-20333/
CVE ID: CVE-2018-20334 State: PUBLISHED Published: 2020-03-20T00:11:06 Last Updated: 2024-08-05T11:58:18.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacters in the fb_email parameter. By using this issue, an attacker can control the router and get shell. Additional Analyst Notes: - CVE Program Container: References: - https://starlabs.sg/advisories/18-20334/
CVE ID: CVE-2018-20335 State: PUBLISHED Published: 2020-03-20T00:11:09 Last Updated: 2024-08-05T11:58:18.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APP_Installation.asp?= URI. Additional Analyst Notes: - CVE Program Container: References: - https://starlabs.sg/advisories/18-20335/
CVE ID: CVE-2018-20336 State: PUBLISHED Published: 2019-09-17T15:51:33 Last Updated: 2024-08-05T11:58:18.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parse_req_queries function in wanduck.c via a long string over UDP, which may lead to an information leak. Additional Analyst Notes: - CVE Program Container: References: - https://starlabs.sg/advisories/18-20336/ - https://www.asus.com/Networking/RT-AC1200G-plus/HelpDesk_BIOS/
CVE ID: CVE-2018-20337 State: PUBLISHED Published: 2018-12-21T09:00:00 Last Updated: 2024-08-05T11:58:19.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/192 - https://usn.ubuntu.com/3989-1/
CVE ID: CVE-2018-20338 State: PUBLISHED Published: 2018-12-21T09:00:00 Last Updated: 2024-08-05T11:58:19.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me.html - http://www.securityfocus.com/bid/106302
CVE ID: CVE-2018-20339 State: PUBLISHED Published: 2018-12-21T09:00:00 Last Updated: 2024-08-05T11:58:18.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me.html - http://www.securityfocus.com/bid/106302
CVE ID: CVE-2018-20340 State: PUBLISHED Published: 2019-03-17T20:06:42 Last Updated: 2024-08-05T11:58:18.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Feb/23 - https://www.debian.org/security/2019/dsa-
VE Program Container: References: - https://seclists.org/bugtraq/2019/Feb/23 - https://www.debian.org/security/2019/dsa-4389 - https://www.yubico.com/support/security-advisories/ysa-2019-01/ - https://developers.yubico.com/libu2f-host/Release_Notes.html - https://blog.inhq.net/posts/yubico-libu2f-host-vuln-part1/ - https://security.gentoo.org/glsa/202004-15
CVE ID: CVE-2018-20341 State: PUBLISHED Published: 2019-04-08T14:50:01 Last Updated: 2024-08-05T11:58:19.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a target system. If the executable is enclosed in quote tags "" then the system will know where to find it. However if the path of where the application binary is located doesn't contain any quotes then Windows will try to find it and execute it inside every folder of this path until they reach the executable. Additional Analyst Notes: - CVE Program Container: References
every folder of this path until they reach the executable. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.winmagic.info/manuals/Release_Notes_8.3.pdf
CVE ID: CVE-2018-20342 State: PUBLISHED Published: 2018-12-21T18:00:00 Last Updated: 2024-08-05T11:58:18.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Floureon IP Camera SP012 provides a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://neolex-security.fr/blog/8/ - http://neolex-security.fr/article/obtenir-un-shell-root-par-les-ports-uart-sur-une-camera-ip-floureon/
CVE ID: CVE-2018-20343 State: PUBLISHED Published: 2020-03-02T20:48:12 Last Updated: 2024-08-05T11:58:19.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflow vulnerabilities have been found in Ken Silverman Build Engine 1. An attacker could craft a special map file to execute arbitrary code when the map file is loaded. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Alexandre-Bartel/CVE-2018-20343
CVE ID: CVE-2018-20345 State: PUBLISHED Published: 2018-12-21T19:00:00Z Last Updated: 2024-09-17T00:42:16.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=<username>" query filter parameters. Enterprise editions with RBAC enabled are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://stackstorm.com/2018/12/20/stackstorm-v2-9-2-and-v2-10-1-a-security-r
tes: - CVE Program Container: References: - https://stackstorm.com/2018/12/20/stackstorm-v2-9-2-and-v2-10-1-a-security-release/
CVE ID: CVE-2018-20346 State: PUBLISHED Published: 2018-12-21T21:00:00 Last Updated: 2024-08-05T11:58:19.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan. Additional Analyst Notes: - CVE Program Container: References: - https://worthdoingbadly.com/sqlitebug/ - https://support.apple.com/HT209446 - https://bugzilla.redhat.com/sho
erences: - https://worthdoingbadly.com/sqlitebug/ - https://support.apple.com/HT209446 - https://bugzilla.redhat.com/show_bug.cgi?id=1659379 - https://bugzilla.redhat.com/show_bug.cgi?id=1659677 - https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html - https://www.synology.com/security/advisory/Synology_SA_18_61 - https://access.redhat.com/articles/3758321 - https://support.apple.com/HT209443 - https://blade.tencent.com/magellan/index_en.html - https://support.apple.com/HT209451 - https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html - https://news.ycombinator.com/item?id=18685296 - https://support.apple.com/HT209450 - https://sqlite.org/src
tebug.html - https://news.ycombinator.com/item?id=18685296 - https://support.apple.com/HT209450 - https://sqlite.org/src/info/940f2adc8541a838 - https://support.apple.com/HT209448 - https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e - https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html - http://www.securityfocus.com/bid/106323 - https://crbug.com/900910 - https://sqlite.org/src/info/d44318f59044162e - https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://www.sqlite.org/releaselog/3_25_3.html - https://support.
og.com/2018/12/stable-channel-update-for-desktop.html - https://www.sqlite.org/releaselog/3_25_3.html - https://support.apple.com/HT209447 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html - https://security.gentoo.org/glsa/201904-21 - https://usn.ubuntu.com/4019-1/ - https://usn.ubuntu.com/4019-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/ - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html - https://kc.mcafee.com/corporate/ind
uapr2020.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html - https://kc.mcafee.com/corporate/index?page=content&id=SB10365
CVE ID: CVE-2018-20347 State: REJECTED Published: 2020-03-02T21:02:33 Last Updated: 2020-03-02T21:02:33 Description: No description available.
CVE ID: CVE-2018-20348 State: PUBLISHED Published: 2018-12-22T00:00:00 Last Updated: 2024-08-05T11:58:19.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libyal/libpff/issues/48
CVE ID: CVE-2018-20349 State: PUBLISHED Published: 2018-12-22T00:00:00 Last Updated: 2024-08-05T11:58:19.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/igraph/igraph/issues/1141 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NCGDUNQYLSZLSGN6JJBORVFW46U3A75Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m
QYLSZLSGN6JJBORVFW46U3A75Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OWCGXEINKJM3JQUPVCSN4RBTRKWBTYI7/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00038.html
CVE ID: CVE-2018-20351 State: PUBLISHED Published: 2018-12-22T00:00:00 Last Updated: 2024-08-05T11:58:19.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832. Additional Analyst Notes: - CVE Program Container: References: - https://www.yinxiang.com/security/updates/
CVE ID: CVE-2018-20352 State: PUBLISHED Published: 2019-06-10T16:15:42 Last Updated: 2024-08-05T11:58:19.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/insi2304/mongoose-6.13-fuzz
CVE ID: CVE-2018-20353 State: PUBLISHED Published: 2019-06-10T16:19:11 Last Updated: 2024-08-05T11:58:19.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read-mg_http_get_proto_data5932.png
CVE ID: CVE-2018-20354 State: PUBLISHED Published: 2019-06-10T16:21:41 Last Updated: 2024-08-05T11:58:19.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read-mg_http_get_proto_data.png
CVE ID: CVE-2018-20355 State: PUBLISHED Published: 2019-06-10T16:23:43 Last Updated: 2024-08-05T11:58:18.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-mg_http_free_proto_data_cgi.png
CVE ID: CVE-2018-20356 State: PUBLISHED Published: 2019-06-10T16:26:32 Last Updated: 2024-08-05T11:58:19.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read_mg_http_free_proto_data_cgi.png
CVE ID: CVE-2018-20357 State: PUBLISHED Published: 2018-12-22T15:00:00 Last Updated: 2024-08-05T11:58:18.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference was discovered in sbr_process_channel of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faad2/issues/28 - https://www.debian.org/security/2019/dsa-4522 - https://seclists.org/bugtraq/2019/Sep/28 - https://security.gentoo.org/glsa/202006-17
CVE ID: CVE-2018-20358 State: PUBLISHED Published: 2018-12-22T15:00:00 Last Updated: 2024-08-05T11:58:19.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faad2/issues/31 - https://www.debian.org/security/2019/dsa-4522 - https://seclists.org/bugtraq/2019/Sep/28 - https://security.gentoo.org/glsa/202006-17
CVE ID: CVE-2018-20359 State: PUBLISHED Published: 2018-12-22T15:00:00 Last Updated: 2024-08-05T11:58:19.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faad2/issues/29 - https://www.debian.org/security/2019/dsa-4522 - https://seclists.org/bugtraq/2019/Sep/28 - https://security.gentoo.org/glsa/202006-17
CVE ID: CVE-2018-20360 State: PUBLISHED Published: 2018-12-22T15:00:00 Last Updated: 2024-08-05T11:58:19.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faad2/issues/32 - https://lists.debian.org/debian-lts-announce/2019/08/msg00033.html - https://security.gentoo.org/glsa/202006-17 - https://lists.debian.org/debian-lts-announce
nounce/2019/08/msg00033.html - https://security.gentoo.org/glsa/202006-17 - https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html - https://www.debian.org/security/2022/dsa-5109
CVE ID: CVE-2018-20361 State: PUBLISHED Published: 2018-12-22T15:00:00 Last Updated: 2024-08-05T11:58:19.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faad2/issues/30 - https://www.debian.org/security/2019/dsa-4522 - https://seclists.org/bugtraq/2019/Sep/28 - https://security.gentoo.org/glsa/202006-17
CVE ID: CVE-2018-20362 State: PUBLISHED Published: 2018-12-22T15:00:00 Last Updated: 2024-08-05T11:58:19.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash because adding to windowed output is mishandled in the EIGHT_SHORT_SEQUENCE case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faad2/issues/26 - https://lists.debian.org/debian-lts-announce/2019/05/msg00022.html - https://www.debian.org/security/2019/dsa-4522 - https://seclists.org/bug
org/debian-lts-announce/2019/05/msg00022.html - https://www.debian.org/security/2019/dsa-4522 - https://seclists.org/bugtraq/2019/Sep/28 - https://security.gentoo.org/glsa/202006-17
CVE ID: CVE-2018-20363 State: PUBLISHED Published: 2018-12-22T17:00:00 Last Updated: 2024-08-05T11:58:19.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106299 - https://github.com/LibRaw/LibRaw/issues/193 - https://usn.ubuntu.com/3989-1/
CVE ID: CVE-2018-20364 State: PUBLISHED Published: 2018-12-22T17:00:00 Last Updated: 2024-08-05T11:58:19.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/issues/194 - http://www.securityfocus.com/bid/106299 - https://usn.ubuntu.com/3989-1/
CVE ID: CVE-2018-20365 State: PUBLISHED Published: 2018-12-22T17:00:00 Last Updated: 2024-08-05T11:58:18.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106299 - https://github.com/LibRaw/LibRaw/issues/195 - https://usn.ubuntu.com/3989-1/
CVE ID: CVE-2018-20367 State: PUBLISHED Published: 2018-12-22T19:00:00 Last Updated: 2024-08-05T11:58:19.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8_181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wstmall/wstmart/issues/1
CVE ID: CVE-2018-20368 State: PUBLISHED Published: 2018-12-23T02:00:00Z Last Updated: 2024-09-17T04:04:49.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2158