Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
use.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html - https://seclists.org/bugtraq/2019/Oct/28 - https://www.debian.org/security/2019/dsa-4547 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ - https://support.f5.com/csp/article/K04367730?utm_source=f5support&amp%3But
g/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ - https://support.f5.com/csp/article/K04367730?utm_source=f5support&amp%3Butm_medium=RSS - https://support.apple.com/kb/HT210788 - https://seclists.org/bugtraq/2019/Dec/23 - http://seclists.org/fulldisclosure/2019/Dec/26 - https://security.netapp.com/advisory/ntap-20200120-0001/ - https://usn.ubuntu.com/4252-2/ - https://usn.ubuntu.com/4252-1/
CVE ID: CVE-2018-14469 State: PUBLISHED Published: 2019-10-03T15:29:17 Last Updated: 2024-08-05T09:29:51.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES - https://github.com/the-tcpdump-group/tcpdump/commit/396e94ff55a80d554b1fe46bf107db1e91008d6c - https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.org/opensuse-security-announce/2
s.opensuse.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html - https://seclists.org/bugtraq/2019/Oct/28 - https://www.debian.org/security/2019/dsa-4547 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ - https://support.apple.com/kb/HT210788 - https://seclists.org/bugtra
ject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ - https://support.apple.com/kb/HT210788 - https://seclists.org/bugtraq/2019/Dec/23 - http://seclists.org/fulldisclosure/2019/Dec/26 - https://security.netapp.com/advisory/ntap-20200120-0001/ - https://usn.ubuntu.com/4252-2/ - https://usn.ubuntu.com/4252-1/
CVE ID: CVE-2018-14470 State: PUBLISHED Published: 2019-10-03T15:31:18 Last Updated: 2024-08-05T09:29:51.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES - https://github.com/the-tcpdump-group/tcpdump/commit/12f66f69f7bf1ec1266ddbee90a7616cbf33696b - https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.org/opensuse-security-announce/2
CVE ID: CVE-2018-14471 State: PUBLISHED Published: 2018-07-20T16:00:00Z Last Updated: 2024-09-16T23:56:44.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: dwg_obj_block_control_get_block_headers in dwg_api.c in GNU LibreDWG 0.5.1048 allows remote attackers to cause a denial of service (NULL pointer dereference and SEGV) via a crafted dwg file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreDWG/libredwg/issues/32
CVE ID: CVE-2018-14472 State: PUBLISHED Published: 2018-07-20T16:00:00Z Last Updated: 2024-09-17T01:22:04.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WUZHI CMS 4.1.0. The vulnerable file is coreframe/app/order/admin/goods.php. The $keywords parameter is taken directly into execution without any filtering, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/144
CVE ID: CVE-2018-14473 State: PUBLISHED Published: 2018-08-03T16:00:00 Last Updated: 2024-08-05T09:29:51.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in order to exfiltrate information or cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/
CVE ID: CVE-2018-14474 State: PUBLISHED Published: 2018-07-20T18:00:00Z Last Updated: 2024-09-17T01:11:34.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/s-gv/orangeforum/commit/1f6313cb3a1e755880fc1354f3e1efc4dd2dd4aa
CVE ID: CVE-2018-14476 State: PUBLISHED Published: 2019-12-31T15:18:52 Last Updated: 2024-08-05T09:29:51.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151006/GeniXCMS-1.1.5-Cross-Site-Scripting.html - https://github.com/semplon/GeniXCMS/issues/88
CVE ID: CVE-2018-14478 State: PUBLISHED Published: 2019-05-07T17:41:50 Last Updated: 2024-08-05T09:29:51.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151306/Coppermine-1.5.46-Cross-Site-Scripting.html - http://forum.coppermine-gallery.net/index.php/board%2C58.0.html
CVE ID: CVE-2018-14481 State: PUBLISHED Published: 2019-01-03T19:00:00 Last Updated: 2024-08-05T09:29:51.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150643/OSclass-3.7.4-Cross-Site-Scripting.html - https://www.netsparker.com/web-applications-advisories/ns-18-029-cross-site-scripting-in-osclass/
CVE ID: CVE-2018-14485 State: PUBLISHED Published: 2019-05-07T17:47:36 Last Updated: 2024-08-05T09:29:51.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151063/BlogEngine-3.3-XML-External-Entity-Injection.html - https://www.exploit-db.com/exploits/46106/ - https://github.com/rxtur/BlogEngine.NET/commits/master
CVE ID: CVE-2018-14486 State: PUBLISHED Published: 2019-03-17T21:14:53 Last Updated: 2024-08-05T09:29:51.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151304/DNN-9.1-XML-Related-Cross-Site-Scripting.html - http://www.dnnsoftware.com/community/security/security-center
CVE ID: CVE-2018-14492 State: PUBLISHED Published: 2018-07-21T12:00:00Z Last Updated: 2024-09-16T18:18:05.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZIllR0/Routers/blob/master/Tendaoob1.md
CVE ID: CVE-2018-14493 State: PUBLISHED Published: 2018-07-25T23:00:00 Last Updated: 2024-08-05T09:29:51.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45160/ - https://docs.google.com/document/d/1K3G6a8P_LhYdk5Ddn57Z2aDUpaGAS7I_F8lESVfSFfY/edit
CVE ID: CVE-2018-14494 State: PUBLISHED Published: 2019-07-10T12:56:42 Last Updated: 2024-08-05T09:29:51.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, although this CVE was first populated in July 2019, it is a historical vulnerability that does not apply to any current or recent Vivotek hardware or firmware Additional Analyst Notes: - CVE Program Container: References: - https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-selection-firmware-analysis/ - https://www.vdalabs.com/2018/08/06/professional-i
/professional-iot-hacking-series-target-selection-firmware-analysis/ - https://www.vdalabs.com/2018/08/06/professional-iot-hacking-series-hunting-remote-command-injection/
CVE ID: CVE-2018-14495 State: PUBLISHED Published: 2019-07-10T13:20:18 Last Updated: 2024-08-05T09:29:51.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target device," a different issue than CVE-2018-14494. NOTE: The vendor has disputed this as a vulnerability and states that the issue does not cause a web server crash or have any other affect on it's performance Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-selection-firmware-analysis/ - https://www.vda
https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-selection-firmware-analysis/ - https://www.vdalabs.com/2018/08/06/professional-iot-hacking-series-hunting-remote-command-injection/
CVE ID: CVE-2018-14496 State: PUBLISHED Published: 2019-07-10T13:25:23 Last Updated: 2024-08-05T09:29:51.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow, related to sprintf, vlocal_buff_4326, and set_getparam.cgi. NOTE: The vendor has disputed this as a vulnerability and states that the issue does not cause a web server crash or have any other affect on it's performance Additional Analyst Notes: - CVE Program Container: References: - https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-selection-firmware-analysis/ - https://www.vdalabs.
://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-selection-firmware-analysis/ - https://www.vdalabs.com/2018/11/29/professional-iot-hacking-series-hunting-remote-memory-corruption/
CVE ID: CVE-2018-14497 State: PUBLISHED Published: 2018-08-03T16:00:00 Last Updated: 2024-08-05T09:29:51.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda D152 ADSL routers allow XSS via a crafted SSID. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45336/ - https://sandipdeyhack7.blogspot.com/2018/07/cve-2018-14497-tenda-d152-adsl-routers_24.html
CVE ID: CVE-2018-14498 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T09:29:51.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjpeg-turbo/libjpeg-turbo/issues/258 - https://github.com/mozilla/mozjpeg/issues/299 - https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9c78a04
sues/258 - https://github.com/mozilla/mozjpeg/issues/299 - https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9c78a04df4e44ef6487eee99c4258397f4fdca55 - https://lists.debian.org/debian-lts-announce/2019/03/msg00021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7YP4QUEYGHI4Q7GIAVFVKWQ7DJMBYLU/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html - https://access.redhat.com/errata/RHSA-2019:2052 - https://access.redhat.com/errata/RHSA-2019:3705 - https://usn.ubuntu.com/4190-1/ - https://lists.debian.org/debian-lts-announce/2020/07/ms
hat.com/errata/RHSA-2019:3705 - https://usn.ubuntu.com/4190-1/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html
CVE ID: CVE-2018-14499 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T09:29:51.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyyyp/HYBBS/issues/1
CVE ID: CVE-2018-14500 State: PUBLISHED Published: 2018-07-22T17:00:00 Last Updated: 2024-08-05T09:29:51.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/431
CVE ID: CVE-2018-14501 State: PUBLISHED Published: 2018-07-22T17:00:00 Last Updated: 2024-08-05T09:29:51.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: manager/admin_ajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "m_id=1 AND SLEEP(5)" substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/432
CVE ID: CVE-2018-14502 State: PUBLISHED Published: 2020-03-10T12:45:15 Last Updated: 2024-08-05T09:29:51.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/chained-quiz/#developers - https://wpvulndb.com/vulnerabilities/9112
CVE ID: CVE-2018-14503 State: PUBLISHED Published: 2018-08-10T16:00:00 Last Updated: 2024-08-05T09:29:51.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in intervalCheck.jsp in Coremail XT 3.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.shuimugan.com/bug/view?bug_no=66925
CVE ID: CVE-2018-14504 State: PUBLISHED Published: 2018-08-03T18:00:00 Last Updated: 2024-08-05T09:29:51.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)'). Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=24608 - https://mantisbt.org/blog/archives/mantisbt/602 - http://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135e
ttps://mantisbt.org/blog/archives/mantisbt/602 - http://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f
CVE ID: CVE-2018-14505 State: PUBLISHED Published: 2018-07-22T18:00:00 Last Updated: 2024-08-05T09:29:51.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mitmproxy/mitmproxy/pull/3243 - https://github.com/mitmproxy/mitmproxy/issues/3234
CVE ID: CVE-2018-14512 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[nickname] parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server" screen, the XSS payload is triggered. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/143
CVE ID: CVE-2018-14513 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[content] parameter to the index.php?m=feedback&f=index&v=contact URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/145
CVE ID: CVE-2018-14514 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/29
CVE ID: CVE-2018-14515 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promote&f=index&v=search keywords parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/146
CVE ID: CVE-2018-14517 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SecWiki/CMS-Hunter/blob/master/seacms/seacms6.61/seacms661.md
CVE ID: CVE-2018-14519 State: PUBLISHED Published: 2022-08-24T19:43:11 Last Updated: 2024-08-05T09:29:51.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page. Additional Analyst Notes: - CVE Program Container: References: - http://zaranshaikh.blogspot.com - https://www.exploit-db.com/exploits/45090
CVE ID: CVE-2018-14520 State: PUBLISHED Published: 2022-08-24T19:43:07.000Z Last Updated: 2025-06-17T19:19:47.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zaranshaikh.blogspot.com/2018/07/cross-site-request-forgery-kirby-cms.html - https://www.exploit-db.com/exploits/45068
CVE ID: CVE-2018-14521 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_source_avcodec_readframe in io/source_avcodec.c, as demonstrated by aubiomfcc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aubio/aubio/issues/187
CVE ID: CVE-2018-14522 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_pitch_set_unit in pitch/pitch.c, as demonstrated by aubionotes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aubio/aubio/issues/188 - http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00071.html
CVE ID: CVE-2018-14523 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aubio/aubio/issues/189 - http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00071.html
CVE ID: CVE-2018-14524 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: dwg_decode_eed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwg_free_eed in free.c) because it does not properly manage the obj->eed value after a free occurs. Additional Analyst Notes: - CVE Program Container: References: - https://savannah.gnu.org/forum/forum.php?forum_id=9211 - https://github.com/LibreDWG/libredwg/issues/33
CVE ID: CVE-2018-14526 State: PUBLISHED Published: 2018-08-08T19:00:00 Last Updated: 2024-08-05T09:29:51.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://papers.mathyvanhoef.com/woot2018.pdf - http://www.securitytracker.com/id/1041438 - https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt
pdf - http://www.securitytracker.com/id/1041438 - https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt - https://security.FreeBSD.org/advisories/FreeBSD-SA-18:11.hostapd.asc - https://access.redhat.com/errata/RHSA-2018:3107 - https://lists.debian.org/debian-lts-announce/2018/08/msg00009.html - https://usn.ubuntu.com/3745-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00013.html - https://cert-portal.siemens.com/productcert/pdf/ssa-344983.pdf - https://www.us-cert.gov/ics/advisories/icsa-19-344-01
CVE ID: CVE-2018-14527 State: PUBLISHED Published: 2018-07-23T08:00:00 Last Updated: 2024-08-05T09:29:51.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: Feedback.asp in Xiao5uCompany 1.7 has XSS because the XSS protection mechanism in Safe.asp is insufficient (for example, it considers SCRIPT and IMG elements, but does not consider VIDEO elements). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/2018/Xiao5uCompany_1.7_xss.doc