Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ml - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
CVE ID: CVE-2018-11500 State: PUBLISHED Published: 2018-05-26T21:00:00 Last Updated: 2024-08-05T08:10:14.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sanluan/PublicCMS/issues/11
CVE ID: CVE-2018-11501 State: PUBLISHED Published: 2018-05-26T21:00:00 Last Updated: 2024-08-05T08:10:14.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS. Additional Analyst Notes: - CVE Program Container: References: - https://whitehatck01.blogspot.com/2018/02/website-seller-script-203-stored-xss.html - https://gkaim.com/cve-2018-11501-vikas-chaudhary/
CVE ID: CVE-2018-11502 State: PUBLISHED Published: 2018-08-24T21:00:00 Last Updated: 2024-08-05T08:10:14.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker can remotely delete all mod notes and mod note logs in the modCP and ACP via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45224/ - https://packetstormsecurity.com/files/148999/MyBB-Moderator-Log-Notes-1.1-Cross-Site-Request-Forgery.html
CVE ID: CVE-2018-11503 State: PUBLISHED Published: 2018-05-26T21:00:00 Last Updated: 2024-08-05T08:10:14.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Orc/discount/issues/189#issuecomment-392247798 - https://lists.debian.org/debian-lts-announce/2018/09/msg00009.html - https://www.debian.org/security/2018/dsa-4293
CVE ID: CVE-2018-11504 State: PUBLISHED Published: 2018-05-26T21:00:00 Last Updated: 2024-08-05T08:10:14.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Orc/discount/issues/189#issuecomment-392247798 - https://lists.debian.org/debian-lts-announce/2018/09/msg00009.html - https://www.debian.org/security/2018/dsa-4293
CVE ID: CVE-2018-11505 State: PUBLISHED Published: 2018-05-26T22:00:00 Last Updated: 2024-08-05T08:10:14.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/NtPn3jB8 - https://www.exploit-db.com/exploits/44776/
CVE ID: CVE-2018-11506 State: PUBLISHED Published: 2018-05-28T04:00:00 Last Updated: 2024-08-05T08:10:14.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3752-2/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html - https://twitter.com/efrmv/
usn.ubuntu.com/3752-2/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html - https://twitter.com/efrmv/status/1001574894273007616 - https://usn.ubuntu.com/3752-3/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://github.com/torvalds/linux/commit/f7068114d45ec55996b9040e98111afa56e010fe - https://access.redhat.com/errata/RHSA-2018:2948 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f7068114d45ec55996b9040e98111afa56e010fe - https://usn.ubuntu.com/3752-1/
CVE ID: CVE-2018-11507 State: PUBLISHED Published: 2018-05-28T04:00:00Z Last Updated: 2024-09-16T19:31:21.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Free Lossless Image Format (FLIF) 0.3. An attacker can trigger a long loop in image_load_pnm in image/image-pnm.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FLIF-hub/FLIF/issues/509
CVE ID: CVE-2018-11508 State: PUBLISHED Published: 2018-05-28T13:00:00 Last Updated: 2024-08-05T08:10:14.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3695-1/ - https://usn.ubuntu.com/3695-2/ - https://bugs.chromium.org/p/project-zero/issues/detail?id=1574 - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.9 - http://www.securityfocus.com/bid/104292 - https://usn.ubuntu.com/3697-1/ - https://github.com/torvalds/l
ngeLog-4.16.9 - http://www.securityfocus.com/bid/104292 - https://usn.ubuntu.com/3697-1/ - https://github.com/torvalds/linux/commit/0a0b98734479aa5b3c671d5190e86273372cab95 - https://usn.ubuntu.com/3697-2/ - https://www.exploit-db.com/exploits/46208/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0a0b98734479aa5b3c671d5190e86273372cab95
CVE ID: CVE-2018-11509 State: PUBLISHED Published: 2018-08-16T20:00:00 Last Updated: 2024-08-05T08:10:14.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45200/ - http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
CVE ID: CVE-2018-11510 State: PUBLISHED Published: 2018-06-28T14:00:00 Last Updated: 2024-08-05T08:10:14.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45200/ - http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html - https://www.exploit-db.com/exploits/45212/ - https://github.com/mefulton/CVE-2018-11510 - https://github.com/m
on.html - https://www.exploit-db.com/exploits/45212/ - https://github.com/mefulton/CVE-2018-11510 - https://github.com/mefulton/CVE-2018-11510/blob/master/admex.py
CVE ID: CVE-2018-11511 State: PUBLISHED Published: 2018-08-16T20:00:00 Last Updated: 2024-08-05T08:10:14.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45200/ - http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
CVE ID: CVE-2018-11512 State: PUBLISHED Published: 2018-05-28T13:00:00 Last Updated: 2024-08-05T08:10:14.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44 - https://www.exploit-db.com/exploits/44790/ - https://gith
wity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44 - https://www.exploit-db.com/exploits/44790/ - https://github.com/Creatiwity/wityCMS/issues/150
CVE ID: CVE-2018-11514 State: PUBLISHED Published: 2018-05-28T14:00:00 Last Updated: 2024-08-05T08:10:14.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_resume_det.php, as demonstrated by changing .docx to .php. Additional Analyst Notes: - CVE Program Container: References: - https://whitehatck01.blogspot.com/2018/02/naukri-clone-script-303-file-upload.html
CVE ID: CVE-2018-11515 State: PUBLISHED Published: 2018-05-28T14:00:00 Last Updated: 2024-08-05T08:10:14.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9089 - https://github.com/DediData/wpforo/issues/1
CVE ID: CVE-2018-11516 State: PUBLISHED Published: 2018-05-28T16:00:00 Last Updated: 2024-08-05T08:10:14.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted .swf file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041312 - http://code610.blogspot.com/2018/05/make-free-vlc.html - http://www.videolan.org/security/sa1801.html - http://www.securityfocus.com/bid/104293
CVE ID: CVE-2018-11517 State: PUBLISHED Published: 2018-05-28T16:00:00Z Last Updated: 2024-09-16T23:46:56.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: mySCADA myPRO 7 allows remote attackers to discover all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 requests to TCP port 11010. Additional Analyst Notes: - CVE Program Container: References: - https://www.emreovunc.com/blog/en/mypro_enum_projectid.rb - https://github.com/EmreOvunc/mySCADA-myPRO-7-projectID-Disclosure
CVE ID: CVE-2018-11518 State: PUBLISHED Published: 2018-05-30T20:00:00 Last Updated: 2024-08-05T08:10:14.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can record these frequencies and use them for service activations. This is a request-forgery issue when the required series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the calle
series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the caller). In this case, the IVR system accepts an activation request from a less-secure channel (any loudspeaker in the caller's physical environment) without verifying that the request was intended (it matches a nonce sent over a more-secure channel to the caller's earpiece). Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/mishradhiraj_/status/1001664440759091207 - https://datarift.blogspot.com/2018/05/CVE-2018-11518-abusing-ivr-systems.html - http://virgil-cj.blogspot.com/2018/05/0day-legacy-ivr-lets-phreak.html - https://twitter.com/mishrad
-ivr-systems.html - http://virgil-cj.blogspot.com/2018/05/0day-legacy-ivr-lets-phreak.html - https://twitter.com/mishradhiraj_/status/1001664204485652482
CVE ID: CVE-2018-11522 State: PUBLISHED Published: 2018-06-01T21:00:00 Last Updated: 2024-08-05T08:10:14.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yosoro 1.0.4 has stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44803/ - http://packetstormsecurity.com/files/147978/Yosoro-1.0.4-Remote-Code-Execution.html - https://github.com/IceEnd/Yosoro/issues/11
CVE ID: CVE-2018-11523 State: PUBLISHED Published: 2018-05-29T07:00:00 Last Updated: 2024-08-05T08:10:14.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44794/ - https://github.com/unh3x/just4cve/issues/1
CVE ID: CVE-2018-11525 State: PUBLISHED Published: 2018-06-19T19:00:00 Last Updated: 2024-08-05T08:10:14.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44931/ - https://wpvulndb.com/vulnerabilities/9096 - https://wordpress.org/plugins/woo-order-export-lite/#developers
CVE ID: CVE-2018-11526 State: PUBLISHED Published: 2018-06-19T19:00:00 Last Updated: 2024-08-05T08:10:14.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44940/ - https://wordpress.org/plugins/comments-import-export-woocommerce/#developers - https://wpvulndb.com/vulnerabilities/9097
CVE ID: CVE-2018-11527 State: PUBLISHED Published: 2018-05-29T07:00:00 Last Updated: 2024-08-05T08:10:14.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpass_save. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fanyibo2009/cscms/blob/master/v4.1%20csrf
CVE ID: CVE-2018-11528 State: PUBLISHED Published: 2018-05-29T07:00:00 Last Updated: 2024-08-05T08:10:14.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/138
CVE ID: CVE-2018-11529 State: PUBLISHED Published: 2018-07-11T16:00:00 Last Updated: 2024-08-05T08:10:14.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041311 - http://seclists.org/fulldisclosure/2018/Jul/28 - https://www.exploit-db.com/exploits/45626/ - https://www.debian.org/security/2018/dsa-4251
CVE ID: CVE-2018-11531 State: PUBLISHED Published: 2018-05-29T07:00:00 Last Updated: 2024-08-05T08:10:14.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/283 - https://usn.ubuntu.com/3700-1/ - https://www.debian.org/security/2018/dsa-4238 - https://security.gentoo.org/glsa/201811-14 - https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html
CVE ID: CVE-2018-11532 State: PUBLISHED Published: 2018-05-29T07:00:00 Last Updated: 2024-08-05T08:10:14.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vintagedaddyo/MyBB_Plugin-ChangUonDyU-Advanced-Statistics/commit/8122c93f4c3b517b9d35338fe77ba91d9a6ac08a - https://www.exploit-db.com/exploits/44795/
CVE ID: CVE-2018-11535 State: PUBLISHED Published: 2018-05-29T07:00:00 Last Updated: 2024-08-05T08:10:14.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/NinjaXshell/f894bd79f9707a92a7b6934711a8fdc9 - https://www.exploit-db.com/exploits/44793/
CVE ID: CVE-2018-11536 State: PUBLISHED Published: 2018-05-29T07:00:00Z Last Updated: 2024-09-16T23:47:03.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mity/md4c/issues/36
CVE ID: CVE-2018-11537 State: PUBLISHED Published: 2018-06-19T19:00:00 Last Updated: 2024-08-05T08:10:14.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain. Additional Analyst Notes: - CVE Program Container: References: - https://auth0.com/docs/security/bulletins/cve-2018-11537
CVE ID: CVE-2018-11538 State: PUBLISHED Published: 2018-06-01T19:00:00 Last Updated: 2024-08-05T08:10:14.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://gurelahmet.com/cve-2018-11538-csrf-privilege-escalation-creation-of-an-administrator-account-on-searchblox-8-6-6/ - https://www.exploit-db.com/exploits/44801/ - http://packetstormsecurity.com/files/147977/SearchBlox-8.6.6-Cross-Site-Request-Forgery.html
CVE ID: CVE-2018-11541 State: PUBLISHED Published: 2018-07-09T12:00:00 Last Updated: 2024-08-05T08:10:14.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privileged content via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/CyberSKR/0134dff8f48d2e7b87227c554404bfcb - https://support.sonus.net/d
Container: References: - https://gist.github.com/CyberSKR/0134dff8f48d2e7b87227c554404bfcb - https://support.sonus.net/display/UXDOC61/SBC+Edge+6.1.6+Release+Notes
CVE ID: CVE-2018-11542 State: PUBLISHED Published: 2018-07-09T12:00:00 Last Updated: 2024-08-05T08:10:14.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Command Execution (RCE) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the execution of arbitrary commands via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonus.net/display/UXDOC61/SBC+Edge+6.1.6+Release+Notes - https://gist.github
am Container: References: - https://support.sonus.net/display/UXDOC61/SBC+Edge+6.1.6+Release+Notes - https://gist.github.com/CyberSKR/a2a8c76174578605af7bdbf53acebe1b
CVE ID: CVE-2018-11543 State: PUBLISHED Published: 2018-07-09T12:00:00 Last Updated: 2024-08-05T08:10:14.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local File Inclusion (LFI) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the downloading of arbitrary files via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonus.net/display/UXDOC61/SBC+Edge+6.1.6+Release+Notes - https://gist.github.com/
ntainer: References: - https://support.sonus.net/display/UXDOC61/SBC+Edge+6.1.6+Release+Notes - https://gist.github.com/CyberSKR/6914c2c2c8a550d6555137a3ff756df4
CVE ID: CVE-2018-11544 State: PUBLISHED Published: 2018-05-29T21:00:00.000Z Last Updated: 2025-11-11T18:26:17.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/data/com.theolivetree.ftpserver/shared_prefs/com.theolivetree.ftpserver_preferences.xml file as the prefUsername and prefUserpass strings. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/ygwczqpP - https://www.exploit-db.com/exploits/44852
CVE ID: CVE-2018-11545 State: PUBLISHED Published: 2018-05-29T21:00:00Z Last Updated: 2024-09-16T23:01:45.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link label composed solely of backslash escapes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mity/md4c/issues/39
CVE ID: CVE-2018-11546 State: PUBLISHED Published: 2018-05-29T21:00:00Z Last Updated: 2024-09-16T23:52:15.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mity/md4c/issues/38
CVE ID: CVE-2018-11547 State: PUBLISHED Published: 2018-05-29T21:00:00Z Last Updated: 2024-09-16T19:24:36.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandles loop termination. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mity/md4c/issues/37
CVE ID: CVE-2018-11548 State: PUBLISHED Published: 2018-05-29T21:00:00Z Last Updated: 2024-09-16T16:13:41.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connections from the same source IP address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EOSIO/eos/issues/3497