Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-11009 State: PUBLISHED Published: 2021-01-11T15:40:34 Last Updated: 2024-08-05T07:54:36.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. Additional Analyst Notes: - CVE Program Container: References: - https://www.k7computing.com - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE ID: CVE-2018-11010 State: PUBLISHED Published: 2021-01-11T15:42:28 Last Updated: 2024-08-05T07:54:36.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. Additional Analyst Notes: - CVE Program Container: References: - https://www.k7computing.com - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE ID: CVE-2018-11011 State: PUBLISHED Published: 2018-05-12T04:00:00Z Last Updated: 2024-09-16T23:10:57.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ruibaby/halo/issues/9
CVE ID: CVE-2018-11012 State: PUBLISHED Published: 2018-05-12T04:00:00Z Last Updated: 2024-09-16T19:51:04.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ruibaby/halo/issues/9
CVE ID: CVE-2018-11013 State: PUBLISHED Published: 2018-05-13T15:00:00 Last Updated: 2024-08-05T07:54:36.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with firmware version 1.10B05 allows unauthenticated remote attackers to execute arbitrary code via a request with a long HTTP Host header. Additional Analyst Notes: - CVE Program Container: References: - https://0x3f97.github.io/exploit/2018/05/13/D-Link-DIR-816-A2-CN-router-stack-based-buffer-overflow/
CVE ID: CVE-2018-11017 State: PUBLISHED Published: 2018-05-13T21:00:00 Last Updated: 2024-08-05T07:54:36.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: The newVar_N function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/18lJc_F5p3HPaMwsUAIwP0zMMhwJs-Snhuj05nhMIgAw/edit
CVE ID: CVE-2018-11018 State: PUBLISHED Published: 2018-05-13T22:00:00 Last Updated: 2024-08-05T07:54:36.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhaoheng521/PbootCMS/blob/master/V1.0.7%20csrf
CVE ID: CVE-2018-11019 State: PUBLISHED Published: 2018-10-16T22:00:00 Last Updated: 2024-08-05T07:54:36.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 3221773726 and cause a kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datadancer/HIAFuzz/blob/master/CVE-Advisory.md - https://github.com/datadancer/HIAFuzz/blob/master/CVE-2018-11019.md
CVE ID: CVE-2018-11020 State: PUBLISHED Published: 2018-10-16T22:00:00 Last Updated: 2024-08-05T07:54:36.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/omap/drivers/rpmsg/rpmsg_omx.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device file /dev/rpmsg-omx1 with the command 3221772291, and cause a kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datadancer/HIAFuzz/blob/master/CVE-Advisory.md - https://github.com/datadancer/HIAFuzz/blob/master/CVE-2018-11020.md
CVE ID: CVE-2018-11021 State: PUBLISHED Published: 2018-10-16T22:00:00 Last Updated: 2024-08-05T07:54:36.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/omap/drivers/video/omap2/dsscomp/device.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/dsscomp with the command 1118064517 and cause a kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datadancer/HIAFuzz/blob/master/CVE-2018-11021.md - https://github.com/datadancer/HIAFuzz/blob/master/CVE-Advisory.md
CVE ID: CVE-2018-11022 State: PUBLISHED Published: 2018-10-16T22:00:00 Last Updated: 2024-08-05T07:54:36.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 3224132973 and cause a kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datadancer/HIAFuzz/blob/master/CVE-Advisory.md
CVE ID: CVE-2018-11023 State: PUBLISHED Published: 2018-10-16T22:00:00 Last Updated: 2024-08-05T07:54:36.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 3222560159 and cause a kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datadancer/HIAFuzz/blob/master/CVEs.md
CVE ID: CVE-2018-11024 State: PUBLISHED Published: 2018-10-16T22:00:00 Last Updated: 2024-08-05T07:54:36.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 1077435789 and cause a kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datadancer/HIAFuzz/blob/master/CVEs.md
CVE ID: CVE-2018-11025 State: PUBLISHED Published: 2018-10-16T22:00:00 Last Updated: 2024-08-05T07:54:36.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/omap/drivers/mfd/twl6030-gpadc.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/twl6030-gpadc with the command 24832 and cause a kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datadancer/HIAFuzz/blob/master/CVE-Advisory.md
CVE ID: CVE-2018-11027 State: PUBLISHED Published: 2018-05-29T20:00:00 Last Updated: 2024-08-05T07:54:36.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/542040/100/0/threaded - https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11027
CVE ID: CVE-2018-11031 State: PUBLISHED Published: 2018-05-14T00:00:00Z Last Updated: 2024-09-16T21:03:39.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an api[url]=file:////etc/passwd&api[method]=get POST request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gouguoyin/phprap/issues/89
CVE ID: CVE-2018-11032 State: PUBLISHED Published: 2018-05-14T00:00:00Z Last Updated: 2024-09-17T03:37:42.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search() function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gouguoyin/phprap/issues/89
CVE ID: CVE-2018-11033 State: PUBLISHED Published: 2018-05-14T00:00:00Z Last Updated: 2024-09-16T20:51:42.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JPEG data. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=40842
CVE ID: CVE-2018-11034 State: PUBLISHED Published: 2018-05-14T01:00:00 Last Updated: 2024-08-05T07:54:36.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x8000200D. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345NsProtect.sys-x64-0x8000200D - https://www.exploit-db.com/exploits/44619/
CVE ID: CVE-2018-11035 State: PUBLISHED Published: 2018-05-14T01:00:00Z Last Updated: 2024-09-16T17:18:56.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x80002019. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345NsProtect.sys-x64-0x80002019
CVE ID: CVE-2018-11036 State: PUBLISHED Published: 2018-05-31T12:00:00 Last Updated: 2024-08-05T07:54:36.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale) on vSZ, SZ-100, SZ-300, and SCG-200 devices allows remote attackers to obtain sensitive information or modify data. Additional Analyst Notes: - CVE Program Container: References: - https://www.ruckuswireless.com/security/279/view/txt
CVE ID: CVE-2018-11037 State: PUBLISHED Published: 2018-05-14T03:00:00 Last Updated: 2024-08-05T07:54:36.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/307 - https://security.gentoo.org/glsa/201811-14 - https://access.redhat.com/errata/RHSA-2019:2101
CVE ID: CVE-2018-11039 State: PUBLISHED Published: 2018-06-25T15:00:00Z Last Updated: 2024-09-16T22:08:49.057Z Vendors: Pivotal Products: Spring Framework Problem Types: Cross Site Tracing Description: Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityf
n XST (Cross Site Tracing) attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107984 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://pivotal.io/security/cve-2018-11039 - https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html - https://www.ora
ivotal.io/security/cve-2018-11039 - https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-11040 State: PUBLISHED Published: 2018-06-25T15:00:00Z Last Updated: 2024-09-17T02:06:00.434Z Vendors: Pivotal Products: Spring Framework Problem Types: JSONP enabled by default in MappingJackson2JsonView Description: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is autom
Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-aler
ml - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://pivotal.io/security/cve-2018-11040 - https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-11041 State: PUBLISHED Published: 2018-06-25T15:00:00Z Last Updated: 2024-09-16T23:11:54.199Z Vendors: Cloud Foundry Products: Cloud Foundry UAA Problem Types: Open Redirect Description: Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt. Additional Analyst Notes: - CVE Program Container:
direct users to arbitrary websites after a successful login attempt. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-11041/
CVE ID: CVE-2018-11042 State: REJECTED Published: 2018-09-18T20:00:00 Last Updated: 2018-09-18T19:57:01 Description: No description available.
CVE ID: CVE-2018-11043 State: REJECTED Published: 2018-10-02T14:00:00 Last Updated: 2018-10-02T13:57:01 Description: No description available.
CVE ID: CVE-2018-11044 State: PUBLISHED Published: 2018-07-24T19:00:00Z Last Updated: 2024-09-16T21:02:31.767Z Vendors: Pivotal Products: Pivotal Application Service Problem Types: Information exposure Description: Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-201
ource of the email. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-11044
CVE ID: CVE-2018-11045 State: PUBLISHED Published: 2018-07-11T20:00:00Z Last Updated: 2024-09-16T22:56:33.333Z Vendors: Pivotal Products: Pivotal Operations Manager Problem Types: Random number generation Description: Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the contents of the corresponding seed from the published image and therefore infer the initial state of the LRNG. Additional Analyst Notes: - CVE Program Container: References: - https:
d therefore infer the initial state of the LRNG. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-11045
CVE ID: CVE-2018-11046 State: PUBLISHED Published: 2018-06-25T15:00:00Z Last Updated: 2024-09-16T22:55:25.495Z Vendors: Pivotal Products: Operations Manager Problem Types: unpatched vulnerabilities Description: Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches. An attacker with access to the NGINX processes and knowledge of how to exploit the unpatched vulnerabilities may be able to impact Operations Manager Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104545 - https://pivotal.io/security/cve-2018-11046
CVE ID: CVE-2018-11047 State: PUBLISHED Published: 2018-07-24T19:00:00Z Last Updated: 2024-09-17T02:41:49.974Z Vendors: Cloud Foundry Products: Cloud Foundry UAA Problem Types: Application Logic Error Description: Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Gro
resh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-11047/
CVE ID: CVE-2018-11048 State: PUBLISHED Published: 2018-08-10T20:00:00Z Last Updated: 2024-09-17T01:56:30.207Z Vendors: Dell EMC Products: Data Protection Advisor, Integrated Data Protection Appliance Problem Types: XML External Entity Vulnerability Description: Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an
tem files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105130 - http://seclists.org/fulldisclosure/2018/Aug/5 - http://www.securitytracker.com/id/1041417
CVE ID: CVE-2018-11049 State: PUBLISHED Published: 2018-07-11T20:00:00Z Last Updated: 2024-09-17T04:20:09.305Z Vendors: Pivotal Products: Pivotal Operations Manager Problem Types: uncontrolled search path vulnerability Description: RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104722 - http://seclists.org/fulldisclosure/20
: - CVE Program Container: References: - http://www.securityfocus.com/bid/104722 - http://seclists.org/fulldisclosure/2018/Jul/23 - http://www.securitytracker.com/id/1041228
CVE ID: CVE-2018-11050 State: PUBLISHED Published: 2018-08-01T06:00:00Z Last Updated: 2024-09-16T19:51:06.826Z Vendors: Dell EMC Products: Networker Problem Types: Clear-Text authentication over network vulnerability Description: Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in the Rabbit MQ Advanced Message Queuing Protocol (AMQP) component. User credentials are sent unencrypted to the remote AMQP service. An unauthenticated attacker in the same network collision domain, could potentially sniff the password from the network and use it to access the component using the privileges of
domain, could potentially sniff the password from the network and use it to access the component using the privileges of the compromised user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104963 - http://www.securitytracker.com/id/1041393 - http://seclists.org/fulldisclosure/2018/Jul/92
CVE ID: CVE-2018-11051 State: PUBLISHED Published: 2018-07-03T17:00:00Z Last Updated: 2024-09-16T21:08:18.669Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: RSA Products: Certificate Manager Path Traversal Vulnerability Problem Types: Authentication Bypass Vulnerability Description: RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enroll Server. A remote unauthenticated attacker could potentially exploit this vulnerability by manipulating input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, wit
g input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jul/11 - http://www.securityfocus.com/bid/104674 - http://www.securitytracker.com/id/1041211
CVE ID: CVE-2018-11052 State: PUBLISHED Published: 2018-07-03T17:00:00Z Last Updated: 2024-09-17T04:00:07.900Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: ECS Problem Types: Authentication Bypass Vulnerability Description: Dell EMC ECS versions 3.2.0.0 and 3.2.0.1 contain an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to read and modify S3 objects by supplying specially crafted S3 requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104660 - http://seclists.org/fulldisclosure/2018/Jul/1