Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
E - https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1%40%3Ccommits.jspwiki.apache.org%3E - https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E
CVE ID: CVE-2018-20243 State: PUBLISHED Published: 2020-10-13T18:23:49 Last Updated: 2024-08-05T11:58:18.736Z Vendors: n/a Products: Apache Fineract Problem Types: Critical Description: The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r040d46835aff3c192656b549ca82f62d87fb044ef9a9dd49408b49b4%40%3Cdev.fineract.apache.org%3E
CVE ID: CVE-2018-20244 State: PUBLISHED Published: 2019-02-27T18:00:00Z Last Updated: 2024-09-16T22:24:36.287Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Stored XSS Description: In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/f656fddf9c49293b3ec450437c46709eb01a12d1645136b2f1b8573b%40%3Cdev.airflow.apache.org%3E - https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231%40%3Cdev.airflow.apache.org
ttps://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231%40%3Cdev.airflow.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/04/10/6
CVE ID: CVE-2018-20245 State: PUBLISHED Published: 2019-01-23T17:00:00Z Last Updated: 2024-09-16T19:40:46.503Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Improper Certificate Validation Description: The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/b549c7573b342a6e457e5a3225c33054244343927bbfb2a4cdc4cf73%40%3Cdev.airflow.apache.org%3E
CVE ID: CVE-2018-20246 State: REJECTED Published: 2019-02-06T22:00:00 Last Updated: 2019-02-06T21:57:01 Description: No description available.
CVE ID: CVE-2018-20247 State: PUBLISHED Published: 2018-12-24T19:00:00 Last Updated: 2024-08-05T11:58:18.710Z Vendors: n/a Products: Foxit Quick PDF Library Problem Types: CWE-121 Description: In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page tree structure using the LoadFromFile, LoadFromString or LoadFromStream functions results in a stack overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106306 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20248 State: PUBLISHED Published: 2018-12-24T19:00:00 Last Updated: 2024-08-05T11:58:18.792Z Vendors: n/a Products: Foxit Quick PDF Library Problem Types: CWE-787 Description: In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table pointers or invalid xref table data using the LoadFromFile, LoadFromString, LoadFromStream, DAOpenFile or DAOpenFileReadOnly functions may result in an access violation caused by out of bounds memory access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106306 - https://www.foxitsoftware.com/support/security-bulletin
ntainer: References: - http://www.securityfocus.com/bid/106306 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20249 State: PUBLISHED Published: 2018-12-24T19:00:00 Last Updated: 2024-08-05T11:58:19.146Z Vendors: n/a Products: Foxit Quick PDF Library Problem Types: CWE-787 Description: In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries using the DAOpenFile or DAOpenFileReadOnly functions may result in an access violation caused by out of bounds memory access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106306 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20250 State: PUBLISHED Published: 2019-02-05T20:00:00.000Z Last Updated: 2025-10-21T23:45:43.535Z Vendors: Check Point Software Technologies Ltd. Products: WinRAR Problem Types: CWE-36 Description: In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/blau72/CVE-2018-20250-WinRAR-ACE - https://research.checkpoint
- CISA ADP Vulnrichment: References: - https://github.com/blau72/CVE-2018-20250-WinRAR-ACE - https://research.checkpoint.com/extracting-code-execution-from-winrar/ - https://www.exploit-db.com/exploits/46552/ - http://www.securityfocus.com/bid/106948 - https://www.win-rar.com/whatsnew.html - http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html - http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace - https://www.exploit-db.com/exploits/46756/
CVE ID: CVE-2018-20251 State: PUBLISHED Published: 2019-02-05T20:00:00Z Last Updated: 2024-09-16T21:04:19.182Z Vendors: Check Point Software Technologies Ltd. Products: WinRAR Problem Types: CWE-693 Description: In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty fil
the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system. Additional Analyst Notes: - CVE Program Container: References: - https://research.checkpoint.com/extracting-code-execution-from-winrar/ - http://www.securityfocus.com/bid/106948 - https://www.win-rar.com/whatsnew.html
CVE ID: CVE-2018-20252 State: PUBLISHED Published: 2019-02-05T20:00:00Z Last Updated: 2024-09-16T18:24:07.685Z Vendors: Check Point Software Technologies Ltd. Products: WinRAR Problem Types: CWE-787 Description: In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user. Additional Analyst Notes: - CVE Program Container: References: - https://research.checkpoint.com/extracting-code-execution-from-winrar/ - http://www.securityfocus.com/bid/106948 - https://www.win-rar.com/whatsnew.html
CVE ID: CVE-2018-20253 State: PUBLISHED Published: 2019-02-13T01:00:00 Last Updated: 2024-08-05T11:58:19.154Z Vendors: Check Point Software Technologies Ltd. Products: WinRAR Problem Types: CWE-787 Description: In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user. Additional Analyst Notes: - CVE Program Container: References: - https://research.checkpoint.com/extracting-code-execution-from-winrar/ - https://www.win-rar.com/whatsnew.html
CVE ID: CVE-2018-20298 State: PUBLISHED Published: 2018-12-19T17:00:00Z Last Updated: 2024-09-16T19:05:26.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol. Additional Analyst Notes: - CVE Program Container: References: - https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-34/ - https://s3browser.com/news.aspx
CVE ID: CVE-2018-20299 State: PUBLISHED Published: 2018-12-19T22:00:00Z Last Updated: 2024-09-16T20:59:08.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow in the RCP+ parser of the web server. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/Advisory/BOSCH-2018-1203.html
CVE ID: CVE-2018-20300 State: PUBLISHED Published: 2018-12-20T00:00:00 Last Updated: 2024-08-05T11:58:18.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file. Additional Analyst Notes: - CVE Program Container: References: - http://p0desta.com/2018/12/19/empirecms%E6%9C%80%E6%96%B0%E7%89%88%E5%90%8E%E5%8F%B0%E5%A4%9A%E5%A4%84getshell/
CVE ID: CVE-2018-20301 State: PUBLISHED Published: 2018-12-20T09:00:00 Last Updated: 2024-08-05T11:58:18.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smpallen99/coherence/issues/270
CVE ID: CVE-2018-20302 State: PUBLISHED Published: 2018-12-20T00:00:00 Last Updated: 2024-08-05T11:58:18.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smpallen99/xain/issues/18 - https://github.com/dependabot/elixir-security-advisories/blob/master/packages/xain/2018-09-03.yml
CVE ID: CVE-2018-20303 State: PUBLISHED Published: 2018-12-20T00:00:00 Last Updated: 2024-08-05T11:58:18.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce - https://pentesterlab.com/exercises/cve-2018-18925/ - https://github.com/gogs/gogs/issues/5558
CVE ID: CVE-2018-20304 State: PUBLISHED Published: 2018-12-20T00:00:00 Last Updated: 2024-08-05T11:58:18.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argument. NOTE: this is not a Microsoft product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/devinsmith/libexcel/issues/9
CVE ID: CVE-2018-20305 State: PUBLISHED Published: 2018-12-20T00:00:00 Last Updated: 2024-08-05T11:58:19.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RootSoull/Vuln-Poc/tree/master/D-Link/DIR-816
CVE ID: CVE-2018-20306 State: PUBLISHED Published: 2018-12-20T09:00:00 Last Updated: 2024-08-05T11:58:18.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730
CVE ID: CVE-2018-20307 State: PUBLISHED Published: 2018-12-20T09:00:00 Last Updated: 2024-08-05T11:58:18.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730
CVE ID: CVE-2018-20309 State: PUBLISHED Published: 2021-01-07T16:54:52 Last Updated: 2024-08-05T11:58:19.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20310 State: PUBLISHED Published: 2021-01-07T16:56:48 Last Updated: 2024-08-05T11:58:18.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20311 State: PUBLISHED Published: 2021-01-07T16:58:11 Last Updated: 2024-08-05T11:58:19.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20312 State: PUBLISHED Published: 2021-01-07T17:01:56 Last Updated: 2024-08-05T11:58:18.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20313 State: PUBLISHED Published: 2021-01-07T17:03:18 Last Updated: 2024-08-05T11:58:19.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20314 State: PUBLISHED Published: 2021-01-07T17:04:20 Last Updated: 2024-08-05T11:58:18.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that can cause a stack-based buffer overflow or an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20315 State: PUBLISHED Published: 2021-01-07T17:05:41 Last Updated: 2024-08-05T11:58:19.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-based buffer overflow or an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20316 State: PUBLISHED Published: 2021-01-07T17:07:19 Last Updated: 2024-08-05T11:58:19.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-20318 State: PUBLISHED Published: 2018-12-21T00:00:00Z Last Updated: 2024-09-17T01:15:58.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Wechat-Group/weixin-java-tools/issues/889
CVE ID: CVE-2018-20320 State: REJECTED Published: 2019-11-06T14:57:14 Last Updated: 2019-11-06T14:57:14 Description: No description available.
CVE ID: CVE-2018-20321 State: PUBLISHED Published: 2019-04-10T13:59:44 Last Updated: 2024-08-05T11:58:18.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the default namespace in a separate project, where only cluster admins can be given permissions to access. As of 2018-12-20, this bug affected ALL clusters created or imported by Rancher. Additional Analyst Notes: - CVE Program Container:
2-20, this bug affected ALL clusters created or imported by Rancher. Additional Analyst Notes: - CVE Program Container: References: - https://rancher.com/blog/2019/2019-01-29-explaining-security-vulnerabilities-addressed-in-rancher-v2-1-6-and-v2-0-11/ - https://forums.rancher.com/c/announcements
CVE ID: CVE-2018-20322 State: PUBLISHED Published: 2018-12-21T22:00:00 Last Updated: 2024-08-05T11:58:18.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/commit/bfee69edaa0b90f97dc2d8fab09a87958cb32405 - https://bugs.limesurvey.org/view.php?id=14376
CVE ID: CVE-2018-20323 State: PUBLISHED Published: 2019-03-17T21:38:18 Last Updated: 2024-08-05T11:58:19.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151056/Mailcleaner-Remote-Code-Execution.html - https://pentest.blog/advisory-mailcleaner-community-edition-remote-code-execution/
CVE ID: CVE-2018-20325 State: PUBLISHED Published: 2018-12-21T22:00:00 Last Updated: 2024-08-05T11:58:19.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/danijar/definitions/issues/14
CVE ID: CVE-2018-20326 State: PUBLISHED Published: 2019-01-02T18:00:00 Last Updated: 2024-08-05T11:58:19.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage=html/index.html var:subpage parameter. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/TwNi05yfQks - http://packetstormsecurity.com/files/150918/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Scripting.html - https://0dayfindings.home.blog/2018/12/26/plc-wireless-router-gpn2-4p21-c-cn-reflected-xss/ - https://www.exploit-db.com/exploits/46081/
CVE ID: CVE-2018-20327 State: PUBLISHED Published: 2018-12-21T06:00:00 Last Updated: 2024-08-05T11:58:18.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits. Additional Analyst Notes: - CVE Program Container: References: - https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-32-2018-11-28-Low-risk-More-XSS-and-path-disclosure-issues - https://github.co
org/projects/1/wiki/Security_issues#Issue-32-2018-11-28-Low-risk-More-XSS-and-path-disclosure-issues - https://github.com/chamilo/chamilo-lms/commit/814049e5bd5317d761dda0ebbbc519cb2a64ab6c
CVE ID: CVE-2018-20328 State: PUBLISHED Published: 2018-12-21T06:00:00 Last Updated: 2024-08-05T11:58:18.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits. Additional Analyst Notes: - CVE Program Container: References: - https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-32-2018-11-28-Low-risk-More-XSS-and-path-disclosure-issues - https://github.com/chamilo/chamilo-lms/commit/
issues#Issue-32-2018-11-28-Low-risk-More-XSS-and-path-disclosure-issues - https://github.com/chamilo/chamilo-lms/commit/5e61c2b0fcc938ca687b8d4e593b1500aa52a034
CVE ID: CVE-2018-20329 State: PUBLISHED Published: 2018-12-21T06:00:00 Last Updated: 2024-08-05T11:58:18.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information. Additional Analyst Notes: - CVE Program Container: References: - https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-33-2018-12-13-Moderate-risk-high-impact-SQL-Injection - https://github.com/chamilo/chamilo-lms/commit/bfa1eccfabb457b800618d9d115f12dc614a55df