Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-18882 State: PUBLISHED Published: 2019-03-17T21:10:38 Last Updated: 2024-08-05T11:23:08.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module 1.05 with firmware revision v1.05. An authenticated user can inject arbitrary script via setup.html in the web interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106655 - https://applied-risk.com/labs/advisories
CVE ID: CVE-2018-18883 State: PUBLISHED Published: 2018-11-01T00:00:00 Last Updated: 2024-08-05T11:23:08.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-278.html - http://www.securitytracker.com/id/1042021 - http://www.securityfocus.com/bid/105817
CVE ID: CVE-2018-18886 State: PUBLISHED Published: 2019-06-18T13:08:35 Last Updated: 2024-08-05T11:23:08.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Helpy v2.1.0 has Stored XSS via the Ticket title. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/helpyio/helpy - https://github.com/helpyio/helpy/releases/tag/2.2.0
CVE ID: CVE-2018-18887 State: PUBLISHED Published: 2018-11-01T01:00:00Z Last Updated: 2024-09-16T18:17:55.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field). Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/75/
CVE ID: CVE-2018-18888 State: PUBLISHED Published: 2018-11-01T01:00:00Z Last Updated: 2024-09-16T16:58:59.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in laravelCMS through 2018-04-02. \app\Http\Controllers\Backend\ProfileController.php allows upload of arbitrary PHP files because the file extension is not properly checked and uploaded files are not properly renamed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Leslie1sMe/laravelCMS/issues/4
CVE ID: CVE-2018-18890 State: PUBLISHED Published: 2018-11-01T01:00:00Z Last Updated: 2024-09-16T18:23:51.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename. Additional Analyst Notes: - CVE Program Container: References: - https://www.patec.cn/newsshow.php?cid=24&id=135 - https://github.com/AvaterXXX/MiniCms/blob/master/Authentication%20and%20Information%20Exposure.md#information-exposure
CVE ID: CVE-2018-18891 State: PUBLISHED Published: 2018-11-01T01:00:00Z Last Updated: 2024-09-17T01:36:31.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/MiniCms/blob/master/Authentication%20and%20Information%20Exposure.md#authentication-vulnerability - https://www.patec.cn/newsshow.php?cid=24&id=135
CVE ID: CVE-2018-18892 State: PUBLISHED Published: 2018-11-01T01:00:00Z Last Updated: 2024-09-17T03:23:01.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.patec.cn/newsshow.php?cid=24&id=135 - https://github.com/AvaterXXX/MiniCms/blob/master/Command%20Execution.md
CVE ID: CVE-2018-18893 State: PUBLISHED Published: 2019-01-03T01:00:00 Last Updated: 2024-08-05T11:23:08.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HubSpot/jinjava/blob/master/CHANGES.md - https://github.com/HubSpot/jinjava/pull/230
CVE ID: CVE-2018-18894 State: PUBLISHED Published: 2020-03-10T12:50:09 Last Updated: 2024-08-05T11:23:08.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server. Additional Analyst Notes: - CVE Program Container: References: - http://support.lexmark.com/alerts - http://support.lexmark.com/index?page=content&id=TE906&locale=EN&userlocale=EN_US
CVE ID: CVE-2018-18895 State: REJECTED Published: 2019-02-12T18:00:00 Last Updated: 2019-02-12T17:57:01 Description: No description available.
CVE ID: CVE-2018-18897 State: PUBLISHED Published: 2018-11-02T06:00:00 Last Updated: 2024-08-05T11:23:08.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/654 - https://usn.ubuntu.com/4042-1/ - https://access.redhat.com/errata/RHSA-2019:2022 - https://access.redhat.com/errata/RHSA-2019:2713 - https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html
CVE ID: CVE-2018-18898 State: PUBLISHED Published: 2019-03-17T21:16:19 Last Updated: 2024-08-05T11:23:08.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/ - https://bes
ect.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/ - https://bestpractical.com/download-page - https://lists.debian.org/debian-lts-announce/2020/02/msg00009.html - https://usn.ubuntu.com/4517-1/
CVE ID: CVE-2018-18903 State: PUBLISHED Published: 2018-11-03T05:00:00 Last Updated: 2024-08-05T11:23:08.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vanilla 2.6.x before 2.6.4 allows remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://srcincite.io/blog/2018/10/02/old-school-pwning-with-new-school-tricks-vanilla-forums-remote-code-execution.html - https://github.com/vanilla/vanilla/releases/tag/Vanilla_2.6.4 - https://open.vanillaforums.com/discussion/36771/security-update-vanilla-2-6-4
CVE ID: CVE-2018-18907 State: PUBLISHED Published: 2022-06-16T21:32:01 Last Updated: 2024-08-05T11:23:08.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-850L 1.21WW devices. A partially completed WPA handshake is sufficient for obtaining full access to the wireless network. A client can access the network by sending packets on Data Frames to the AP without encryption. Additional Analyst Notes: - CVE Program Container: References: - http://us.dlink.com/security-advisories/ - https://www.synopsys.com/blogs/software-security/wpa2-encryption-bypass-defensics-fuzzing/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?nam
y/wpa2-encryption-bypass-defensics-fuzzing/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10097
CVE ID: CVE-2018-18908 State: PUBLISHED Published: 2019-01-19T18:00:00 Last Updated: 2024-08-05T11:23:08.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle (MiTM) attacks, whereby an attacker would be able to obtain the data sent in these requests. Some of the requests contain potentially sensitive information that could be useful to an attacker, such as the victim's Sky username. Additional Analyst Notes: - CVE Program Container: References: - https://blog.sean-wright.com/sky/
CVE ID: CVE-2018-18909 State: PUBLISHED Published: 2018-11-03T16:00:00 Last Updated: 2024-08-05T11:23:08.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yaniswang/xhEditor/issues/37
CVE ID: CVE-2018-18912 State: PUBLISHED Published: 2019-05-13T19:05:44 Last Updated: 2024-08-05T11:23:08.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Easy File Sharing (EFS) Web Server 7.2. A stack-based buffer overflow vulnerability occurs when a malicious POST request has been made to forum.ghp upon creating a new topic in the forums, which allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/notkisi/CVE-s/blob/master/CVE-2018-18912.py
CVE ID: CVE-2018-18913 State: PUBLISHED Published: 2019-03-21T21:06:16 Last Updated: 2024-08-05T11:23:08.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location within the system. The issue lies in the loading of the shcore.dll and dcomp.dll files: these files are being searched for by the program in the same system-wide directory where the HTML file is executed. Additional Analyst Notes: - CV
hed for by the program in the same system-wide directory where the HTML file is executed. Additional Analyst Notes: - CVE Program Container: References: - https://lucideustech.blogspot.com/2019/02/opera-search-order-hijacking-cve-2018-18913.html - https://blogs.opera.com/desktop/changelog-for-57/
CVE ID: CVE-2018-18915 State: PUBLISHED Published: 2018-11-03T04:00:00 Last Updated: 2024-08-05T11:23:08.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted input will lead to a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/511 - https://access.redhat.com/errata/RHSA-2019:2101
CVE ID: CVE-2018-18919 State: PUBLISHED Published: 2018-11-04T04:00:00Z Last Updated: 2024-09-17T00:57:00.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JaxsonWang/WP-Editor.md/issues/275
CVE ID: CVE-2018-18920 State: PUBLISHED Published: 2018-11-12T02:00:00 Last Updated: 2024-08-05T11:23:08.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid." Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/AlexanderFisher/status/1060923428641878019 - https://github.com/ethereum/py-evm/issues/1448 - https://twitter.
itter.com/AlexanderFisher/status/1060923428641878019 - https://github.com/ethereum/py-evm/issues/1448 - https://twitter.com/NettaLab/status/1060889400102383617 - https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/
CVE ID: CVE-2018-18921 State: PUBLISHED Published: 2018-12-18T22:00:00 Last Updated: 2024-08-05T11:23:08.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/bugbountywriteup/cve-2018-18921-php-server-monitor-3-3-1-cross-site-request-forgery-a73e8dae563 - https://github.com/phpservermon/phpservermon/issues/670
CVE ID: CVE-2018-18922 State: PUBLISHED Published: 2018-12-13T19:00:00 Last Updated: 2024-08-05T11:23:08.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45892 - https://0day.today/exploit/31658 - https://medium.com/%40javierolmedo/cve-2018-18922-ticketly-1-0-privilege-escalation-add-admin-4d1b3696f367 - https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/
CVE ID: CVE-2018-18923 State: PUBLISHED Published: 2018-12-13T19:00:00 Last Updated: 2024-08-05T11:23:08.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category_id and description in action/addproject.php; kind_id, priority_id, project_id, status_id and title in action/addticket.php; and kind_id and status_id in reports.php. Additional Analyst Notes: - CVE Program Container: References: - https://hackpuntes.com/cve-2018-18923-ticketly-1-0-multiples-sql-injections/ - https://www.exploit-db.com/exploits/45902/
CVE ID: CVE-2018-18924 State: PUBLISHED Published: 2018-11-04T06:00:00 Last Updated: 2024-08-05T11:23:08.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "#exec cmd" because rejected files remain on the server, with predictable filenames, after a "This file is not a valid image" error message. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45680/ - https://pentest.com.tr/exploits/ProjeQtOr-Project-Management-Tool-7-2-5-Remote-Code-Execution.html
CVE ID: CVE-2018-18925 State: PUBLISHED Published: 2018-11-04T06:00:00 Last Updated: 2024-08-05T11:23:08.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gogs/gogs/issues/5469
CVE ID: CVE-2018-18926 State: PUBLISHED Published: 2018-11-04T06:00:00 Last Updated: 2024-08-05T11:23:08.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-gitea/gitea/issues/5140
CVE ID: CVE-2018-18927 State: PUBLISHED Published: 2018-11-04T06:00:00 Last Updated: 2024-08-05T11:23:08.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sanluan/PublicCMS/issues/22
CVE ID: CVE-2018-18928 State: PUBLISHED Published: 2018-11-04T20:00:00Z Last Updated: 2024-09-17T03:02:41.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/unicode-org/icu/commit/53d8c8f3d181d87a6aa925b449b51c4a2c922a51 - https://unicode-org.atlassian.net/browse/ICU-20246 - https://bugs.chromium.org/p/chromium/issues/detail?id=900059
CVE ID: CVE-2018-18929 State: PUBLISHED Published: 2019-10-29T19:33:33 Last Updated: 2024-08-05T11:23:08.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username and password can leverage it to gain administrator-level access on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/
CVE ID: CVE-2018-18930 State: PUBLISHED Published: 2019-10-29T19:35:20 Last Updated: 2024-08-05T11:23:08.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. An authenticated attacker can upload a crafted ZIP file (based on an exported backup of existing "Bulletins") containing a malicious file. When uploaded, the system only checks for the presence of the needed files within the ZIP and, as long as the malicious file is named properly, will extract all contained files to a new d
d files within the ZIP and, as long as the malicious file is named properly, will extract all contained files to a new directory on the system, named with a random GUID. The attacker can determine this GUID by previewing an image from the uploaded Bulletin within the web UI. Once the GUID is determined, the attacker can navigate to the malicious file and execute it. In testing, an ASPX web shell was uploaded, allowing for remote-code execution in the context of a restricted IIS user. Additional Analyst Notes: - CVE Program Container: References: - https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/
CVE ID: CVE-2018-18931 State: PUBLISHED Published: 2019-10-29T19:36:40 Last Updated: 2024-08-05T11:23:08.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permissions on the C:\TRMS\Services directory, an attacker who has gained access to the system can elevate their privileges from a restricted account to full SYSTEM by replacing the Carousel.Service.exe file with a custom malicious executable. This service is independent of the associated IIS web site, which means that this service can be manipulated by an attacker without losing access to vulnerabilities in the
b site, which means that this service can be manipulated by an attacker without losing access to vulnerabilities in the web interface (which would potentially be used in conjunction with this attack, to control the service). Once the attacker has replaced Carousel.Service.exe, the server can be restarted using the command "shutdown -r -t 0" from a web shell, causing the system to reboot and launching the malicious Carousel.Service.exe as SYSTEM on startup. If this malicious Carousel.Service.exe is configured to launch a reverse shell back to the attacker, then upon reboot the attacker will have a fully privileged remote command-line environment to manipulate the system further. Additional An
he attacker will have a fully privileged remote command-line environment to manipulate the system further. Additional Analyst Notes: - CVE Program Container: References: - https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/
CVE ID: CVE-2018-18933 State: PUBLISHED Published: 2018-11-05T08:00:00 Last Updated: 2024-08-05T11:23:08.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader!safe_vsnprintf+0x00000000002c4330" issue. Additional Analyst Notes: - CVE Program Container: References: - https://yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/ - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/1
yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/ - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/02/2018/11/2018-11-02/index.html - https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/
CVE ID: CVE-2018-18934 State: PUBLISHED Published: 2018-11-05T08:00:00 Last Updated: 2024-08-05T11:23:08.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code (that is extracted and can be executed). This can also be exploited via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PopojiCMS/PopojiCMS/issues/12 - https://github.com/PopojiCMS/PopojiCMS/issues/13
CVE ID: CVE-2018-18935 State: PUBLISHED Published: 2018-11-05T08:00:00 Last Updated: 2024-08-05T11:23:08.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PopojiCMS/PopojiCMS/issues/14
CVE ID: CVE-2018-18936 State: PUBLISHED Published: 2018-11-05T08:00:00 Last Updated: 2024-08-05T11:23:08.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PopojiCMS v2.0.1. admin_library.php allows remote attackers to delete arbitrary files via directory traversal in the po-admin/route.php?mod=library&act=delete id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PopojiCMS/PopojiCMS/issues/15
CVE ID: CVE-2018-18937 State: PUBLISHED Published: 2018-11-05T08:00:00 Last Updated: 2024-08-05T11:23:08.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in ClientDataSet_getValues in client/ied_connection.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fouzhe/security/tree/master/libiec61850#segv-in-function-clientdataset_getvalues - https://github.com/mz-automation/libiec61850/issues/82
CVE ID: CVE-2018-18938 State: PUBLISHED Published: 2018-11-05T08:00:00 Last Updated: 2024-08-05T11:23:08.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/158