Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-18005 State: PUBLISHED Published: 2019-01-03T20:00:00 Last Updated: 2024-08-05T11:01:14.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vivotek-ip-camera-vulnerabilities-discovered-and-exploited-2e2531ecd244 - http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-006-v1.pdf
CVE ID: CVE-2018-18006 State: PUBLISHED Published: 2018-12-14T15:00:00 Last Updated: 2024-08-05T11:01:14.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150399/Ricoh-myPrint-Hardcoded-Credentials-Information-Disclosure.html - http://seclists.org/fulldisclosure/2018/Nov/46
CVE ID: CVE-2018-18007 State: PUBLISHED Published: 2018-12-21T23:00:00 Last Updated: 2024-08-05T11:01:14.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106337 - http://seclists.org/fulldisclosure/2018/Dec/38
CVE ID: CVE-2018-18008 State: PUBLISHED Published: 2018-12-21T23:00:00 Last Updated: 2024-08-05T11:01:14.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106344 - http://seclists.org/fulldisclosure/2018/Dec/45
CVE ID: CVE-2018-18009 State: PUBLISHED Published: 2018-12-21T23:00:00 Last Updated: 2024-08-05T11:01:14.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106336 - http://seclists.org/fulldisclosure/2018/Dec/46
CVE ID: CVE-2018-18013 State: PUBLISHED Published: 2018-10-24T21:00:00 Last Updated: 2024-08-05T11:01:14.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: * Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost. Additional Analyst Notes: - CVE Program Container: References
that limits access to configuration services to localhost. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/xen-mobile-vulnerable-to-code-execution-via-object-serialisation/
CVE ID: CVE-2018-18014 State: PUBLISHED Published: 2018-10-24T21:00:00 Last Updated: 2024-08-05T11:01:14.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: * Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.dxw.com/advisories/xen-mobile-backing-se
ISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.dxw.com/advisories/xen-mobile-backing-service-allows-unauthenticated-local-users-to-execute-system-commands-as-root/
CVE ID: CVE-2018-18016 State: PUBLISHED Published: 2018-10-05T17:00:00 Last Updated: 2024-08-05T11:01:14.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1049 - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-18017 State: PUBLISHED Published: 2019-04-15T20:24:56 Last Updated: 2024-08-05T11:01:15.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1rwN4hJkD5TJfCa16rsGwzYhzL-ODd2VLkFnPvAIq4Ys/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-and-sqli-in-slideshow-gallery.html
CVE ID: CVE-2018-18018 State: PUBLISHED Published: 2019-04-15T20:27:53 Last Updated: 2024-08-05T11:01:15.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1rwN4hJkD5TJfCa16rsGwzYhzL-ODd2VLkFnPvAIq4Ys/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-and-sqli-in-slideshow-gallery.html
CVE ID: CVE-2018-18019 State: PUBLISHED Published: 2019-04-15T20:29:31 Last Updated: 2024-08-05T11:01:14.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1rwN4hJkD5TJfCa16rsGwzYhzL-ODd2VLkFnPvAIq4Ys/edit?usp=sharing - https://ansawaf.blogspot.com/2019/04/xss-and-sqli-in-slideshow-gallery.html
CVE ID: CVE-2018-18020 State: PUBLISHED Published: 2018-10-06T00:00:00 Last Updated: 2024-08-05T11:01:14.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attackers to cause a denial of service via a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qpdf/qpdf/issues/243 - https://lists.debian.org/debian-lts-announce/2023/08/msg00037.html
CVE ID: CVE-2018-18021 State: PUBLISHED Published: 2018-10-07T06:00:00 Last Updated: 2024-08-05T11:01:14.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent
nsufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3821-1/ - https://github.com/torvalds/linux/commit/2a3f93459d689d990b3ecfbe782fec89b97d3279 - https://www.openwall.com/lists/oss-security/2018/10/02/2 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.12 - https://access.redhat.com/errata/RHSA-2018:3656 - https://github.com/torvalds/linux/commit/d26c25a9d19b5976b319af528886f89cf455692d - http://www.securityfocus.com/bid/105550 - https://usn.ubuntu.com/3821-2/ - http://git.kernel.org/cgit/linux/ker
55692d - http://www.securityfocus.com/bid/105550 - https://usn.ubuntu.com/3821-2/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2a3f93459d689d990b3ecfbe782fec89b97d3279 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d26c25a9d19b5976b319af528886f89cf455692d - https://www.debian.org/security/2018/dsa-4313 - https://usn.ubuntu.com/3931-1/ - https://usn.ubuntu.com/3931-2/
CVE ID: CVE-2018-18023 State: PUBLISHED Published: 2018-10-07T18:00:00 Last Updated: 2024-08-05T11:01:14.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1336 - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-18024 State: PUBLISHED Published: 2018-10-07T18:00:00 Last Updated: 2024-08-05T11:01:14.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1337 - https://usn.ubuntu.com/4034-1/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2018-18025 State: PUBLISHED Published: 2018-10-07T18:00:00 Last Updated: 2024-08-05T11:01:14.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/11/msg00014.html - https://github.com/ImageMagick/ImageMagick/issues/1335 - https://usn.ubuntu.com/4034-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2018-18026 State: PUBLISHED Published: 2018-10-19T22:00:00 Last Updated: 2024-08-05T11:01:14.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: IMFCameraProtect.sys in IObit Malware Fighter 6.2 (and possibly lower versions) is vulnerable to a stack-based buffer overflow. The attacker can use DeviceIoControl to pass a user specified size which can be used to overwrite return addresses. This can lead to a denial of service or code execution attack. Additional Analyst Notes: - CVE Program Container: References: - https://downwithup.github.io/CVEPosts.html
CVE ID: CVE-2018-18029 State: PUBLISHED Published: 2018-10-09T15:00:00 Last Updated: 2024-08-05T11:01:14.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Navigate CMS has Stored XSS via the navigate.php Title field in an edit action. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/navigatecms/navigatecms/commits/586e67ce1c43d459f6b00221fb30be26fcbfb866 - https://bitbucket.org/navigatecms/navigatecms/issues/3/stored-xss-in-navigatecms
CVE ID: CVE-2018-18035 State: PUBLISHED Published: 2019-04-02T21:44:13 Last Updated: 2024-08-05T11:01:15.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://www.purplemet.com/blog/openemr-xss-vulnerability
CVE ID: CVE-2018-18056 State: PUBLISHED Published: 2019-08-20T16:22:18 Last Updated: 2024-08-05T11:01:15.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Texas Instruments (TI) TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory (XOM) implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in XOM-protected flash memory. As a consequence, it is possible to execute single instructions with arbitrary system states (e.g., registers, status flags, and SRAM content) and observe the state changes produced by the unknown instruction. An attacker c
isters, status flags, and SRAM content) and observe the state changes produced by the unknown instruction. An attacker could exploit this vulnerability by executing protected and unknown instructions with specific system states and observing the state changes. Based on the gathered information, it is possible to reverse-engineer the executed instructions. The processor acts as a kind of "instruction oracle." Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/woot19-paper_schink.pdf - https://www.usenix.org/conference/woot19/presentation/schink
CVE ID: CVE-2018-18058 State: PUBLISHED Published: 2019-05-24T16:56:11 Last Updated: 2024-08-05T11:01:14.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bitdefender Engines before 7.76662. A vulnerability has been discovered in the iso.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a division-by-zero circumstance. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdef
cious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/ - https://www.bitdefender.com/support/security-advisories/bitdefender-iso-xmd-iso-parsing-bounds-read-vulnerability/
CVE ID: CVE-2018-18059 State: PUBLISHED Published: 2019-05-24T16:54:14 Last Updated: 2024-08-05T11:01:14.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bitdefender Engines before 7.76675. A vulnerability has been discovered in the rar.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https:/
isit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/ - https://www.bitdefender.com/support/security-advisories/bitdefender-rar-xmd-rar-parsing-bounds-read-vulnerability/
CVE ID: CVE-2018-18060 State: PUBLISHED Published: 2019-05-24T16:51:45 Last Updated: 2024-08-05T11:01:14.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bitdefender Engines before 7.76808. A vulnerability has been discovered in the dalvik.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - http
t visit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/ - https://www.bitdefender.com/support/security-advisories/bitdefender-dalvik-xmd-apk-parsing-bounds-read-vulnerability/
CVE ID: CVE-2018-18061 State: PUBLISHED Published: 2018-10-10T21:00:00 Last Updated: 2024-08-05T11:01:14.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. Attackers can access the file manager interface that provides them with the ability to upload and delete files. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2018/Oct/25
CVE ID: CVE-2018-18062 State: PUBLISHED Published: 2018-10-10T21:00:00 Last Updated: 2024-08-05T11:01:14.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. A reflected XSS vulnerability allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2018/Oct/26
CVE ID: CVE-2018-18064 State: PUBLISHED Published: 2018-10-08T18:00:00 Last Updated: 2024-08-05T11:01:14.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function). Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/cairo/cairo/issues/341 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.a
ues/341 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE ID: CVE-2018-18065 State: PUBLISHED Published: 2018-10-08T18:00:00 Last Updated: 2024-08-05T11:01:14.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/net-snmp/code/ci/7ffb8e25a0db851953155de91f0170e9bf8c457d/ - https://www.exploit-db.com/exploits/45547/ - https://usn.ubuntu.com/3792-1/ - https://dumpco.re/blog/net-snmp-5.7.3-remote-dos - https:
loit-db.com/exploits/45547/ - https://usn.ubuntu.com/3792-1/ - https://dumpco.re/blog/net-snmp-5.7.3-remote-dos - https://security.netapp.com/advisory/ntap-20181107-0001/ - https://usn.ubuntu.com/3792-2/ - https://usn.ubuntu.com/3792-3/ - https://www.debian.org/security/2018/dsa-4314 - http://www.securityfocus.com/bid/106265 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://cert-portal.siemens.com/productcert/pdf/ssa-978220.pdf - https://security.paloaltonetworks.com/CVE-2018-18065
CVE ID: CVE-2018-18066 State: PUBLISHED Published: 2018-10-08T18:00:00.000Z Last Updated: 2025-05-06T14:41:28.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/net-snmp/code/ci/7ffb8e25a0db851953155de91f0170e9bf8c457d/ - https://dumpco.re/blog/net-snmp-5.7.3-remote-dos - https://security.netapp.com/advisory/ntap-20181107-0001/
bf8c457d/ - https://dumpco.re/blog/net-snmp-5.7.3-remote-dos - https://security.netapp.com/advisory/ntap-20181107-0001/ - https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/ - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
CVE ID: CVE-2018-18068 State: PUBLISHED Published: 2019-04-04T19:13:46 Last Updated: 2024-08-05T11:01:14.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other devices allows non-secure EL1 code to read/write any EL3 (the highest privilege level in ARMv8) memory/register via inter-processor debugging. With a debug host processor A running in non-secure EL1 and a debug target processor B running in any privilege level, the debugging feature allows A to halt B and promote B to any privilege level. As a debug host, A has full control of B even if B owns a higher privilege level than A. Accordingly,
privilege level. As a debug host, A has full control of B even if B owns a higher privilege level than A. Accordingly, A can read/write any EL3 memory/register via B. Also, with this memory access, A can execute arbitrary code in EL3. Additional Analyst Notes: - CVE Program Container: References: - https://www.computer.org/csdl/proceedings-article/sp/2019/666000b157/17D45WHONhv - http://www.cs.wayne.edu/fengwei/paper/nailgun-sp19.pdf
CVE ID: CVE-2018-18069 State: PUBLISHED Published: 2018-10-08T22:00:00 Last Updated: 2024-08-05T11:01:14.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://0x62626262.wordpress.com/2018/10/08/sitepress-multilingual-cms-plugin-unauthenticated-stored-xss/
CVE ID: CVE-2018-18070 State: PUBLISHED Published: 2018-10-09T09:00:00Z Last Updated: 2024-09-17T02:16:59.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Daimler Mercedes-Benz COMAND 17/13.0 50.12 on Mercedes-Benz C-Class 2018 vehicles. Defining or receiving a specific navigation route might cause the system to freeze and reboot after a few transmissions. When the system next starts, it tries to re-calculate the route, which will cause a boot loop. (Under certain circumstances, it is possible to quickly overwrite the malicious route to regain the stability of the system.) Additional Analyst Notes: - CVE Program Container: References: - https://vuldb
e to regain the stability of the system.) Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.125080
CVE ID: CVE-2018-18071 State: PUBLISHED Published: 2018-10-09T09:00:00Z Last Updated: 2024-09-17T02:32:27.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted Connected Vehicle API data exchange between the app and a server might be intercepted. The app can be used to operate the Remote Parking Pilot, unlock the vehicle, or obtain sensitive information such as latitude, longitude, and direction of travel. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.125081 - https://www.scip.ch/en/?labs.20180405