Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-8635 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:25.868Z Vendors: Microsoft Products: Microsoft SharePoint Server, Microsoft SharePoint Problem Types: Elevation of Privilege Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server, aka "Microsoft SharePoint Server Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106121 - https://portal.msrc.microsoft.com/
tes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106121 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8635
CVE ID: CVE-2018-8636 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:25.859Z Vendors: Microsoft Products: Microsoft Office, Office, Microsoft Excel Problem Types: Remote Code Execution Description: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel. This CVE ID is unique from CVE-2018-8597. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8636 - http://www.securit
ner: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8636 - http://www.securityfocus.com/bid/106101
CVE ID: CVE-2018-8637 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:25.868Z Vendors: Microsoft Products: Windows 10 Servers, Windows 10, Windows Server 2019 Problem Types: Information Disclosure Description: An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass, aka "Win32k Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8637
- CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8637 - http://www.securityfocus.com/bid/106095
CVE ID: CVE-2018-8638 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:25.818Z Vendors: Microsoft Products: Windows 10, Windows Server 2019 Problem Types: Information Disclosure Description: An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulnerability." This affects Windows 10, Windows Server 2019. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8638 - http://www.securityfocus.com/bid/106089
CVE ID: CVE-2018-8639 State: PUBLISHED Published: 2018-12-12T00:00:00.000Z Last Updated: 2025-10-21T23:45:46.009Z Vendors: Microsoft Products: Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers Problem Types: Elevation of Privilege, Information Disclosure Description: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server
ege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/106093 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639
CVE ID: CVE-2018-8641 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:26.064Z Vendors: Microsoft Products: Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers Problem Types: Elevation of Privilege Description: An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Serve
This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8639. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8641 - http://www.securityfocus.com/bid/106090
CVE ID: CVE-2018-8643 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:25.908Z Vendors: Microsoft Products: Internet Explorer 9, Internet Explorer 11, Internet Explorer 10 Problem Types: Remote Code Execution Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106117 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8
http://www.securityfocus.com/bid/106117 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8643
CVE ID: CVE-2018-8649 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:25.967Z Vendors: Microsoft Products: Windows 10, Windows Server 2019 Problem Types: Denial of Service Description: A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." This affects Windows 10, Windows Server 2019. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8649 - http://www.securityfocus.com/bid/106091
CVE ID: CVE-2018-8650 State: PUBLISHED Published: 2018-12-12T14:00:00.000Z Last Updated: 2025-02-28T20:14:50.820Z Vendors: Microsoft Products: Microsoft SharePoint Problem Types: Spoofing Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8650 - http://www.securityfocus.com/bid/106170
CVE ID: CVE-2018-8651 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:25.924Z Vendors: Microsoft Products: Microsoft Dynamics NAV Problem Types: Spoofing Description: A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106077 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8651
CVE ID: CVE-2018-8652 State: PUBLISHED Published: 2018-12-12T00:00:00 Last Updated: 2024-08-05T07:02:26.096Z Vendors: Microsoft Products: Windows Azure Pack Rollup 13.1 Problem Types: Remote Code Execution Description: A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8652 - http://www.securityfocus.com/bid/106155
CVE ID: CVE-2018-8653 State: PUBLISHED Published: 2018-12-20T13:00:00.000Z Last Updated: 2025-10-21T23:45:45.766Z Vendors: Microsoft Products: Internet Explorer 9, Internet Explorer 11, Internet Explorer 10 Problem Types: Remote Code Execution Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8643. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/securit
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8653 - http://www.securityfocus.com/bid/106255
CVE ID: CVE-2018-8654 State: PUBLISHED Published: 2020-01-24T20:50:24 Last Updated: 2024-08-05T07:02:25.965Z Vendors: Microsoft Products: Microsoft Dynamics 365 (on-premises) version 8 Problem Types: Elevation of Privilege Description: An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'. Additional Analyst Notes: - CVE Program Container: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8654
CVE ID: CVE-2018-8661 State: REJECTED Published: N/A Last Updated: 2023-05-30T00:00:00 Description: No description available.
CVE ID: CVE-2018-8710 State: PUBLISHED Published: 2018-03-14T19:00:00Z Last Updated: 2024-09-16T16:27:32.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive. Additional Analyst Notes: - CVE Program Container: References: - http
t evaluate shortcodes as they are often sensitive. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/woocommerce-products-filter/#developers - https://sec-consult.com/en/blog/advisories/arbitrary-shortcode-execution-local-file-inclusion-in-woof-pluginus-net/index.html - https://www.woocommerce-filter.com/update-woocommerce-products-filter-v-2-2-0/
CVE ID: CVE-2018-8711 State: PUBLISHED Published: 2018-03-14T19:00:00Z Last Updated: 2024-09-17T02:06:59.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack. Additional Analyst Notes: - CVE Program
the $pagepath variable, which then could lead to a local file inclusion attack. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/woocommerce-products-filter/#developers - https://sec-consult.com/en/blog/advisories/arbitrary-shortcode-execution-local-file-inclusion-in-woof-pluginus-net/index.html - https://www.woocommerce-filter.com/update-woocommerce-products-filter-v-2-2-0/
CVE ID: CVE-2018-8712 State: PUBLISHED Published: 2018-03-14T19:00:00Z Last Updated: 2024-09-17T00:37:20.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request. Additional Analyst Notes: - CVE Program Container: References: - https://www.7elements.co
w=1&file=/etc/shadow" request. Additional Analyst Notes: - CVE Program Container: References: - https://www.7elements.co.uk/resources/technical-advisories/webmin-1-840-1-880-unrestricted-access-arbitrary-files-using-local-file-include/
CVE ID: CVE-2018-8714 State: PUBLISHED Published: 2018-05-17T19:00:00 Last Updated: 2024-08-05T07:02:25.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell MatrikonOPC OPC Controller before 5.1.0.0 allows local users to transfer arbitrary files from a host computer and consequently obtain sensitive information via vectors related to MSXML libraries. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104157 - https://ics-cert.us-cert.gov/advisories/ICSA-18-130-01 - https://www.opcsupport.com/s/article/SECURITY-NOTIFICATION-OPC-Explorer-SN-2017-04-27-01
CVE ID: CVE-2018-8715 State: PUBLISHED Published: 2018-03-14T20:00:00 Last Updated: 2024-08-05T07:02:25.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/embedthis/appweb/issues/610 - https://blogs.securiteam.com/index.php/archives/3676 - https://security.paloaltonetworks.com/CVE-2018-8715
CVE ID: CVE-2018-8716 State: PUBLISHED Published: 2018-04-25T20:00:00 Last Updated: 2024-08-05T07:02:26.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/en/blog/advisories/multiple-stored-xss-vulnerabilities-in-wso2-carbon-and-dashboard-server/index.html - http://seclists.org/fulldisclosure/2018/Apr/45 - http://packetstormsecurity.com/files/147330/WSO2-Identity-Server-5.3.0-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/44531/ - http://www.securityfocus.com/archiv
erver-5.3.0-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/44531/ - http://www.securityfocus.com/archive/1/541954/100/0/threaded
CVE ID: CVE-2018-8717 State: PUBLISHED Published: 2018-03-14T20:00:00 Last Updated: 2024-08-05T07:02:25.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/419
CVE ID: CVE-2018-8718 State: PUBLISHED Published: 2018-03-27T16:00:00 Last Updated: 2024-08-05T07:02:26.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/ - http://www.openwall.com/lists/oss-security/2018/03/26/3 - https://www.exploit-db.com/exploits/44843/ - http://www.securityfocus.com/bid/103691
CVE ID: CVE-2018-8719 State: PUBLISHED Published: 2018-04-04T19:00:00 Last Updated: 2024-08-05T07:02:25.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44371/
CVE ID: CVE-2018-8720 State: PUBLISHED Published: 2018-03-15T13:00:00 Last Updated: 2024-08-05T07:02:26.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka search_results.do). Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/137427/ServiceNow-ITSM-Cross-Site-Scripting.html
CVE ID: CVE-2018-8721 State: PUBLISHED Published: 2018-03-15T04:00:00 Last Updated: 2024-08-05T07:02:25.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103424 - https://pitstop.manageengine.com/portal/community/topic/manageengine-eventlog-analyzer-11-0-build-11000-stored-cross-site-scripting-attack
CVE ID: CVE-2018-8722 State: PUBLISHED Published: 2018-03-15T04:00:00 Last Updated: 2024-08-05T07:02:26.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/cross-site-scripting-vulnerability.html
CVE ID: CVE-2018-8724 State: PUBLISHED Published: 2021-01-11T15:34:26 Last Updated: 2024-08-05T07:02:26.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr.exe. Additional Analyst Notes: - CVE Program Container: References: - http://k7computing.com - http://k7antivirus.com - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE ID: CVE-2018-8725 State: PUBLISHED Published: 2021-01-11T15:35:19 Last Updated: 2024-08-05T07:02:26.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe. Additional Analyst Notes: - CVE Program Container: References: - http://k7computing.com - http://k7antivirus.com - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE ID: CVE-2018-8726 State: PUBLISHED Published: 2021-01-11T15:35:52 Last Updated: 2024-08-05T07:02:26.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe. Additional Analyst Notes: - CVE Program Container: References: - http://k7computing.com - http://k7antivirus.com - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021
CVE ID: CVE-2018-8727 State: PUBLISHED Published: 2018-06-19T19:00:00 Last Updated: 2024-08-05T07:02:26.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows an attacker to traverse the file system to access files or directories via the Web Client webserver. Additional Analyst Notes: - CVE Program Container: References: - https://www.onvio.nl/nieuws/cve-mirasys-vulnerability
CVE ID: CVE-2018-8728 State: PUBLISHED Published: 2018-03-15T15:00:00Z Last Updated: 2024-09-16T23:00:51.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: server/app/views/static/code.html in Kontena before 1.5.0 allows XSS in "kontena master login --remote" code display, as demonstrated by /code#code= in a URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kontena/kontena/pull/3223 - https://lgtm.com/projects/g/kontena/kontena/rev/06a7a06e65a5ef0dada14faee2ae20388b87c1fe - https://github.com/kontena/kontena/releases/tag/v1.5.0
CVE ID: CVE-2018-8729 State: PUBLISHED Published: 2018-03-15T17:00:00 Last Updated: 2024-11-14T20:48:12.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pojome/activity-log/commit/950c46b2290c991187ff3471640e9688b16908fb - https://plugins.trac.wordpress.org/changeset/1836276 - https://www.exploit-db.com/exploits/44437/ - https://github.com/pojome/activity-log/commit/e7bcd1
rg/changeset/1836276 - https://www.exploit-db.com/exploits/44437/ - https://github.com/pojome/activity-log/commit/e7bcd12fcb0add82bed762a971f427a360664bd9 - https://wordpress.org/plugins/aryo-activity-log/#developers
CVE ID: CVE-2018-8732 State: PUBLISHED Published: 2018-03-19T20:00:00 Last Updated: 2024-08-05T07:02:25.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the virtual_del parameter. Additional Analyst Notes: - CVE Program Container: References: - http://forum.wampserver.com/read.php?2%2C138295%2C150615%2Cpage=6#msg-150615 - https://www.exploit-db.com/exploits/44384/
CVE ID: CVE-2018-8733 State: PUBLISHED Published: 2018-04-18T00:00:00 Last Updated: 2024-08-05T07:02:26.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f - https://www.exploit-db.com/exploits/44560/ - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://blog.redactedsec.net/exploits/2018/04/26/nagios.html - h
ttps://www.nagios.com/downloads/nagios-xi/change-log/ - https://blog.redactedsec.net/exploits/2018/04/26/nagios.html - https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT - https://www.exploit-db.com/exploits/44969/