Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-11350 State: PUBLISHED Published: 2018-07-07T17:00:00 Last Updated: 2024-08-05T08:01:53.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Jirafeau before 3.4.1. The file "search by name" form is affected by one Cross-Site Scripting vulnerability via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/06/jirafeau-version-3-3-0-multiple-vulnerabilities/
CVE ID: CVE-2018-11351 State: PUBLISHED Published: 2018-07-07T17:00:00 Last Updated: 2024-08-05T08:10:13.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These two injections could be triggered without authentication, and target the administrator. The attack vectors are the Content-Type field and the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com
d and the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/06/jirafeau-version-3-3-0-multiple-vulnerabilities/
CVE ID: CVE-2018-11352 State: PUBLISHED Published: 2018-09-21T16:00:00 Last Updated: 2024-08-05T08:10:13.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/09/wallabag-2-2-3-to-2-3-2-stored-cross-site-s
CVE Program Container: References: - https://www.bishopfox.com/news/2018/09/wallabag-2-2-3-to-2-3-2-stored-cross-site-scripting/
CVE ID: CVE-2018-11354 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104308 - https://www.wireshark.org/security/wnpa-sec-2018-26.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=cb517a4a434387e74a2f75ebb106ee3c3893251c - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14647 - http://www.securitytrac
4a434387e74a2f75ebb106ee3c3893251c - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14647 - http://www.securitytracker.com/id/1041036 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11355 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for packet status chunks. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2018-27.html - http://www.securityfocus.com/bid/104308 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14673 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=99d27a5fd2c540f837154aca3b3647f5ccfa0c33 - http://www.securitytracker.com
g/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=99d27a5fd2c540f837154aca3b3647f5ccfa0c33 - http://www.securitytracker.com/id/1041036 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11356 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2018-29.html - http://www.securityfocus.com/bid/104308 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=4425716ddba99374749bd033d9bc0f4add2fb973 - https://bugs.wireshark.org/bugzilla/
ew/gitweb?p=wireshark.git%3Ba=commit%3Bh=4425716ddba99374749bd033d9bc0f4add2fb973 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14681 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html - http://www.securitytracker.com/id/1041036 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11357 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104308 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14678 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=ab8a33ef083b9732c89117747a83
_bug.cgi?id=14678 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=ab8a33ef083b9732c89117747a83a905a676faf6 - https://www.wireshark.org/security/wnpa-sec-2018-28.html - http://www.securitytracker.com/id/1041036 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11358 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2018-31.html - http://www.securityfocus.com/bid/104308 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14689 - https://www.debian.org/security/2018/dsa-4217 - https://code.wireshark.org/review/
.org/bugzilla/show_bug.cgi?id=14689 - https://www.debian.org/security/2018/dsa-4217 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=ccb1ac3c8cec47fbbbf2e80ced80644005c65252 - https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html - http://www.securitytracker.com/id/1041036 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11359 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104308 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14703 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=beaebe91b14564fb9f86f0726bab09927872721
0.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=beaebe91b14564fb9f86f0726bab09927872721b - https://www.wireshark.org/security/wnpa-sec-2018-33.html - http://www.securitytracker.com/id/1041036 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11360 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in epan/dissectors/packet-gsm_a_dtap.c by fixing an off-by-one error that caused a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104308 - https://www.debian.org/security/2018/dsa-4217 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a55b36c51f83a7b9680824e8ee3a6ce8429ab24b - https://www.wireshark.org/security/wnpa-sec-201
=wireshark.git%3Ba=commit%3Bh=a55b36c51f83a7b9680824e8ee3a6ce8429ab24b - https://www.wireshark.org/security/wnpa-sec-2018-30.html - http://www.securitytracker.com/id/1041036 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14688 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11361 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=1b52f9929238ce3948ec924ae4f9456b5e9df558 - http://www.securityfocus.com/bid/104308 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14686 - https://www.wireshark.org/security/wnpa-sec-2018-32
104308 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14686 - https://www.wireshark.org/security/wnpa-sec-2018-32.html - http://www.securitytracker.com/id/1041036 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11362 State: PUBLISHED Published: 2018-05-22T21:00:00 Last Updated: 2024-08-05T08:10:13.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104308 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14615 - https://www.debian.org/security/2018/dsa-4217 - https://www.wireshark.org/security/wnpa-sec-2018-25.html - https://lists.debian.org/debian-lts-annou
ity/2018/dsa-4217 - https://www.wireshark.org/security/wnpa-sec-2018-25.html - https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f177008b04a530640de835ca878892e58b826d58 - http://www.securitytracker.com/id/1041036 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-11363 State: PUBLISHED Published: 2018-05-22T04:00:00 Last Updated: 2024-08-05T08:10:13.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AndreRenaud/PDFGen/commit/ee58aff6918b8bbc3be29b9e3089485ea46ff956 - https://github.com/ChijinZ/security_advisories/tree/master/PDFgen-206ef1b
CVE ID: CVE-2018-11364 State: PUBLISHED Published: 2018-05-22T04:00:00 Last Updated: 2024-08-05T08:10:13.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconv_open call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChijinZ/security_advisories/tree/master/ReadStat-7bced5b
CVE ID: CVE-2018-11365 State: PUBLISHED Published: 2018-05-22T04:00:00 Last Updated: 2024-08-05T08:10:13.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: sas/readstat_sas7bcat_read.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChijinZ/security_advisories/tree/master/ReadStat-7bced5b
CVE ID: CVE-2018-11366 State: PUBLISHED Published: 2018-05-22T13:00:00Z Last Updated: 2024-09-16T20:57:36.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/loginizer/#developers - https://plugins.trac.wordpress.org/changeset/1878502/loginizer - https://blog.dewhurstsecurity.com/2018/05/22/loginizer-wordpress-plugin-xss-vulnerability.html - https://wpvulndb.com/vulnerabilities/9088
CVE ID: CVE-2018-11367 State: PUBLISHED Published: 2018-05-22T13:00:00Z Last Updated: 2024-09-16T17:08:42.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module. Additional Analyst Notes: - CVE Program Container: References: - http://blog.cppcms.com/post/123
CVE ID: CVE-2018-11369 State: PUBLISHED Published: 2018-05-22T15:00:00Z Last Updated: 2024-09-17T00:05:51.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the database via the \apps\home\controller\ParserController.php scode parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/hnaoyun/PbootCMS/issues/IJZ1E
CVE ID: CVE-2018-11371 State: PUBLISHED Published: 2018-05-22T16:00:00Z Last Updated: 2024-09-17T02:56:52.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: SkyCaiji 1.2 allows CSRF to add an Administrator user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zorlan/skycaiji/issues/9
CVE ID: CVE-2018-11372 State: PUBLISHED Published: 2018-05-22T17:00:00Z Last Updated: 2024-09-16T19:10:23.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hi-KK/CVE-Hunter/blob/master/1.md
CVE ID: CVE-2018-11373 State: PUBLISHED Published: 2018-05-22T17:00:00Z Last Updated: 2024-09-17T02:52:52.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hi-KK/CVE-Hunter/blob/master/2.md
CVE ID: CVE-2018-11375 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/9928 - https://github.com/radare/radare2/commit/041e53cab7ca33481ae45ecd65ad596976d78e68
CVE ID: CVE-2018-11376 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/9904 - https://github.com/radare/radare2/commit/1f37c04f2a762500222dda2459e6a04646feeedf
CVE ID: CVE-2018-11377 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/25a3703ef2e015bbe1d1f16f6b2f63bb10dd34f4 - https://github.com/radare/radare2/commit/b35530fa0681b27eba084de5527037ebfb397422 - https://github.com/radare/radare2/issues/9901
CVE ID: CVE-2018-11378 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/bd276ef2fd8ac3401e65be7c126a43175ccfbcd7 - https://github.com/radare/radare2/issues/9969
CVE ID: CVE-2018-11379 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted PE file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/9926 - https://github.com/radare/radare2/commit/4e1cf0d3e6f6fe2552a269def0af1cd2403e266c
CVE ID: CVE-2018-11380 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted Mach-O file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/60208765887f5f008b3b9a883f3addc8bdb9c134 - https://github.com/radare/radare2/issues/9970
CVE ID: CVE-2018-11381 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/3fcf41ed96ffa25b38029449520c8d0a198745f3 - https://github.com/radare/radare2/issues/9902
CVE ID: CVE-2018-11382 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/10091 - https://github.com/radare/radare2/commit/d04c78773f6959bcb427453f8e5b9824d5ba9eff
CVE ID: CVE-2018-11383 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/9d348bcc2c4bbd3805e7eec97b594be9febbdf9a - https://github.com/radare/radare2/issues/9943
CVE ID: CVE-2018-11384 State: PUBLISHED Published: 2018-05-22T19:00:00 Last Updated: 2024-08-05T08:10:13.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/77c47cf873dd55b396da60baa2ca83bbd39e4add - https://github.com/radare/radare2/issues/9903
CVE ID: CVE-2018-11385 State: PUBLISHED Published: 2018-06-13T16:00:00 Last Updated: 2024-08-05T08:10:13.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa
Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/ - https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html - https://www.debian.org/security/2018/dsa-4262
CVE ID: CVE-2018-11386 State: PUBLISHED Published: 2018-06-13T16:00:00 Last Updated: 2024-08-05T08:10:13.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%
al Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/ - https://symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler - https://www.debian.org/security/2018/dsa-4262
CVE ID: CVE-2018-11392 State: PUBLISHED Published: 2018-05-29T20:00:00 Last Updated: 2024-08-05T08:10:14.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.1.1, as distributed in the Envato Market, allows any remote authenticated user to upload .php files to the web server via a profile avatar field. This results in arbitrary code execution by requesting the .php file. Additional Analyst Notes: - CVE Program Container: References: - https://doddsecurity.com/94/remote-code-execution-in-the-avatars/ - http://packetstormsecurity.com/files/147878/PHP-Login-And-User
ddsecurity.com/94/remote-code-execution-in-the-avatars/ - http://packetstormsecurity.com/files/147878/PHP-Login-And-User-Management-4.1.0-Shell-Upload.html - https://codecanyon.net/item/php-login-user-management/49008 - http://www.securityfocus.com/archive/1/542038/100/0/threaded