Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-11077 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-17T03:06:58.660Z Vendors: Dell EMC Products: Avamar, Integrated Data Protection Appliance Problem Types: Command Injection Vulnerability Description: 'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially be able to execute arbitrary commands under root privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security
s under root privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2018-0029.html - https://seclists.org/fulldisclosure/2018/Nov/51 - http://www.securityfocus.com/bid/105971 - http://www.securitytracker.com/id/1042153
CVE ID: CVE-2018-11078 State: PUBLISHED Published: 2018-09-11T19:00:00Z Last Updated: 2024-09-16T18:43:20.109Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: DELL EMC Products: VPlex Software: GeoSynchrony Problem Types: Insecure File Permissions vulnerability Description: Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from VPN configuration files on and potentially author a MITM attack on the VPN traffic. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041613 - https://seclists.org/fulldisclosure/2018/
E Program Container: References: - http://www.securitytracker.com/id/1041613 - https://seclists.org/fulldisclosure/2018/Sep/10
CVE ID: CVE-2018-11079 State: PUBLISHED Published: 2018-10-18T22:00:00Z Last Updated: 2024-09-17T01:26:15.649Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: DELL EMC Products: ESRS Virtual Edition Problem Types: Plaintext Password Storage Vulnerability Description: Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain access to the application database. Additional Analyst Notes: - CVE Program Container: References: - h
password to gain access to the application database. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Oct/35 - http://www.securityfocus.com/bid/105694 - http://www.securitytracker.com/id/1041877
CVE ID: CVE-2018-11080 State: PUBLISHED Published: 2018-10-18T22:00:00Z Last Updated: 2024-09-17T02:52:05.343Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: DELL EMC Products: ESRS Virtual Edition Problem Types: Improper File Permissions Vulnerability Description: Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. The application contains multiple configuration files with world-readable permissions that could allow an authenticated malicious user to utilize the file contents to potentially elevate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.
potentially elevate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Oct/35 - http://www.securityfocus.com/bid/105694 - http://www.securitytracker.com/id/1041877
CVE ID: CVE-2018-11081 State: PUBLISHED Published: 2018-10-05T21:00:00Z Last Updated: 2024-09-17T01:26:01.975Z Severity: HIGH (CVSS 7.9 CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Pivotal Products: pivotal-ops-manager Problem Types: Cleartext Storage in a File or on Disk Description: Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk, thus exposing the configs directly onto disk. A remote user that has gained access to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system disk
to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system disk.. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-11081
CVE ID: CVE-2018-11082 State: PUBLISHED Published: 2018-10-05T21:00:00Z Last Updated: 2024-09-17T02:00:59.932Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cloud Foundry Products: UAA Release, UAA Problem Types: Improper Access Control Description: Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-11082/
CVE ID: CVE-2018-11083 State: PUBLISHED Published: 2018-10-05T21:00:00 Last Updated: 2024-08-05T07:54:36.539Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Cloud Foundry Products: BOSH Problem Types: Improper Authentication Description: Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access BOSH resources without obtaining an access token, even if their user no longer has access to those resources. Additional Analyst Note
s without obtaining an access token, even if their user no longer has access to those resources. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-11083
CVE ID: CVE-2018-11084 State: PUBLISHED Published: 2018-09-18T21:00:00Z Last Updated: 2024-09-16T16:49:02.611Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: Cloud Foundry Products: Garden-runC Problem Types: Logic error Description: Cloud Foundry Garden-runC release, versions prior to 1.16.1, prevents deletion of some app environments based on file attributes. A remote authenticated malicious user may create and delete apps with crafted file attributes to cause a denial of service for new app instances or scaling up of existing apps. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-11084/
CVE ID: CVE-2018-11085 State: REJECTED Published: 2018-08-17T17:00:00 Last Updated: 2018-08-17T16:57:01 Description: No description available.
CVE ID: CVE-2018-11086 State: PUBLISHED Published: 2018-09-17T16:00:00Z Last Updated: 2024-09-16T20:58:01.148Z Vendors: Pivotal Products: Application Service Problem Types: Credential leak Description: Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-11086
CVE ID: CVE-2018-11087 State: PUBLISHED Published: 2018-09-14T20:00:00Z Last Updated: 2024-09-17T03:58:41.663Z Vendors: Pivotal Products: Spring AMQP Problem Types: TLS validation error Description: Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-11087
CVE ID: CVE-2018-11088 State: PUBLISHED Published: 2018-09-17T16:00:00Z Last Updated: 2024-09-17T03:14:36.305Z Vendors: Pivotal Products: Application Service Problem Types: Credential leak Description: Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-11088
CVE ID: CVE-2018-11090 State: PUBLISHED Published: 2018-05-14T23:00:00 Last Updated: 2024-08-05T07:54:36.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in MyBiz MyProcureNet 5.0.0. This vulnerability within "ProxyPage.aspx" allows an attacker to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/en/blog/advisories/arbitrary-file-upload-cross-site-scripting-in-mybiz-myprocurenet/ - http://seclists.org/fulldisclosure/2018/May/32
CVE ID: CVE-2018-11091 State: PUBLISHED Published: 2018-05-14T23:00:00 Last Updated: 2024-08-05T07:54:36.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload a script to issue operating system commands. This vulnerability occurs because an attacker is able to adjust the "HiddenFieldControlCustomWhiteListedExtensions" parameter and add arbitrary extensions to the whitelist during the upload. For instance, if the extension .asp is added to the "HiddenFieldControlCustomWhiteListedExtensions" parameter, the server accepts "secc
f the extension .asp is added to the "HiddenFieldControlCustomWhiteListedExtensions" parameter, the server accepts "secctest.asp" as a legitimate file. Hence malicious files can be uploaded in order to execute arbitrary commands to take over the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/en/blog/advisories/arbitrary-file-upload-cross-site-scripting-in-mybiz-myprocurenet/ - http://seclists.org/fulldisclosure/2018/May/32 - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:26.mcu.asc - https://seclists.org/bugtraq/2019/Nov/16 - http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html
CVE ID: CVE-2018-11092 State: PUBLISHED Published: 2018-05-21T14:00:00 Last Updated: 2024-08-05T07:54:36.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action. Additional Analyst Notes: - CVE Program Container: References: - https://community.mybb.com/mods.php?action=changelog&pid=1106 - https://www.exploit-db.com/exploits/44624/ - https://github.com/vintagedaddyo/MyBB_Plugin-adminnotes/commit/3deae701cdd89753cb6688302aee5b93a72bc58b?diff=split
CVE ID: CVE-2018-11093 State: PUBLISHED Published: 2018-05-22T18:00:00 Last Updated: 2024-08-05T07:54:36.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckeditor/ckeditor5-link/blob/master/CHANGELOG.md#1001-2018-05-22 - https://ckeditor.com/blog/CKEditor-5-v10.0.1-released/
CVE ID: CVE-2018-11094 State: PUBLISHED Published: 2018-05-15T19:00:00 Last Updated: 2024-08-05T07:54:36.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authentication. For example, when an HTTP POST request is made to /cgi-bin/ExportSettings.sh, the username, password, and other details are retrieved. Additional Analyst Notes: - CVE Program Container: References: - https://blog.kos-lab.com/Hello-World/ - https://www.exploit-db.com/exploits/44637/
CVE ID: CVE-2018-11095 State: PUBLISHED Published: 2018-05-15T00:00:00 Last Updated: 2024-08-05T07:54:36.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/13xJhiIgDbqYwmR4j7aGEbKUU8KDl195mkw4rcvhT4J8/edit?usp=sharing - https://github.com/libming/libming/issues/141
CVE ID: CVE-2018-11096 State: PUBLISHED Published: 2018-05-21T14:00:00 Last Updated: 2024-08-05T07:54:36.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44628/
CVE ID: CVE-2018-11097 State: PUBLISHED Published: 2018-05-15T01:00:00Z Last Updated: 2024-09-16T17:17:47.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudwu/cstring/issues/6
CVE ID: CVE-2018-11098 State: PUBLISHED Published: 2018-05-15T01:00:00 Last Updated: 2024-08-05T07:54:36.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/11
CVE ID: CVE-2018-11099 State: PUBLISHED Published: 2018-05-17T19:00:00 Last Updated: 2024-08-05T07:54:36.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/43 - https://usn.ubuntu.com/3974-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00039.html
CVE ID: CVE-2018-11100 State: PUBLISHED Published: 2018-05-15T01:00:00 Last Updated: 2024-08-05T07:54:36.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/142 - https://docs.google.com/document/d/1N-_obGIyAM5DGcrB7gHy89Oy68aDvxSMjrKaaM7KOFA/edit
CVE ID: CVE-2018-11101 State: PUBLISHED Published: 2018-05-17T19:00:00 Last Updated: 2024-08-05T07:54:36.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fails to sanitize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML messa
tize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML message. Specifically the IMG and IFRAME elements can be used to include remote or local resources. For example, the use of an IFRAME element enables full code execution, allowing an attacker to download/upload files, information, etc. The SCRIPT element was also found to be injectable. On the Windows operating system, the CSP fails to prevent remote inclusion of resources via the SMB protocol. In this case, remote execution of JavaScript can be achieved by referencing the script on an SMB share within an IFRAME element, for example: <IFRAME src=\\DESKTOP-XXXXX\Temp\test.html> a
erencing the script on an SMB share within an IFRAME element, for example: <IFRAME src=\\DESKTOP-XXXXX\Temp\test.html> and then replying to it. The included JavaScript code is then executed automatically, without any interaction needed from the user. The vulnerability can be triggered in the Signal-Desktop client by sending a specially crafted message and then replying to it with any text or content in the reply (it doesn't matter). Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/46
CVE ID: CVE-2018-11102 State: PUBLISHED Published: 2018-05-15T02:00:00 Last Updated: 2024-08-05T07:54:36.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/18xCwfxMSJiQ9ruQSVaO8-jlcobDjFiYXWOaw31V37xo/edit - https://bugzilla.libav.org/show_bug.cgi?id=1128 - https://lists.debian.org/debian-lts-announce/2019/09/msg00000.html
CVE ID: CVE-2018-11103 State: REJECTED Published: N/A Last Updated: 2023-10-30T13:36:00.149938 Description: No description available.
CVE ID: CVE-2018-11105 State: PUBLISHED Published: 2018-05-15T15:00:00 Last Updated: 2024-08-05T07:54:36.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-live-chat-support/#developers - https://github.com/RiieCco/writ
ontainer: References: - https://wordpress.org/plugins/wp-live-chat-support/#developers - https://github.com/RiieCco/write-ups/tree/master/CVE-2018-11105
CVE ID: CVE-2018-11106 State: PUBLISHED Published: 2020-04-01T16:31:45 Last Updated: 2024-08-05T07:54:36.460Z Vendors: NETGEAR Products: WC7500, WC7520, WC7600v1, WC7600v2, WC9500 Problem Types: Other Description: NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5. Additional Analyst Notes: - CVE Program Container: References: - htt
WC9500, running firmware versions prior to 6.5.3.5. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000058243/Security-Advisory-for-Pre-Authentication-Command-Injection-in-request-handler-php-on-Some-Wireless-Controllers-PSV-2018-0051
CVE ID: CVE-2018-11116 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T07:54:36.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call arbitrary methods (i.e., achieve ubus access over HTTP) that were only supposed to be accessible to a specific user, as demonstrated by the file, log, and service namespaces, potentially leading to remote Information Disclosure or Code Execution. NOTE: The developer disputes this as a vulnerability, indicating that rpcd functions appropriately Additional Analyst Notes: - CISA ADP Vulnrichm
tes this as a vulnerability, indicating that rpcd functions appropriately Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://blog.hac425.top/2018/05/16/openwrt_rpcd_acl_fail.html - https://forum.openwrt.org/t/rpcd-vulnerability-reported-on-vultdb/16497/3
CVE ID: CVE-2018-11117 State: PUBLISHED Published: 2018-05-17T13:00:00 Last Updated: 2024-08-05T07:54:36.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute. Additional Analyst Notes: - CVE Program Container: References: - https://www.ilias.de/docu/goto.php?target=st_229 - https://github.com/ILIAS-eLearning/ILIAS/commit/ff9bf29858f2dbffe828711a6f8bf37038c00d77
CVE ID: CVE-2018-11118 State: PUBLISHED Published: 2018-05-17T13:00:00 Last Updated: 2024-08-05T07:54:36.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ILIAS-eLearning/ILIAS/commit/d0dcad1b1e729f694acd0582bc626c7c8e62b519 - https://github.com/ILIAS-eLearning/ILIAS/commit/6b2217c31b6974788a5c787413454475687b44bb - https://www.ilias.de/docu/goto.php?target=st_229
CVE ID: CVE-2018-11119 State: PUBLISHED Published: 2018-05-17T13:00:00 Last Updated: 2024-08-05T07:54:36.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.ilias.de/docu/goto.php?target=st_229 - https://github.com/ILIAS-eLearning/ILIAS/commit/01a24cf04fe8dddf1da59ca497580637973482b6
CVE ID: CVE-2018-11120 State: PUBLISHED Published: 2018-05-17T13:00:00 Last Updated: 2024-08-05T07:54:36.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.ilias.de/docu/goto.php?target=st_229 - https://github.com/ILIAS-eLearning/ILIAS/commit/7959485406eb981976b64fee363cf950603924ed
CVE ID: CVE-2018-11124 State: PUBLISHED Published: 2018-07-06T14:00:00 Last Updated: 2024-08-05T08:01:51.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1dJP1CQupHGXjsMWthgPGepOkcnxYA4mDfdjOE46nrhM/edit?usp=sharing - https://www.exploit-db.com/exploits/45053/
CVE ID: CVE-2018-11125 State: REJECTED Published: 2018-05-15T16:00:00 Last Updated: 2018-05-18T13:57:01 Description: No description available.