Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-25084 State: PUBLISHED Published: 2023-04-10T18:00:05.570Z Last Updated: 2024-08-05T12:33:47.869Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Ping Identity Products: Self-Service Account Manager Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b
ched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225362 - https://vuldb.com/?ctiid.225362 - https://github.com/pingidentity/ssam/commit/f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251 - https://github.com/pingidentity/ssam/releases/tag/ssam-1.1.3
CVE ID: CVE-2018-25085 State: PUBLISHED Published: 2023-05-01T05:00:03.819Z Last Updated: 2024-08-05T12:33:47.826Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: Responsive Menus Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsive_menus_admin_form_submit of the file responsive_menus.module of the component Configuration Setting Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 7.x-1.7 is able to address this issue. The patch is named 3c554b31d32a367188f44d44857b061ea
motely. Upgrading to version 7.x-1.7 is able to address this issue. The patch is named 3c554b31d32a367188f44d44857b061eac949fb8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227755. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227755 - https://vuldb.com/?ctiid.227755 - https://www.drupal.org/sa-contrib-2018-079 - https://git.drupalcode.org/project/responsive_menus/-/commit/3c554b31d32a367188f44d44857b061eac949fb8 - https://www.drupal.org/project/responsive_menus/releases/7.x-1.7
CVE ID: CVE-2018-25086 State: PUBLISHED Published: 2023-06-01T07:00:03.743Z Last Updated: 2024-08-05T12:33:49.169Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: sea75300 Products: FanPress CM Problem Types: CWE-79 Description: A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.6.4 is able to address this issue. The patch is named c380d343c2107fcee55ab00eb8d189ce5e03369b. It
pgrading to version 3.6.4 is able to address this issue. The patch is named c380d343c2107fcee55ab00eb8d189ce5e03369b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230235. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230235 - https://vuldb.com/?ctiid.230235 - https://github.com/sea75300/fanpresscm3/commit/c380d343c2107fcee55ab00eb8d189ce5e03369b - https://github.com/sea75300/fanpresscm3/releases/tag/v3.6.4
CVE ID: CVE-2018-25087 State: PUBLISHED Published: 2023-06-06T03:00:04.431Z Last Updated: 2025-01-07T21:21:30.676Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Arborator Products: Server Problem Types: CWE-404 Description: A vulnerability classified as problematic was found in Arborator Server. This vulnerability affects the function start of the file project.cgi. The manipulation of the argument project leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as cdbdbcbd491db65e9d697ab4365605fdfab1a604. It is recommende
or updated releases are available. The patch is identified as cdbdbcbd491db65e9d697ab4365605fdfab1a604. It is recommended to apply a patch to fix this issue. VDB-230662 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230662 - https://vuldb.com/?ctiid.230662 - https://github.com/Arborator/arborator-server/commit/cdbdbcbd491db65e9d697ab4365605fdfab1a604
CVE ID: CVE-2018-25088 State: PUBLISHED Published: 2023-07-18T13:00:05.652Z Last Updated: 2024-08-05T12:33:49.158Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Blue Yonder Products: postgraas_server Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function _create_pg_connection/create_postgres_db of the file postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py of the component PostgreSQL Backend Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 7c
pulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 7cd8d016edc74a78af0d81c948bfafbcc93c937c. It is recommended to upgrade the affected component. VDB-234246 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.234246 - https://vuldb.com/?ctiid.234246 - https://github.com/blue-yonder/postgraas_server/commit/7cd8d016edc74a78af0d81c948bfafbcc93c937c - https://github.com/blue-yonder/postgraas_server/releases/tag/v2.0.0
CVE ID: CVE-2018-25089 State: PUBLISHED Published: 2023-08-28T12:31:04.889Z Last Updated: 2024-09-30T17:50:45.123Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: glb Products: Meetup Tag Extension Problem Types: CWE-1022 Description: A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 850c726d6bbfe0bf270801fbb92a30babea4155c. It is recommended to upgra
address this issue. The identifier of the patch is 850c726d6bbfe0bf270801fbb92a30babea4155c. It is recommended to upgrade the affected component. The identifier VDB-238157 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238157 - https://vuldb.com/?ctiid.238157 - https://github.com/glb/mediawiki-tag-extension-meetup/commit/850c726d6bbfe0bf270801fbb92a30babea4155c - https://github.com/glb/mediawiki-tag-extension-meetup/releases/tag/v0.2
CVE ID: CVE-2018-25090 State: PUBLISHED Published: 2024-03-13T08:32:17.180Z Last Updated: 2024-08-05T15:22:05.933Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: WAGO Products: Controller BACnet/IP, Controller BACnet MS/TP, Ethernet Controller 3rd Generation, Fieldbus Coupler Ethernet 3rd Generation Problem Types: CWE-79 Description: An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
integrity but no impact of availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-039/
CVE ID: CVE-2018-25091 State: PUBLISHED Published: 2023-10-15T00:00:00 Last Updated: 2024-09-16T19:01:58.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/urllib3/urllib3/issues/1510 - https
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/urllib3/urllib3/issues/1510 - https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc - https://github.com/urllib3/urllib3/compare/1.24.1...1.24.2
CVE ID: CVE-2018-25092 State: PUBLISHED Published: 2023-11-05T21:00:04.701Z Last Updated: 2024-08-05T12:33:48.485Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Vaerys-Dawn Products: DiscordSailv2 Problem Types: CWE-284 Description: A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The patch is named cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. Th
ue. The patch is named cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244483. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.244483 - https://vuldb.com/?ctiid.244483 - https://github.com/Vaerys-Dawn/DiscordSailv2/commit/cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69 - https://github.com/Vaerys-Dawn/DiscordSailv2/releases/tag/2.10.3
CVE ID: CVE-2018-25093 State: PUBLISHED Published: 2023-11-06T01:00:05.912Z Last Updated: 2024-08-05T12:33:49.283Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Vaerys-Dawn Products: DiscordSailv2 Problem Types: CWE-284 Description: A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The name of the patch is cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The identifier of
atch is cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244484. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.244484 - https://vuldb.com/?ctiid.244484 - https://github.com/Vaerys-Dawn/DiscordSailv2/commit/cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69 - https://github.com/Vaerys-Dawn/DiscordSailv2/releases/tag/2.10.3
CVE ID: CVE-2018-25094 State: PUBLISHED Published: 2023-12-03T10:31:03.118Z Last Updated: 2024-08-05T12:33:49.018Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ระบบบัญชีออนไลน์ Products: Online Accounting System Problem Types: CWE-24 Description: A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is
ath traversal: '../filedir'. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 9d9618422b980335bb30be612ea90f4f56cb992c. It is recommended to upgrade the affected component. The identifier VDB-246641 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246641 - https://vuldb.com/?ctiid.246641 - https://github.com/59160781/project/commit/9d9618422b980335bb30be612ea90f4f56cb992c
CVE ID: CVE-2018-25095 State: PUBLISHED Published: 2024-01-08T19:00:33.155Z Last Updated: 2025-06-03T14:34:46.451Z Vendors: Unknown Products: Duplicator Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/16cc47aa-cb31-4114-b014-7ac5fbc1d3ee
CVE ID: CVE-2018-25096 State: PUBLISHED Published: 2023-12-30T09:31:03.613Z Last Updated: 2024-08-05T12:33:47.883Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: MdAlAmin-aol Products: Own Health Record Problem Types: CWE-352 Description: A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to
-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.249191 - https://vuldb.com/?ctiid.249191 - https://github.com/MdAlAmin-aol/ownhealthrecord/commit/58b413aa40820b49070782c786c526850ab7748f - https://github.com/MdAlAmin-aol/ownhealthrecord/releases/tag/v0.4-alpha
CVE ID: CVE-2018-25097 State: PUBLISHED Published: 2024-01-02T15:31:03.846Z Last Updated: 2024-09-06T17:53:31.410Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Acumos Products: Design Studio Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of the patch is 0df8a5e8722188744973168648e4c74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420. Ad
74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249420 - https://vuldb.com/?ctiid.249420 - https://github.com/acumos/design-studio/commit/0df8a5e8722188744973168648e4c74c69ce67fd - https://github.com/acumos/design-studio/releases/tag/2.0.8
CVE ID: CVE-2018-25098 State: PUBLISHED Published: 2024-02-04T16:31:03.073Z Last Updated: 2024-08-05T12:33:47.848Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: blockmason Products: credit-protocol Problem Types: CWE-404 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in blockmason credit-protocol. It has been declared as problematic. Affected by this vulnerability is the function executeUcacTx of the file contracts/CreditProtocol.sol of the component UCAC Handler. The manipulation leads to denial of service. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patc
roduct does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 082e01f18707ef995e80ebe97fcedb229a55efc5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252799. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.252799 - https://vuldb.com/?ctiid.252799 - https://github.com/blockmason/credit-protocol/pull/33 - https://github.com/blockmason/credit-protocol/commit/082e01f18707ef995e80ebe97fcedb229a55efc5
CVE ID: CVE-2018-25099 State: PUBLISHED Published: 2024-03-18T00:00:00.000Z Last Updated: 2025-03-14T18:17:30.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DCIT/perl-CryptX/issues/47 - https://github.com/libtom/libtomcrypt/pull/451 - https://metacpan.org/dist/CryptX/changes
CVE ID: CVE-2018-25100 State: PUBLISHED Published: 2024-03-24T00:00:00.000Z Last Updated: 2025-04-10T20:08:35.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. This affects Mojo::UserAgent::CookieJar. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mojolicious/mojo/pull/1192 - https://github.com/mojolicious/mojo/issues/1185 - https://github.com/mojolicious/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149 - https://metacpan.org/dist/Mojolicious/changes
CVE ID: CVE-2018-25101 State: PUBLISHED Published: 2024-04-22T01:31:03.752Z Last Updated: 2024-08-05T12:33:48.492Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: l2c2technologies Products: Koha Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknown processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the argument biblionumber with the input 2"><TEST> leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 950fc8e101886821879066b33e389a47fb0a9782. It is recommended to upgrade the affected compo
The identifier of the patch is 950fc8e101886821879066b33e389a47fb0a9782. It is recommended to upgrade the affected component. The identifier VDB-261677 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261677 - https://vuldb.com/?ctiid.261677 - https://github.com/l2c2technologies/Koha/commit/950fc8e101886821879066b33e389a47fb0a9782
CVE ID: CVE-2018-25103 State: PUBLISHED Published: 2024-06-17T18:02:57.162Z Last Updated: 2025-09-15T20:05:35.756Z Vendors: lighttpd Products: lighttpd Problem Types: CWE-416: Use After Free Description: There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blogvdoo.wordpress.com/2018/11/06/giving-back-securing-open-source-iot-projects/#more-736 - https://www.runzero.com/blog/lighttpd/ - https://github.com/lighttpd/lighttpd1.4/commit/df8e4f95614e476276a55e34da2aa8b00b11
s://www.runzero.com/blog/lighttpd/ - https://github.com/lighttpd/lighttpd1.4/commit/df8e4f95614e476276a55e34da2aa8b00b1148e9 - https://github.com/lighttpd/lighttpd1.4/commit/d161f53de04bc826ce1bdaeb3dce2c72ca50a3f8 - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024002.pdf - https://www.kb.cert.org/vuls/id/312260
CVE ID: CVE-2018-25104 State: PUBLISHED Published: 2024-10-17T15:31:04.848Z Last Updated: 2024-10-17T17:52:22.017Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: CoinGate Plugin Problem Types: CWE-840 Description: A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. The manipulation leads to business logic errors. The attack may be launched remotely. Upgrading to version 1.2.8 is able to address this issue. The patch is identified as 0a3097db0aec7c5
launched remotely. Upgrading to version 1.2.8 is able to address this issue. The patch is identified as 0a3097db0aec7c5d66686c142c6abaa1e126ca16. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280358 - https://vuldb.com/?ctiid.280358 - https://github.com/coingate/prestashop-plugin/commit/0a3097db0aec7c5d66686c142c6abaa1e126ca16 - https://github.com/coingate/prestashop-plugin/releases/tag/v1.2.8
CVE ID: CVE-2018-25105 State: PUBLISHED Published: 2024-10-16T06:43:38.894Z Last Updated: 2024-10-16T17:09:15.846Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mndpsingh287 Products: File Manager Problem Types: CWE-862 Description: The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence
e used for remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a56d5a2f-ae13-4523-bc4a-17bb2fb4c6f0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1942390%40wp-file-manager&new=1942390%40wp-file-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2018-25106 State: PUBLISHED Published: 2024-12-23T23:00:16.772Z Last Updated: 2024-12-24T01:29:30.969Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: webuidesigning Products: NebulaX Theme Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebula_send_to_hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patch is named 41230a81db0f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA AD
f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289163 - https://vuldb.com/?ctiid.289163 - https://github.com/webuidesigning/NebulaX/commit/41230a81db0f671c570c2644bc2f80565ca83c5a
CVE ID: CVE-2018-25107 State: PUBLISHED Published: 2024-12-29T00:00:00 Last Updated: 2024-12-31T18:20:33.845Z Vendors: n/a Products: n/a Problem Types: CWE-338 Description: The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/karenetheridge/Crypt-Random-Source/pull/3 - https://metacpan.org/release/ETHER/Crypt-Random-Source-0.13/changes