Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-11593 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-16T18:39:52.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclosure with a user crafted input file via a Buffer Overflow during syntax parsing because strncpy is misused in jslex.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/files/2019228/eh_0.txt - https://github.com/espruino/Espruino/issues/1426 - https://github.com/espruino/Espruino/commit/bed844f109b6c222816740555068de2e101e8018
CVE ID: CVE-2018-11594 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-16T18:08:56.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing of "VOID" tokens in jsparse.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/issues/1434 - https://github.com/espruino/Espruino/files/2022588/input.txt - https://github.com/espruino/Espruino/commit/c36d30529118aa049797db43f111ddad468aad29
CVE ID: CVE-2018-11595 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-17T02:06:51.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Privileges with a user crafted input file via a Buffer Overflow during syntax parsing, because strncat is misused. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/commit/0a7619875bf79877907205f6bee08465b89ff10b - https://github.com/espruino/Espruino/files/2019220/test_4.txt - https://github.com/espruino/Espruino/files/2019210/test_0.txt - https://github.com
o/Espruino/files/2019220/test_4.txt - https://github.com/espruino/Espruino/files/2019210/test_0.txt - https://github.com/espruino/Espruino/issues/1425 - https://github.com/espruino/Espruino/files/2019216/test_2.txt
CVE ID: CVE-2018-11596 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-17T00:56:13.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because a check for '\0' is made for the wrong array element in jsvar.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/issues/1435 - https://github.com/espruino/Espruino/commit/ce1924193862d58cb43d3d4d9dada710a8361b89
CVE ID: CVE-2018-11597 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-16T23:20:22.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because of a missing check for stack exhaustion with many '{' characters in jsparse.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/commit/51380baf17241728b6d48cdb84140b931e3e3cc5 - https://github.com/espruino/Espruino/issues/1448
CVE ID: CVE-2018-11598 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-16T17:39:06.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Disclosure with user crafted input files via a Buffer Overflow or Out-of-bounds Read during syntax parsing of certain for loops in jsparse.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espruino/Espruino/files/2025968/test_2.txt - https://github.com/espruino/Espruino/files/2025956/test_0.txt - https://github.com/espruino/Espruino/files/2025963/test_1.txt - https://github.c
ino/Espruino/files/2025956/test_0.txt - https://github.com/espruino/Espruino/files/2025963/test_1.txt - https://github.com/espruino/Espruino/commit/bf4416ab9129ee3afd56739ea4e3cd0da5484b6b - https://github.com/espruino/Espruino/issues/1437
CVE ID: CVE-2018-11614 State: PUBLISHED Published: 2018-09-24T23:00:00 Last Updated: 2024-08-05T08:17:07.793Z Vendors: Samsung Products: Samsung Members Problem Types: CWE-269 Description: This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Intents. The issue lies in the ability to send an Intent that would not otherwise be reachable. An attacker can leverage this vulnerability to escalate privileges to resources normally protec
otherwise be reachable. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5361. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-562
CVE ID: CVE-2018-11615 State: PUBLISHED Published: 2018-08-30T12:00:00 Last Updated: 2024-08-05T08:17:07.813Z Vendors: npm Products: npm mosca Problem Types: CWE-20 Description: This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-583
CVE ID: CVE-2018-11616 State: PUBLISHED Published: 2018-08-30T12:00:00 Last Updated: 2024-08-05T08:17:08.408Z Vendors: Tencent Products: Tencent Foxmail Problem Types: CWE-78 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under th
ed string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5543. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-584
CVE ID: CVE-2018-11617 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-05T08:17:08.755Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Format events for ComboBox fields. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute c
ence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5415. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-694
CVE ID: CVE-2018-11618 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-05T08:17:08.643Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the resetForm method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the
ject prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5416. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-695 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-11619 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-05T08:17:08.950Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the setFocus method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the
ect prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5417. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-696 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-11620 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-05T08:17:07.853Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other v
hich can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5756. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-697
CVE ID: CVE-2018-11621 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-05T08:17:08.291Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other v
hich can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5896. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-698 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-11622 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-05T08:17:07.861Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in t
result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-5873. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-699
CVE ID: CVE-2018-11623 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-05T08:17:08.035Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-843 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAdLayer method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-
ion. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6003. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-700 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-11624 State: PUBLISHED Published: 2018-05-31T16:00:00Z Last Updated: 2024-09-16T19:00:50.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1149
CVE ID: CVE-2018-11625 State: PUBLISHED Published: 2018-05-31T16:00:00 Last Updated: 2024-08-05T08:17:08.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/1156
CVE ID: CVE-2018-11626 State: PUBLISHED Published: 2018-05-31T18:00:00 Last Updated: 2024-08-05T08:17:08.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sahaRatul/sela/issues/12
CVE ID: CVE-2018-11627 State: PUBLISHED Published: 2018-05-31T19:00:00 Last Updated: 2024-08-05T08:17:08.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sinatra/sinatra/issues/1428 - https://access.redhat.com/errata/RHSA-2019:0315 - https://access.redhat.com/errata/RHSA-2019:0212 - https://github.com/sinatra/sinatra/commit/12786867d6faaceaec62c7c2cb5b0e2dc074d71a
CVE ID: CVE-2018-11628 State: PUBLISHED Published: 2018-06-01T15:00:00 Last Updated: 2024-08-05T08:17:07.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/barrett092/c70752ca6960b8b9616a03006f291a28 - https://docs.emssoftware.com/Content/V44.1_ReleaseNotes.htm - http://www.securityfocus.com/bid/104428 - https://www.exploit-db.com/exploits/44831/
CVE ID: CVE-2018-11629 State: PUBLISHED Published: 2018-06-02T13:00:00 Last Updated: 2024-08-05T08:17:08.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do n
execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machine Additional Analyst Notes: - CVE Program Container: References: - http://sadfud.me/explotos/CVE-2018-11629 - https://reversecodes.wordpress.com/2018/06/02/0-day-tomando-el-control-de-las-instalaciones-de-la-nasa-en-cabo-canaveral/ - http://www.lutron.com/TechnicalDocumentLibrary/040249.pdf
CVE ID: CVE-2018-11631 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T16:43:22.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy (BLE) traffic. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xMagass/bandexploit
CVE ID: CVE-2018-11632 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T16:53:32.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings via wp-admin/admin-post.php CSRF. There's no nonce or capability check in the whatsapp_share_setting_add_update() function. Additional Analyst Notes: - CVE Program Container: References: - http://labs.threatpress.com/cross-site-request-for
ion. Additional Analyst Notes: - CVE Program Container: References: - http://labs.threatpress.com/cross-site-request-forgery-csrf-in-add-social-share-messenger-buttons-whatsapp-and-viber-plugin/ - https://wordpress.org/plugins/add-social-share-buttons/#developers
CVE ID: CVE-2018-11633 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T03:23:27.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities. Additional Analyst Notes: - CVE Program Container: Ref
post.php Cross-site request forgery (CSRF) and user capabilities. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/woo-checkout-for-digital-goods/#developers - http://labs.threatpress.com/cross-site-request-forgery-csrf-in-woo-checkout-for-digital-goods-plugin/
CVE ID: CVE-2018-11634 State: PUBLISHED Published: 2018-07-03T17:00:00 Last Updated: 2024-08-05T08:17:08.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows local users to access the web application's user passwords in cleartext by reading /var/www/xms/xmsdb/default.db. Additional Analyst Notes: - CVE Program Container: References: - https://d3adend.org/blog/?p=1398
CVE ID: CVE-2018-11635 State: PUBLISHED Published: 2018-07-03T17:00:00 Last Updated: 2024-08-05T08:17:08.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://d3adend.org/blog/?p=1398
CVE ID: CVE-2018-11636 State: PUBLISHED Published: 2018-07-03T17:00:00 Last Updated: 2024-08-05T08:17:07.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to execute malicious and unauthorized actions. Additional Analyst Notes: - CVE Program Container: References: - https://d3adend.org/blog/?p=1398
CVE ID: CVE-2018-11637 State: PUBLISHED Published: 2018-07-03T17:00:00 Last Updated: 2024-08-05T08:17:07.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to read arbitrary files from the /var/ directory because a symlink exists under the web root. Additional Analyst Notes: - CVE Program Container: References: - https://d3adend.org/blog/?p=1398
CVE ID: CVE-2018-11638 State: PUBLISHED Published: 2018-07-03T17:00:00 Last Updated: 2024-08-05T08:17:09.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to upload malicious code to the web root to gain code execution. Additional Analyst Notes: - CVE Program Container: References: - https://d3adend.org/blog/?p=1398
CVE ID: CVE-2018-11639 State: PUBLISHED Published: 2018-07-03T17:00:00 Last Updated: 2024-08-05T08:17:08.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://d3adend.org/blog/?p=1398
CVE ID: CVE-2018-11640 State: PUBLISHED Published: 2018-07-03T17:00:00 Last Updated: 2024-08-05T08:17:07.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitrary files or cause a denial of service (resource consumption). Additional Analyst Notes: - CVE Program Container: References: - https://d3adend.org/blog/?p=1398
CVE ID: CVE-2018-11641 State: PUBLISHED Published: 2018-07-03T17:00:00 Last Updated: 2024-08-05T08:17:08.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service. Additional Analyst Notes: - CVE Program Container: References: - https://d3adend.org/blog/?p=1398