Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-16575 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16576 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16577 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16578 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16579 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16580 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16581 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16582 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16583 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16584 State: REJECTED Published: 2019-04-17T13:34:21 Last Updated: 2019-04-17T13:34:21 Description: No description available.
CVE ID: CVE-2018-16585 State: PUBLISHED Published: 2018-09-06T13:00:00 Last Updated: 2024-11-14T20:34:21.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show
the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.gentoo.org/glsa/201811-12 - https://usn.ubuntu.com/3768-1/ - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=1497d65039885a52b598b137dd8622bd4672f9be - https://www.debian.org/security/2018/dsa-4288 - https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=971472c83a345a16dac9f90f91258bb22dd77f22 - https://seclists.org/oss-sec/2018/q3/182 - https://bugzilla.redh
mmitdiff%3Bh=971472c83a345a16dac9f90f91258bb22dd77f22 - https://seclists.org/oss-sec/2018/q3/182 - https://bugzilla.redhat.com/show_bug.cgi?id=1626193
CVE ID: CVE-2018-16586 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:24:32.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources. Additional Analyst Notes: - CVE Program Container: References: - https://community.otrs.com/security-advisory-2018-05-security-update-for-otrs-framework/ - https://www.debian.org/security/2018/dsa-4317 - https://lists.debian.org/debian-lts-announce/2018/09/msg00
-framework/ - https://www.debian.org/security/2018/dsa-4317 - https://lists.debian.org/debian-lts-announce/2018/09/msg00033.html - https://github.com/OTRS/otrs/commit/baa92df09145b8ae2702a3a0e85d8ba55ec96302 - https://github.com/OTRS/otrs/commit/a808859a75c59ae3b7568f5cc4708c53462aa4c7 - https://github.com/OTRS/otrs/commit/09e80c7752b0d9080688e4597c7495dd109e0963
CVE ID: CVE-2018-16587 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:24:32.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OTRS/otrs/commit/d9db0c6a15caafda7689320ecf61777993c33711 - https://www.debian.org/security/2018/dsa-4317 - https://lists.debian.org/debian-lts-announ
fda7689320ecf61777993c33711 - https://www.debian.org/security/2018/dsa-4317 - https://lists.debian.org/debian-lts-announce/2018/09/msg00033.html - https://community.otrs.com/security-advisory-2018-04-security-update-for-otrs-framework/ - https://github.com/OTRS/otrs/commit/a4a1a01f84fac7ab032570ee50b660e2ebb15c01 - https://github.com/OTRS/otrs/commit/d8cae00b0f78c2a07bb10cedb817304139395843
CVE ID: CVE-2018-16588 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:24:32.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks. NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream
nd other unspecified attacks. NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream pull request; however, no non-SUSE distribution is known to be affected. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2018-09/msg00073.html
CVE ID: CVE-2018-16590 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-08-05T10:24:32.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication. Additional Analyst Notes: - CVE Program Container: References: - https://cyberskr.com/blog/furuno-felcom.html - https://gist.github.com/CyberSKR/34a8d6be7646a4bfd4df455f9f52500f
CVE ID: CVE-2018-16591 State: PUBLISHED Published: 2018-09-10T17:00:00 Last Updated: 2024-08-05T10:24:33.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the protected "SMS" panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://cyberskr.com/blog/furuno-felcom.html - https://gist.github.com/CyberSKR/2c30d964d48b5e1518ded88bd953b710
CVE ID: CVE-2018-16593 State: PUBLISHED Published: 2019-06-19T18:18:21 Last Updated: 2024-08-05T10:24:32.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.sony.co.uk/electronics/support/articles/00201041 - https://fortiguard.com/zeroday/FG-VD-18-036
CVE ID: CVE-2018-16594 State: PUBLISHED Published: 2019-06-19T18:13:28 Last Updated: 2024-08-05T10:24:32.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.sony.co.uk/electronics/support/articles/00201041 - https://fortiguard.com/zeroday/FG-VD-18-036
CVE ID: CVE-2018-16595 State: PUBLISHED Published: 2019-06-19T18:08:12 Last Updated: 2024-08-05T10:24:32.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices has a Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.sony.co.uk/electronics/support/articles/00201041 - https://fortiguard.com/zeroday/FG-VD-18-036
CVE ID: CVE-2018-16596 State: PUBLISHED Published: 2018-12-17T18:00:00 Last Updated: 2024-08-05T10:24:32.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09.04.00 and Internet-Box light prior to v08.05.02 allows remote code execution. No authentication is required to exploit this vulnerability. Sending a simple UDP packet to port 1900 allows an attacker to execute code on a remote device. However, this is only possible if the attacker is inside the LAN. Because of ASLR, the success rate is not 100% and leads instead to a DoS of the UPnP serv
he attacker is inside the LAN. Because of ASLR, the success rate is not 100% and leads instead to a DoS of the UPnP service. The remaining functionality of the Internet Box is not affected. A reboot of the Internet Box is necessary to attempt the exploit again. Additional Analyst Notes: - CVE Program Container: References: - https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-16596.txt
CVE ID: CVE-2018-16597 State: PUBLISHED Published: 2018-09-21T16:00:00 Last Updated: 2024-08-05T10:24:32.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105394 - https://security.netapp.com/advisory/ntap-20190204-0001/ - https://bugzilla.suse.com/show_bug.cgi?id=1106512 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862 -
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862 - https://support.f5.com/csp/article/K22691834 - http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html - https://seclists.org/bugtraq/2019/Jul/33 - http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE ID: CVE-2018-16598 State: PUBLISHED Published: 2018-12-06T23:00:00 Last Updated: 2024-08-05T10:24:32.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. In xProcessReceivedUDPPacket and prvParseDNSReply, any received DNS response is accepted, without confirming it matches a sent DNS request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https:
on-freertos/blob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/
CVE ID: CVE-2018-16599 State: PUBLISHED Published: 2018-12-06T23:00:00 Last Updated: 2024-08-05T10:24:33.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of NBNS packets in prvTreatNBNS can be used for information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimperium.com/free
HANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/
CVE ID: CVE-2018-16600 State: PUBLISHED Published: 2018-12-06T23:00:00 Last Updated: 2024-08-05T10:24:32.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of ARP packets in eARPProcessPacket can be used for information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimperium.com/
.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/
CVE ID: CVE-2018-16601 State: PUBLISHED Published: 2018-12-06T23:00:00 Last Updated: 2024-08-05T10:24:32.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. A crafted IP header triggers a full memory space copy in prvProcessIPPacket, leading to denial of service and possibly remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - http
azon-freertos/blob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/
CVE ID: CVE-2018-16602 State: PUBLISHED Published: 2018-12-06T23:00:00 Last Updated: 2024-08-05T10:32:52.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds memory access during parsing of DHCP responses in prvProcessDHCPReplies can be used for information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimperi
ob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/
CVE ID: CVE-2018-16603 State: PUBLISHED Published: 2018-12-06T23:00:00 Last Updated: 2024-08-05T10:32:52.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds access to TCP source and destination port fields in xProcessReceivedTCPPacket can leak data back to an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md - https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/ - https://blog.zimper
CVE ID: CVE-2018-16604 State: PUBLISHED Published: 2018-09-06T16:00:00Z Last Updated: 2024-09-16T23:50:42.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes (e.g., "${phpinfo()}"). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dignajar/nibbleblog/issues/131
CVE ID: CVE-2018-16605 State: PUBLISHED Published: 2018-09-12T16:00:00 Last Updated: 2024-08-05T10:32:52.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=BvZJ_e2BH_M&feature=youtu.be
CVE ID: CVE-2018-16606 State: PUBLISHED Published: 2018-09-06T16:00:00 Last Updated: 2024-08-05T10:32:52.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstract) and their authors' personal information (Name, Email, Organization, and Position) by changing the value of Paper ID (the pid parameter). Additional Analyst Notes: - CVE Program Container: References: - https://blog.ziaurrashid.com/idor-on-proconf-peer-reviewand-conference-management-system/ - https://packetstormsecurity.com/files/149259/IDOR-On-ProConf-Peer-Review-And-Conference-Manage
ence-management-system/ - https://packetstormsecurity.com/files/149259/IDOR-On-ProConf-Peer-Review-And-Conference-Management-6.0-File-Disclosure.html
CVE ID: CVE-2018-16607 State: PUBLISHED Published: 2018-09-19T15:00:00 Last Updated: 2024-08-05T10:32:53.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1MKeb9lly_oOrVG0Ja4A-HgwaeXhb_xQHT9IIOee3wi0/edit
CVE ID: CVE-2018-16608 State: PUBLISHED Published: 2018-09-10T13:00:00 Last Updated: 2024-08-05T10:32:52.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, Insecure Direct Object Reference (IDOR). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monstra-cms/monstra/issues/453
CVE ID: CVE-2018-16613 State: PUBLISHED Published: 2019-06-19T17:59:49 Last Updated: 2024-08-05T10:32:52.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wpforo/#developers - https://github.com/9emin1/advisories - https://github.com/9emin1/advisories/blob/master/wpForo-1-5-1.md
CVE ID: CVE-2018-16618 State: PUBLISHED Published: 2019-06-19T17:48:14 Last Updated: 2024-08-05T10:32:52.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x service on port 1668 listening for requests on localhost. Requests submitted to this service are checked for a string of random characters followed by the name of an Android activity to start. Activities are started by inserting their name into a string that is executed in a shell command. By inserting metacharacters this can be exploited to run arbitrary commands as root
that is executed in a shell command. By inserting metacharacters this can be exploited to run arbitrary commands as root. The requests also match those of the HTTP protocol and can be triggered on any web page rendered on the device by requesting resources stored at an http://127.0.0.1:1668/ URI, as demonstrated by the http://127.0.0.1:1668/dacdb70556479813fab2d92896596eef?';{ping,example.org}' URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.vtech.com/en/our-businesses/product-support/ - https://www.surecloud.com/sc-blog/vtech
CVE ID: CVE-2018-16619 State: PUBLISHED Published: 2018-11-15T20:00:00 Last Updated: 2024-08-05T10:32:53.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager before 3.14 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/360010789893-CVE-2018-16619-Nexus-Repository-Manager-XSS-October-17-2018
CVE ID: CVE-2018-16620 State: PUBLISHED Published: 2018-11-15T20:00:00 Last Updated: 2024-08-05T10:32:53.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/360010789453-CVE-2018-16620-Nexus-Repository-Manager-Missing-Access-Controls-October-17-2018
CVE ID: CVE-2018-16621 State: PUBLISHED Published: 2018-11-15T20:00:00 Last Updated: 2024-08-05T10:32:53.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/360010789153-CVE-2018-16621-Nexus-Repository-Manager-Java-Injection-October-17-2018 - https://securitylab.github.com/advisories/GHSL-2020-015-nxrm-sonatype
CVE ID: CVE-2018-16622 State: PUBLISHED Published: 2018-09-06T19:00:00Z Last Updated: 2024-09-17T03:33:43.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/doramart/DoraCMS/issues/136
CVE ID: CVE-2018-16623 State: PUBLISHED Published: 2019-05-13T12:57:55 Last Updated: 2024-08-05T10:32:53.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16623/blob/master/CVE-2018-16623.pdf
CVE ID: CVE-2018-16624 State: PUBLISHED Published: 2019-05-13T12:56:27 Last Updated: 2024-08-05T10:32:52.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16624/blob/master/CVE-2018-16624.pdf
CVE ID: CVE-2018-16625 State: PUBLISHED Published: 2019-05-13T12:54:54 Last Updated: 2024-08-05T10:32:52.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-provensec/CVE-2018-16625
CVE ID: CVE-2018-16626 State: PUBLISHED Published: 2019-05-13T12:53:20 Last Updated: 2024-08-05T10:32:53.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-provensec/CVE-2018-16626