Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-10545 State: PUBLISHED Published: 2018-04-29T21:00:00 Last Updated: 2024-08-05T07:39:08.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=
HP-FPM worker process. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=75605 - https://usn.ubuntu.com/3646-2/ - http://www.securityfocus.com/bid/104022 - https://www.debian.org/security/2018/dsa-4240 - https://www.tenable.com/security/tns-2018-12 - https://usn.ubuntu.com/3646-1/ - http://php.net/ChangeLog-5.php - https://lists.debian.org/debian-lts-announce/2018/05/msg00004.html - http://php.net/ChangeLog-7.php - https://security.gentoo.org/glsa/201812-01 - https://security.netapp.com/advisory/ntap-20180607-0003/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html - https://access.redhat.com/errata/RHSA-2019:2519
CVE ID: CVE-2018-10546 State: PUBLISHED Published: 2018-04-29T21:00:00 Last Updated: 2024-08-05T07:39:08.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104019 - http://www.securitytracker.com/id/1040807 - https://bugs.php.net/bug.php?id=76249 - https://www.debian.org/security/2018/dsa-4240 - https://www.tenable.com/security/tns-2018-12 - https://usn
hp?id=76249 - https://www.debian.org/security/2018/dsa-4240 - https://www.tenable.com/security/tns-2018-12 - https://usn.ubuntu.com/3646-1/ - http://php.net/ChangeLog-5.php - http://php.net/ChangeLog-7.php - https://security.gentoo.org/glsa/201812-01 - https://security.netapp.com/advisory/ntap-20180607-0003/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html - https://access.redhat.com/errata/RHSA-2019:2519
CVE ID: CVE-2018-10547 State: PUBLISHED Published: 2018-04-29T21:00:00 Last Updated: 2024-08-05T07:39:08.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040807 - https://usn.ubuntu.com/3646-2/ - https://bugs.php.net/bug.php?id=76129 - https://www.debian.org/s
acker.com/id/1040807 - https://usn.ubuntu.com/3646-2/ - https://bugs.php.net/bug.php?id=76129 - https://www.debian.org/security/2018/dsa-4240 - https://www.tenable.com/security/tns-2018-12 - https://usn.ubuntu.com/3646-1/ - http://php.net/ChangeLog-5.php - https://lists.debian.org/debian-lts-announce/2018/05/msg00004.html - http://php.net/ChangeLog-7.php - https://security.netapp.com/advisory/ntap-20180607-0003/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html - https://access.redhat.com/errata/RHSA-2019:2519
CVE ID: CVE-2018-10548 State: PUBLISHED Published: 2018-04-29T21:00:00 Last Updated: 2024-08-05T07:39:08.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104019 - http://www.securitytracker.com/id/1040807 - https://usn.ubuntu.com/3646-2/ - https://bugs.php.net/bug.php?id=76248 - https://www.debian
ritytracker.com/id/1040807 - https://usn.ubuntu.com/3646-2/ - https://bugs.php.net/bug.php?id=76248 - https://www.debian.org/security/2018/dsa-4240 - https://www.tenable.com/security/tns-2018-12 - https://usn.ubuntu.com/3646-1/ - http://php.net/ChangeLog-5.php - https://lists.debian.org/debian-lts-announce/2018/05/msg00004.html - http://php.net/ChangeLog-7.php - https://security.gentoo.org/glsa/201812-01 - https://security.netapp.com/advisory/ntap-20180607-0003/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html - https://access.redhat.com/errata/RHSA-2019:2519 - https://www.tenable.com/security/tns-2019-07
CVE ID: CVE-2018-10549 State: PUBLISHED Published: 2018-04-29T21:00:00 Last Updated: 2024-08-05T07:39:07.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\0' character. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104019 - http://www.securitytracker.com/id/1040807 - https://bugs.php.net/bug.php?id=76130 - https://www.synology.com/support/security/Synolog
curitytracker.com/id/1040807 - https://bugs.php.net/bug.php?id=76130 - https://www.synology.com/support/security/Synology_SA_18_20 - https://www.debian.org/security/2018/dsa-4240 - https://www.tenable.com/security/tns-2018-12 - https://usn.ubuntu.com/3646-1/ - http://php.net/ChangeLog-5.php - http://php.net/ChangeLog-7.php - https://security.gentoo.org/glsa/201812-01 - https://security.netapp.com/advisory/ntap-20180607-0003/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html - https://access.redhat.com/errata/RHSA-2019:2519
CVE ID: CVE-2018-10550 State: PUBLISHED Published: 2018-04-30T04:00:00 Last Updated: 2024-08-05T07:39:07.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/4454
CVE ID: CVE-2018-10553 State: PUBLISHED Published: 2018-04-30T03:00:00 Last Updated: 2024-08-05T07:39:07.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2018/04/few-bugs-in-latest-nagios-xi-5413.html
CVE ID: CVE-2018-10554 State: PUBLISHED Published: 2018-04-30T03:00:00 Last Updated: 2024-08-05T07:39:08.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelper.php opts or background parameter; (4) the i[] array parameter to ajax_handler.php; or (5) the deploynotification.php title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/20
ion.php title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2018/04/few-bugs-in-latest-nagios-xi-5413.html
CVE ID: CVE-2018-10561 State: PUBLISHED Published: 2018-05-04T03:00:00.000Z Last Updated: 2025-10-21T23:45:51.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/107053 - https://www.exploit-db.com/exploits/44576/ - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-rou
bid/107053 - https://www.exploit-db.com/exploits/44576/ - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
CVE ID: CVE-2018-10562 State: PUBLISHED Published: 2018-05-04T03:00:00.000Z Last Updated: 2025-10-21T23:45:51.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/107053 - https://www.exploit-db.com/exploits/44576/ - https
Vulnrichment: References: - http://www.securityfocus.com/bid/107053 - https://www.exploit-db.com/exploits/44576/ - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
CVE ID: CVE-2018-10563 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:39:08.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7). Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/4 - http://blog.n0ipr0cs.io/post/2018/04/29/XSS-Flexense-DiskBoss-Enterprise-all-versions
CVE ID: CVE-2018-10564 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:39:08.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/5 - http://blog.n0ipr0cs.io/post/2018/04/29/XSS-Flexense-DiskBoss-Enterprise-all-versions
CVE ID: CVE-2018-10565 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:39:08.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7. Additional Analyst Notes: - CVE Program Container: References: - http://blog.n0ipr0cs.io/post/2018/04/29/XSS-Flexense-DiskBoss-Enterprise-all-versions - http://seclists.org/fulldisclosure/2018/May/6
CVE ID: CVE-2018-10566 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:39:07.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/7 - http://blog.n0ipr0cs.io/post/2018/04/29/XSS-Flexense-DiskBoss-Enterprise-all-versions
CVE ID: CVE-2018-10567 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:39:08.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/8 - http://blog.n0ipr0cs.io/post/2018/04/29/XSS-Flexense-DiskBoss-Enterprise-all-versions
CVE ID: CVE-2018-10568 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:39:07.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/9 - http://blog.n0ipr0cs.io/post/2018/04/29/XSS-Flexense-DiskBoss-Enterprise-all-versions
CVE ID: CVE-2018-10569 State: PUBLISHED Published: 2018-08-13T17:00:00 Last Updated: 2024-08-05T07:39:08.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/m2to4PWmHkI - https://youtu.be/6d4BPbvddkE
CVE ID: CVE-2018-10570 State: PUBLISHED Published: 2018-04-30T16:00:00Z Last Updated: 2024-09-17T02:52:01.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/9
CVE ID: CVE-2018-10571 State: PUBLISHED Published: 2018-04-30T17:00:00 Last Updated: 2024-08-05T07:39:08.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to interface/billing/get_claim_file.php; (3) formid or (4) formseq parameter to interface/orders/types.php; (5) eraname, (6) paydate, (7) post_to_date, (8) deposit_date, (9) debug, or (10) InsId parameter to interface/billing/sl_eob_process.php; (11) form_source, (12) form_paydate, (13)
e, (9) debug, or (10) InsId parameter to interface/billing/sl_eob_process.php; (11) form_source, (12) form_paydate, (13) form_deposit_date, (14) form_amount, (15) form_name, (16) form_pid, (17) form_encounter, (18) form_date, or (19) form_to_date parameter to interface/billing/sl_eob_search.php; (20) codetype or (21) search_term parameter to interface/de_identification_forms/find_code_popup.php; (22) search_term parameter to interface/de_identification_forms/find_drug_popup.php; (23) search_term parameter to interface/de_identification_forms/find_immunization_popup.php; (24) id parameter to interface/forms/CAMOS/view.php; (25) id parameter to interface/forms/reviewofs/view.php; or (26) list_
) id parameter to interface/forms/CAMOS/view.php; (25) id parameter to interface/forms/reviewofs/view.php; or (26) list_id parameter to library/custom_template/personalize.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/commit/699e3c2ef68545357cac714505df1419b8bf2051 - https://github.com/openemr/openemr/issues/1518 - https://www.open-emr.org/wiki/index.php/Release_Features#Version_5.0.1 - https://github.com/openemr/openemr/pull/1519 - https://csticsfrontline.wordpress.com/2018/05/24/openemr-%E5%BC%B1%E9%BB%9E%E5%88%86%E6%9E%90/
CVE ID: CVE-2018-10572 State: PUBLISHED Published: 2018-04-30T17:00:00 Last Updated: 2024-08-05T07:39:07.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and form_body parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/commit/699e3c2ef68545357cac714505df1419b8bf2051 - https://github.com/openemr/openemr/issues/1518 - https://www.open-emr.org/wiki/index.php/Release_Features#Version_5.0.1 - https://github.com/openemr/openemr/pull/1519 - https://csticsfrontline.wordpre
ndex.php/Release_Features#Version_5.0.1 - https://github.com/openemr/openemr/pull/1519 - https://csticsfrontline.wordpress.com/2018/05/24/openemr-%E5%BC%B1%E9%BB%9E%E5%88%86%E6%9E%90/
CVE ID: CVE-2018-10573 State: PUBLISHED Published: 2018-04-30T17:00:00 Last Updated: 2024-08-05T07:39:08.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/commit/699e3c2ef68545357cac714505df1419b8bf2051 - https://github.com/openemr/openemr/issues/1518 - https://www.open-emr.org/wiki/index.php/Release_Features#Version_5.0.1 - https://github.com/openemr/openemr/pull/1519 - https://csticsfrontline.wordpress.com/2018/05/24/openemr-%E5
sion_5.0.1 - https://github.com/openemr/openemr/pull/1519 - https://csticsfrontline.wordpress.com/2018/05/24/openemr-%E5%BC%B1%E9%BB%9E%E5%88%86%E6%9E%90/
CVE ID: CVE-2018-10574 State: PUBLISHED Published: 2018-04-30T20:00:00Z Last Updated: 2024-09-16T17:43:54.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/335 - https://github.com/bigtreecms/BigTree-CMS/commit/609bd17728ee1db0487a42d96028d30537528ae8
CVE ID: CVE-2018-10575 State: PUBLISHED Published: 2018-04-30T22:00:00 Last Updated: 2024-08-05T07:39:08.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Hardcoded credentials exist for an unprivileged SSH account with a shell of /bin/false. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/wgrd-blog/new-firmware-available-ap100ap102ap200ap300-security-vulnerability-fixes - http://seclists.org/fulldisclosure/2018/May/12 - https://www.exploit-db.com/exploits/45409/ - https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssu
2 - https://www.exploit-db.com/exploits/45409/ - https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000LIy
CVE ID: CVE-2018-10576 State: PUBLISHED Published: 2018-04-30T22:00:00 Last Updated: 2024-08-05T07:39:08.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Point web UI allows authentication using a local system account (instead of the dedicated web-only user). Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/wgrd-blog/new-firmware-available-ap100ap102ap200ap300-security-vulnerability-fixes - http://seclists.org/fulldisclosure/2018/May/12 - https://www.exploit-db.com/exploits/45409/ -
rity-vulnerability-fixes - http://seclists.org/fulldisclosure/2018/May/12 - https://www.exploit-db.com/exploits/45409/ - https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000LIy
CVE ID: CVE-2018-10577 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:39:08.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. File upload functionality allows any users authenticated on the web interface to upload files containing code to the web root, allowing these files to be executed as root. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/12 - https://www.exploit-db.com/exploits/45409/
CVE ID: CVE-2018-10578 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:39:08.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect validation of the "old password" field in the change password form allows an attacker to bypass validation of this field. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/12
CVE ID: CVE-2018-10580 State: PUBLISHED Published: 2018-05-11T14:00:00 Last Updated: 2024-08-05T07:39:07.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147575/MyBB-Latest-Posts-On-Profile-1.1-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/44608/
CVE ID: CVE-2018-10581 State: PUBLISHED Published: 2018-05-01T13:00:00 Last Updated: 2024-08-05T07:39:08.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/4474
CVE ID: CVE-2018-10583 State: PUBLISHED Published: 2018-05-01T16:00:00 Last Updated: 2024-08-05T07:39:08.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2018-10583 - https://access.redhat.com/errata/RHSA-2018:3054 - https://usn.ubuntu.com/3883-1/ - https://ww
g/tracker/CVE-2018-10583 - https://access.redhat.com/errata/RHSA-2018:3054 - https://usn.ubuntu.com/3883-1/ - https://www.exploit-db.com/exploits/44564/ - http://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files/ - https://lists.apache.org/thread.html/6c65f22306c36c95e75f8d2b7f49cfcbeb0a4614245c20934612a39d%40%3Cdev.openoffice.apache.org%3E - https://lists.apache.org/thread.html/0598708912978b27121b2e380b44a225c706aca882cd1da6a955a0af%40%3Cdev.openoffice.apache.org%3E - https://lists.apache.org/thread.html/c8fd59ac77b42aac90eb5c59b87f3ab59b5e0c3bfb4819aa649a2909%40%3Cdev.openoffice.apache.org%3E - http://seclists.org/fulldisclosure/2020/Oct/26
CVE ID: CVE-2018-10585 State: PUBLISHED Published: 2020-09-25T03:25:02 Last Updated: 2024-08-05T07:39:08.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 18 allows remote Denial of Service (XML parsing). Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/whats_new.htm - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2018-10586 State: PUBLISHED Published: 2018-11-01T17:00:00 Last Updated: 2024-08-05T07:39:08.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetGain Enterprise Manager (EM) is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities in versions before 10.1.12. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-003