Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-10233 State: PUBLISHED Published: 2018-04-23T14:00:00 Last Updated: 2024-08-05T07:32:01.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RiieCco/write-ups/tree/master/CVE-2018-10233 - https://wordpress.org/plugins/ultimate-member/#developers - https://wpvulndb.com/vulnerabilities/9611
CVE ID: CVE-2018-10234 State: PUBLISHED Published: 2018-04-23T14:00:00 Last Updated: 2024-08-05T07:32:01.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RiieCco/write-ups/tree/master/CVE-2018-10234 - https://wordpress.org/plugins/ultimate-member/#developers
CVE ID: CVE-2018-10235 State: PUBLISHED Published: 2018-04-19T18:00:00 Last Updated: 2024-08-05T07:32:01.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacker can control the value of $cache['setting']['ucssocfg'] in diy\module\member\models\Member_model.php and write this code into the api/ucsso/config.php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/myndtt/vulnerability/blob/master/poscms/3-2-10.md
CVE ID: CVE-2018-10236 State: PUBLISHED Published: 2018-04-19T18:00:00 Last Updated: 2024-08-05T07:32:01.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker can control the value of $data['name'] with no restrictions, and this value is written to the FCPATH.$file file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/myndtt/vulnerability/blob/master/poscms/3-2-18.md
CVE ID: CVE-2018-10237 State: PUBLISHED Published: 2018-04-26T21:00:00 Last Updated: 2024-08-05T07:32:01.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. Additional Analyst Notes: - CVE Program C
iate checks on what a client has sent and whether the data size is reasonable. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2428 - https://access.redhat.com/errata/RHSA-2018:2740 - https://access.redhat.com/errata/RHSA-2018:2741 - https://access.redhat.com/errata/RHSA-2018:2742 - https://access.redhat.com/errata/RHSA-2018:2598 - https://access.redhat.com/errata/RHSA-2018:2643 - https://access.redhat.com/errata/RHSA-2018:2424 - https://access.redhat.com/errata/RHSA-2018:2423 - https://access.redhat.com/errata/RHSA-2018:2425 - https://access.redhat.com/errata/RHSA-2018:2927 - http://www.securitytracker.com/id/1041707 - https://acce
A-2018:2425 - https://access.redhat.com/errata/RHSA-2018:2927 - http://www.securitytracker.com/id/1041707 - https://access.redhat.com/errata/RHSA-2018:2743 - https://lists.apache.org/thread.html/cc48fe770c45a74dc3b37ed0817393e0c96701fc49bc431ed922f3cc%40%3Chdfs-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/19fa48533bc7ea1accf6b12746a74ed888ae6e49a5cf81ae4f807495%40%3Ccommon-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/3ddd79c801edd99c0978e83dbe2168ebd36fd42acfa5dac38fb03dd6%40%3Cissues.activemq.apache.org%3E - https://lists.apa
ead.html/3ddd79c801edd99c0978e83dbe2168ebd36fd42acfa5dac38fb03dd6%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/3d5dbdd92ac9ceaef90e40f78599f9109f2f345252e0ac9d98e7e084%40%3Cgitbox.activemq.apache.org%3E - https://lists.apache.org/thread.html/33c6bccfeb7adf644d4d79894ca8f09370be6ed4b20632c2e228d085%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:2858 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/e
html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/r27eb79a87a760335226dbfa6a7b7bffea539a535f8e80c41e482106d%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/r95799427b335807a4c54776908125c3e66597b65845ae50096d9278a%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/rc78f6e84f82cc66286
6908125c3e66597b65845ae50096d9278a%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/rc78f6e84f82cc662860e96526d8ab969f34dbe12dc560e22d9d147a3%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E - https://lists.apache.org/thread.html/rd0c8ec6e044aa2958dd0549ebf8ecead7f5968c9474ba73a504161b2%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/r38e2ab87528d3c904e7fac496e8fd766b9277656ff95b97d6b6b6dcd%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/r2ea4e5e5aa8ad73b001a466c582899620961f47d77a40af712c1fdf9%40%3Cdev.cxf.apache.org%3E - https://list
ache.org/thread.html/r2ea4e5e5aa8ad73b001a466c582899620961f47d77a40af712c1fdf9%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540%40%3Cdev.syncope.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/rc8467f357b943ceaa86f289f8bc1a5d1c7955b75d3bac1426f2d4ac1%40%3Ccommon-dev.hadoop.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html - https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion - https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cdev.flink.apache.org%3E - https://lists.ap
rg/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cdev.flink.apache.org%3E - https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cuser.flink.apache.org%3E - https://lists.apache.org/thread.html/r50fc0bcc734dd82e691d36d209258683141bfc0083739a77e56ad92d%40%3Cdev.flink.apache.org%3E - https://lists.apache.org/thread.html/rdc56c15693c236e31e1e95f847b8e5e74fc0a05741d47488e7fc8c45%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/ra8906723927aef2a599398c238eacfc845b74d812e0093ec2fc70a7d%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/ra4f44016926dcb034b3b230280a18102062f94ae55b8a31
%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/ra4f44016926dcb034b3b230280a18102062f94ae55b8a31bb92fed84%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/rb3da574c34bc6bd37972d2266af3093b90d7e437460423c24f477919%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r223bc776a077d0795786c38cbc6e7dd808fce1a9161b00ba9c0a5d55%40%3Cissues.lucene.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5f6ba%40%3Cissues.maven.apache.org%3E - https://lists.apache.org/thread.html/r22c8173b804cd4a420c43064ba4e363d0022aa421008b1989f7
3Cissues.maven.apache.org%3E - https://lists.apache.org/thread.html/r22c8173b804cd4a420c43064ba4e363d0022aa421008b1989f7354d4%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E - https://lists.apache.org/thread.html/r30e7d7b6bfa630dacc41649a0e96dad75165d50474c1241068aa0f94%40%3Cissues.storm.apache.org%3E - https://lists.apache.org/thread.html/r3c3b33ee5bef0c67391d27a97cbfd89d44f328cf072b601b58d4e748%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rd01f5ff0164c468ec7abc96ff7646cea3cce6378da2e4aa29c6bcb95%40%3Cgithub.arrow.apache.org%3E - https://www.oracle.co
d.html/rd01f5ff0164c468ec7abc96ff7646cea3cce6378da2e4aa29c6bcb95%40%3Cgithub.arrow.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20220629-0008/
CVE ID: CVE-2018-10238 State: PUBLISHED Published: 2018-04-20T07:00:00 Last Updated: 2024-08-05T07:32:01.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation. The affected component is bacserv BACnet/IP BVLC forwarded NPDU. The function bvlc_bdt_forward_npdu() calls bvlc_encode_forwarded_npdu() which copies the content from the request into a local in the bvlc_bdt_forward_npdu() stack frame and clobbers the canary. The attack vector is: A BACnet/IP device with BBMD enabled based on this library connected to IP network. The fixed version is: 0.8
vector is: A BACnet/IP device with BBMD enabled based on this library connected to IP network. The fixed version is: 0.8.6. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/bacnet/code/3168/ - https://sourceforge.net/p/bacnet/code/3169/ - https://sourceforge.net/p/bacnet/bugs/55/
CVE ID: CVE-2018-10239 State: PUBLISHED Published: 2019-06-17T14:49:58 Last Updated: 2024-08-05T07:32:01.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to temporarily gain additional privileges on an affected device and perform actions within the super user scope. The vulnerability is due to a weakness in the "support access" password generation algorithm. A locally authenticated administrative user may be able to exploit this vulnerability if the "support access" feature is enabled, they know the support access code for th
able to exploit this vulnerability if the "support access" feature is enabled, they know the support access code for the current session, and they know the algorithm to generate the support access password from the support access code. "Support access" is disabled by default. When enabled, the access will be automatically disabled (and support access code will expire) after the 24 hours. Additional Analyst Notes: - CVE Program Container: References: - https://community.infoblox.com/t5/Security-Blog/10427-NIOS-Privilege-Escalation-Vulnerability/ba-p/17309
CVE ID: CVE-2018-10240 State: PUBLISHED Published: 2018-05-16T14:00:00 Last Updated: 2024-08-05T07:32:01.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user's session. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/05/solarwinds-serv-u-managed-file-transfer-insufficient-session-id-entropy/
CVE ID: CVE-2018-10241 State: PUBLISHED Published: 2018-05-16T14:00:00 Last Updated: 2024-08-05T07:32:01.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereference) via a specially crafted URL beginning with the /Web%20Client/ substring. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/05/solarwinds-serv-u-managed-file-transfer-denial-of-service/
CVE ID: CVE-2018-10242 State: PUBLISHED Published: 2019-04-04T14:59:50 Last Updated: 2024-08-05T07:32:01.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data because SSHParseBanner in app-layer-ssh.c lacks a length check. Additional Analyst Notes: - CVE Program Container: References: - https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/ - https://lists.debian.org/debian-lts-announce/2019/04/msg00010.html
CVE ID: CVE-2018-10243 State: PUBLISHED Published: 2019-04-04T15:10:21 Last Updated: 2024-08-05T07:32:01.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header. Additional Analyst Notes: - CVE Program Container: References: - https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/ - https://lists.debian.org/debian-lts-announce/2019/04/msg00010.html
CVE ID: CVE-2018-10244 State: PUBLISHED Published: 2019-04-04T15:04:13 Last Updated: 2024-08-05T07:32:01.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated data because DecodeENIPPDU in app-layer-enip-commmon.c has an integer overflow during a length check. Additional Analyst Notes: - CVE Program Container: References: - https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/
CVE ID: CVE-2018-10245 State: PUBLISHED Published: 2018-04-20T17:00:00Z Last Updated: 2024-09-16T20:32:47.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theyiyibest/AWStatsFullPathDisclosure
CVE ID: CVE-2018-10248 State: PUBLISHED Published: 2018-04-20T17:00:00Z Last Updated: 2024-09-17T02:42:09.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycle_delete. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/130
CVE ID: CVE-2018-10249 State: PUBLISHED Published: 2018-04-20T19:00:00 Last Updated: 2024-08-05T07:32:01.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://crayon-xin.github.io/2018/04/20/baijiacmsV3-CSRF-add-admin/
CVE ID: CVE-2018-10250 State: PUBLISHED Published: 2018-04-20T18:00:00Z Last Updated: 2024-09-16T17:57:53.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixin_category action, aka a WeChat Classified Management keyword search. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/22
CVE ID: CVE-2018-10251 State: PUBLISHED Published: 2018-05-04T20:00:00 Last Updated: 2024-08-05T07:32:01.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wirele
ferences: - https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/
CVE ID: CVE-2018-10252 State: PUBLISHED Published: 2018-05-14T14:00:00 Last Updated: 2024-08-05T07:32:01.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its current time of day in responses, it is possible to step backward through possible session values until a working one is found. Once a working session ID is found, an attacker then has admin control of the device and can add a secondary
is found. Once a working session ID is found, an attacker then has admin control of the device and can add a secondary SSID to create a backdoor to the network. Additional Analyst Notes: - CVE Program Container: References: - https://actiontecsupport.zendesk.com/hc/en-us/articles/115000432163-WCB6200Q-Firmware-Upgrade
CVE ID: CVE-2018-10253 State: PUBLISHED Published: 2018-04-21T02:00:00 Last Updated: 2024-08-05T07:32:01.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Paessler PRTG Network Monitor before 18.1.39.1648 mishandles stack memory during unspecified API calls. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44500/ - https://www.paessler.com/prtg/history/preview
CVE ID: CVE-2018-10254 State: PUBLISHED Published: 2018-04-21T16:00:00 Last Updated: 2024-08-05T07:32:01.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwide Assembler (NASM) 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file. Remote attackers could leverage this vulnerability to cause a denial of service or possibly have unspecified other impact via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/nasm/bugs/561/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html
CVE ID: CVE-2018-10255 State: PUBLISHED Published: 2018-05-01T19:00:00 Last Updated: 2024-08-05T07:32:01.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147363/Blog-Master-Pro-1.0-CSV-Injection.html - https://www.exploit-db.com/exploits/44535/
CVE ID: CVE-2018-10256 State: PUBLISHED Published: 2018-05-01T19:00:00 Last Updated: 2024-08-05T07:32:01.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44537/ - http://packetstormsecurity.com/files/147366/HRSALE-The-Ultimate-HRM-1.0.2-SQL-Injection.html
CVE ID: CVE-2018-10257 State: PUBLISHED Published: 2018-05-01T19:00:00 Last Updated: 2024-08-05T07:32:01.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147364/HRSALE-The-Ultimate-HRM-1.0.2-CSV-Injection.html - https://www.exploit-db.com/exploits/44536/
CVE ID: CVE-2018-10258 State: PUBLISHED Published: 2018-05-01T19:00:00 Last Updated: 2024-08-05T07:32:01.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147362/Shopy-Point-Of-Sale-1.0-CSV-Injection.html - https://www.exploit-db.com/exploits/44534/
CVE ID: CVE-2018-10259 State: PUBLISHED Published: 2018-05-01T19:00:00 Last Updated: 2024-08-05T07:32:01.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147383/HRSALE-The-Ultimate-HRM-1.0.2-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/44538/
CVE ID: CVE-2018-10260 State: PUBLISHED Published: 2018-05-01T19:00:00 Last Updated: 2024-08-05T07:32:01.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44539/ - http://packetstormsecurity.com/files/147382/HRSALE-The-Ultimate-HRM-1.0.2-Local-File-Inclusion.html
CVE ID: CVE-2018-10265 State: PUBLISHED Published: 2018-04-21T17:00:00 Last Updated: 2024-08-05T07:32:01.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Neeke/HongCMS/issues/1
CVE ID: CVE-2018-10266 State: PUBLISHED Published: 2018-04-21T17:00:00 Last Updated: 2024-08-05T07:32:01.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/beescms/issues/1
CVE ID: CVE-2018-10267 State: PUBLISHED Published: 2018-04-21T17:00:00 Last Updated: 2024-08-05T07:32:01.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taosir/wtcms/issues/1 - https://www.hackpwn.me/2018/04/21/1/