Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-12448 State: PUBLISHED Published: 2018-08-02T13:00:00 Last Updated: 2024-08-05T08:38:05.941Z Vendors: NAVER Corporation Products: Whale Browser Problem Types: CWE-20 Description: Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2018-12448.html
CVE ID: CVE-2018-12449 State: PUBLISHED Published: 2018-10-11T13:00:00 Last Updated: 2024-08-05T08:38:06.398Z Vendors: NAVER Corporation Products: Whale Browser Installer Problem Types: CWE-426 Description: The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2018-12449
CVE ID: CVE-2018-12453 State: PUBLISHED Published: 2018-06-16T17:00:00 Last Updated: 2024-08-05T08:38:05.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44908/ - https://gist.github.com/fakhrizulkifli/34a56d575030682f6c564553c53b82b5 - https://github.com/antirez/redis/commit/c04082cf138f1f51cedf05ee9ad36fb6763cafc6
CVE ID: CVE-2018-12454 State: PUBLISHED Published: 2018-06-17T12:00:00 Last Updated: 2024-08-05T08:38:06.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game
s://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d
CVE ID: CVE-2018-12455 State: PUBLISHED Published: 2018-10-10T21:00:00 Last Updated: 2024-08-05T08:38:05.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Oct/18
CVE ID: CVE-2018-12456 State: PUBLISHED Published: 2018-10-10T21:00:00 Last Updated: 2024-08-05T08:38:05.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Oct/18
CVE ID: CVE-2018-12457 State: PUBLISHED Published: 2018-06-15T14:00:00Z Last Updated: 2024-09-16T19:56:24.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/express-cart?activeTab=versions - https://hackerone.com/reports/343626 - https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b
CVE ID: CVE-2018-12458 State: PUBLISHED Published: 2018-06-15T15:00:00 Last Updated: 2024-08-05T08:38:05.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4249 - https://github.com/FFmpeg/FFmpeg/commit/e1182fac1afba92a4975917823a5f644bee7e6e8 - https://github.com/FFmpeg/FFmpeg/commit/6bbef938839adc55e8e048bc9cc2e0fafe2064df
CVE ID: CVE-2018-12459 State: PUBLISHED Published: 2018-06-15T15:00:00Z Last Updated: 2024-09-16T19:36:55.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/2fc108f60f98cd00813418a8754a46476b404a3c
CVE ID: CVE-2018-12460 State: PUBLISHED Published: 2018-06-15T15:00:00Z Last Updated: 2024-09-16T18:43:34.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI file to MPEG4, leading to a denial of service, related to idctdsp.c and mpegvideo.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/b3332a182f8ba33a34542e4a0370f38b914ccf7d
CVE ID: CVE-2018-12461 State: PUBLISHED Published: 2018-07-10T18:00:00Z Last Updated: 2024-09-16T17:18:10.522Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: NetIQ Products: eDirectory Problem Types: Under some circumstances certificate revocation checks in NetIQ eDirectory versions prior to 9.1.1 do not work. Description: Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation. Additional Analyst Notes: - CVE Program Container: References: - https://www.netiq.com/support/kb/doc.php?id=7016794
CVE ID: CVE-2018-12462 State: PUBLISHED Published: 2018-07-10T19:00:00Z Last Updated: 2024-09-16T18:56:13.274Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: NetIQ Products: iManager Problem Types: NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities. Description: NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://support.microfocus.com/kb/doc.php?id=7016795
CVE ID: CVE-2018-12463 State: PUBLISHED Published: 2018-07-12T16:00:00Z Last Updated: 2024-09-16T22:46:15.424Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Micro Focus Products: Fortify Software Security Center Problem Types: Server-side Request Forgery (SSRF) Description: An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041286 - https://softwaresupp
l Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041286 - https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03201563 - https://www.exploit-db.com/exploits/45027/
CVE ID: CVE-2018-12464 State: PUBLISHED Published: 2018-06-29T16:00:00Z Last Updated: 2024-09-17T01:55:32.229Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Micro Focus Products: Secure Messaging Gateway Problem Types: CWE-89 Description: A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versi
with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5). Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45083/ - https://support.microfocus.com/kb/doc.php?id=7023132 - https://pentest.blog/unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-messaging-gateway/
CVE ID: CVE-2018-12465 State: PUBLISHED Published: 2018-06-29T16:00:00Z Last Updated: 2024-09-16T20:21:55.086Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Micro Focus Products: Secure Messaging Gateway Problem Types: CWE-77 Description: An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affe
uthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that used GWAVA product name (i.e. GWAVA 6.5). Additional Analyst Notes: - CVE Program Container: References: - https://support.microfocus.com/kb/doc.php?id=7023133 - https://www.exploit-db.com/exploits/45083/ - https://pentest.blog/unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-messaging-gateway/
CVE ID: CVE-2018-12466 State: PUBLISHED Published: 2018-08-01T15:00:00Z Last Updated: 2024-09-17T00:40:29.176Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: opensuse Products: openbuildservice Problem Types: CWE-285 Description: openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104958 - https://github.com/openSUSE/open-build-service/commit/f57b660f49f830006766a8d4abc3b4af6e178063 - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-12466
CVE ID: CVE-2018-12467 State: PUBLISHED Published: 2018-08-01T15:00:00Z Last Updated: 2024-09-16T18:34:59.508Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: opensuse Products: openbuildservice Problem Types: CWE-285 Description: Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/open-build-service/commit/f57b660f49f830006766a8d4abc3b4af6e178063 - https://bugzilla.suse.com/show_bug.cgi?id=1100217
CVE ID: CVE-2018-12468 State: PUBLISHED Published: 2018-08-01T20:00:00Z Last Updated: 2024-09-16T19:25:29.758Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Micro Focus Products: GroupWise Problem Types: Arbitrary file upload potentially leading to remote code execution. Description: A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/
mote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7023223
CVE ID: CVE-2018-12469 State: PUBLISHED Published: 2018-10-12T13:00:00Z Last Updated: 2024-09-16T19:46:30.802Z Vendors: Micro Focus Products: Micro Focus Enterprise Developer, Micro Focus Enterprise Server Problem Types: CWE-476 Description: Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination. Additional Analyst Notes: - CVE Program Container: References: - https://com
nial of service due to process termination. Additional Analyst Notes: - CVE Program Container: References: - https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018
CVE ID: CVE-2018-12470 State: PUBLISHED Published: 2018-10-04T14:00:00Z Last Updated: 2024-09-16T18:28:50.344Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Linux Products: SMT Problem Types: CWE-89 Description: A SQL Injection in the RegistrationSharing module of SUSE Linux SMT allows remote attackers to cause execute arbitrary SQL statements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1103810
CVE ID: CVE-2018-12471 State: PUBLISHED Published: 2018-10-04T14:00:00Z Last Updated: 2024-09-17T01:50:45.119Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: SUSE Linux Products: SMT Problem Types: CWE-611 Description: A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1103809
CVE ID: CVE-2018-12472 State: PUBLISHED Published: 2018-10-04T14:00:00Z Last Updated: 2024-09-16T23:31:29.584Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SUSE Linux Products: SMT Problem Types: CWE-287 Description: A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: versions prior to 3.0.37. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1104076
CVE ID: CVE-2018-12473 State: PUBLISHED Published: 2018-10-02T15:00:00Z Last Updated: 2024-09-16T23:21:29.602Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: openSUSE Products: Open Build Service Problem Types: CWE-23 Description: A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to 70d1aa4cc4d7b940180553a63805c22fc62e2cf0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_
0553a63805c22fc62e2cf0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1105361 - https://github.com/openSUSE/obs-service-tar_scm/pull/248
CVE ID: CVE-2018-12474 State: PUBLISHED Published: 2018-10-09T13:00:00Z Last Updated: 2024-09-16T18:19:31.293Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: openSUSE Products: Open Build Service Problem Types: CWE-20 Description: Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to 51a17c553b6ae2598820b7a90fd0c11502a49106. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/obs-s
b7a90fd0c11502a49106. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/obs-service-tar_scm/pull/254 - https://bugzilla.suse.com/show_bug.cgi?id=1107507
CVE ID: CVE-2018-12475 State: PUBLISHED Published: 2020-09-01T11:55:11.943373Z Last Updated: 2024-09-17T00:36:57.174Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: openSUSE Products: Open Build Service Problem Types: CWE-610 Description: A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service . Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.c
en Build Service . Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1107821
CVE ID: CVE-2018-12476 State: PUBLISHED Published: 2020-01-27T08:30:14.943188Z Last Updated: 2024-09-16T20:52:13.615Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 15, Factory Problem Types: CWE-23 Description: Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-serv
SE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1107944
CVE ID: CVE-2018-12477 State: PUBLISHED Published: 2018-10-09T13:00:00Z Last Updated: 2024-09-16T20:32:32.887Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: openSUSE Products: Open Build Service Problem Types: CWE-93 Description: A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1108189
CVE ID: CVE-2018-12478 State: PUBLISHED Published: 2018-10-09T13:00:00Z Last Updated: 2024-09-16T18:44:00.980Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: openSUSE Products: Open Build Service Problem Types: CWE-20 Description: A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs. Affected releases are openSUSE Open Build Service: status of is unknown. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1108280
CVE ID: CVE-2018-12479 State: PUBLISHED Published: 2018-10-09T13:00:00Z Last Updated: 2024-09-16T19:35:16.650Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: openSUSE Products: Open Build Service Problem Types: CWE-20 Description: A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are openSUSE Open Build Service: versions prior to 01b015ca2a320afc4fae823465d1e72da8bd60df. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1108435
CVE ID: CVE-2018-12480 State: PUBLISHED Published: 2018-11-15T13:00:00.000Z Last Updated: 2025-02-13T16:27:15.734Z Vendors: NetIQ eDirectory Products: NetIQ Access Manager (NAM) Problem Types: XSS Description: Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3. Additional Analyst Notes: - CVE Program Container: References: - https://support.microfocus.com/kb/doc.php?id=7023513 - https://www.netiq.com/documentation/access-manager-44/accessmanager443-release-notes/data/accessmanager443-release-notes.html#b149i4n6
CVE ID: CVE-2018-12481 State: PUBLISHED Published: 2018-06-15T16:00:00 Last Updated: 2024-08-05T08:38:05.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the "User password" field with the Drozer post.capture.clipboard module. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/sp5nMhvc
CVE ID: CVE-2018-12482 State: PUBLISHED Published: 2018-08-03T16:00:00 Last Updated: 2024-08-05T08:38:06.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues. Additional Analyst Notes: - CVE Program Container: References: - https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/
CVE ID: CVE-2018-12483 State: PUBLISHED Published: 2018-08-03T16:00:00 Last Updated: 2024-08-05T08:38:06.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscover_analyser rzo GET parameter is concatenated to a string used in an exec() call in the PHP code. Authentication is needed in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/
CVE ID: CVE-2018-12491 State: PUBLISHED Published: 2018-06-15T18:00:00Z Last Updated: 2024-09-16T20:16:59.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by uploading a .php file within a .php.zip archive, a similar issue to CVE-2018-8944. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SukaraLin/php_code_audit_project/blob/master/phpok/Phpok%204.9.032%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md
CVE ID: CVE-2018-12492 State: PUBLISHED Published: 2018-06-15T18:00:00Z Last Updated: 2024-09-17T01:10:30.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SukaraLin/php_code_audit_project/blob/master/phpok/Phpok%204.9.032%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md
CVE ID: CVE-2018-12493 State: PUBLISHED Published: 2018-06-15T18:00:00 Last Updated: 2024-08-05T08:38:06.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsWebFile/list.html?path=../ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sanluan/PublicCMS/issues/12