Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-18759 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:16:00.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150015/Modbus-Slave-7.0.0-Denial-Of-Service.html - https://www.exploit-db.com/exploits/45732/
CVE ID: CVE-2018-18760 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:16:00.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: RhinOS 3.0 build 1190 allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45729/ - http://packetstormsecurity.com/files/150018/RhinOS-CMS-3.x-Arbitrary-File-Download.html
CVE ID: CVE-2018-18761 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:16:00.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45731/
CVE ID: CVE-2018-18762 State: PUBLISHED Published: 2019-03-17T19:17:52 Last Updated: 2024-08-05T11:16:00.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: SaltOS 3.1 r8126 contains a database download vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150005/SaltOS-Erp-Crm-3.1-r8126-Database-Download.html - https://www.exploit-db.com/exploits/45734/
CVE ID: CVE-2018-18763 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:16:00.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150004/SaltOS-Erp-Crm-3.1-r8126-SQL-Injection.html - https://www.exploit-db.com/exploits/45733/
CVE ID: CVE-2018-18764 State: PUBLISHED Published: 2018-10-28T19:00:00Z Last Updated: 2024-09-16T19:05:17.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https:/
over the network to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow2.md - https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow1.md
CVE ID: CVE-2018-18765 State: PUBLISHED Published: 2018-10-28T19:00:00 Last Updated: 2024-08-05T11:16:00.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http
et over the network to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/thracky/status/1059472674940993541 - https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.md
CVE ID: CVE-2018-18766 State: PUBLISHED Published: 2019-03-29T20:19:07 Last Updated: 2024-08-05T11:16:00.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: An elevation of privilege vulnerability exists in the Call Dispatcher in Provisio SiteKiosk before 9.7.4905. Additional Analyst Notes: - CVE Program Container: References: - https://www.provisio.com/en-US/Downloads/VersionHistory.aspx?Product=SiteKiosk
CVE ID: CVE-2018-18767 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T11:16:00.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials. Additional Analyst Notes: - CVE Program Container: References: - https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-m
ditional Analyst Notes: - CVE Program Container: References: - https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/
CVE ID: CVE-2018-18771 State: PUBLISHED Published: 2018-10-29T02:00:00Z Last Updated: 2024-09-17T01:16:36.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LuLu CMS through 2015-05-14. backend\modules\filemanager\controllers\DefaultController.php allows arbitrary file upload by entering a filename, directory name, and PHP code into the three text input fields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yiifans/lulucms/issues/6
CVE ID: CVE-2018-18772 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:16:00.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45822/ - http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-XSS-CSRF-Code-Execution.html - http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-Root-Account-Takeover-Command-Execution.html
CVE ID: CVE-2018-18773 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:16:00.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45822/ - http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-XSS-CSRF-Code-Execution.html - http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-Root-Account-Takeover-Command-Execution.html
CVE ID: CVE-2018-18774 State: PUBLISHED Published: 2018-11-20T19:00:00 Last Updated: 2024-08-05T11:16:00.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45822/ - http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-XSS-CSRF-Code-Execution.html - http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-Root-Account-Takeover-Command-Execution.html
CVE ID: CVE-2018-18775 State: PUBLISHED Published: 2018-11-01T17:00:00 Last Updated: 2024-08-05T11:16:00.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter. NOTE: this is a deprecated product. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45755/ - http://packetstormsecurity.com/files/150059/Microstrategy-Web-7-Cross-Site-Scripting-Traversal.html
CVE ID: CVE-2018-18776 State: PUBLISHED Published: 2018-11-01T17:00:00 Last Updated: 2024-08-05T11:16:00.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the admin/admin.asp ShowAll parameter. NOTE: this is a deprecated product. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45755/ - http://packetstormsecurity.com/files/150059/Microstrategy-Web-7-Cross-Site-Scripting-Traversal.html
CVE ID: CVE-2018-18777 State: PUBLISHED Published: 2018-11-01T17:00:00 Last Updated: 2024-08-05T11:16:00.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application. NOTE: this is a deprecated product. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45755/ - http://packetstormsecurity.com/files/150059/Microstrategy-Web-7-Cross-Site-Scriptin
www.exploit-db.com/exploits/45755/ - http://packetstormsecurity.com/files/150059/Microstrategy-Web-7-Cross-Site-Scripting-Traversal.html
CVE ID: CVE-2018-18778 State: PUBLISHED Published: 2018-10-29T02:00:00Z Last Updated: 2024-09-17T01:10:35.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACME mini_httpd before 1.30 lets remote users read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://www.acme.com/software/mini_httpd/
CVE ID: CVE-2018-18781 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:16:00.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ky-j/dedecms/issues/9
CVE ID: CVE-2018-18782 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:16:00.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ky-j/dedecms/issues/10
CVE ID: CVE-2018-18783 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:16:00.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS was discovered in SEMCMS V3.4 via the semcms_remail.php?type=ok umail parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/m3lon/2018_Recorder/blob/master/SEMCMS%20DOM%20Based%20XSS.md
CVE ID: CVE-2018-18784 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:16:00.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. (This needs an admin user login.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18785 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:16:00.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zs/subzs.php with a zzcmscpid cookie to zs/search.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18786 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:23:06.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in ajax/zs.php via a pxzs cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18787 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:23:06.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs.php via a pxzs cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18788 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:23:06.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. (This needs an admin user login.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18789 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:23:07.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zt/top.php via a Host HTTP header to zt/news.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18790 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:23:07.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in admin/special_add.php via a zxbigclassid cookie. (This needs an admin user login.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18791 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:23:06.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18792 State: PUBLISHED Published: 2018-10-29T05:00:00 Last Updated: 2024-08-05T11:23:06.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs_list.php via a pxzs cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE ID: CVE-2018-18793 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:06.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45723/ - http://packetstormsecurity.com/files/150006/School-Event-Management-System-1.0-Shell-Upload.html
CVE ID: CVE-2018-18794 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:06.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Event Management System 1.0 allows CSRF via user/controller.php?action=edit. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45724/ - http://packetstormsecurity.com/files/150007/School-Event-Management-System-1.0-Cross-Site-Request-Forgery.html
CVE ID: CVE-2018-18795 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:06.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150014/School-Event-Management-System-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/45722/
CVE ID: CVE-2018-18796 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:07.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System 1.0 has SQL Injection via the "Search for Books" screen. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149987/Library-Management-System-1.0-SQL-Injection.html
CVE ID: CVE-2018-18797 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:08.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45725/ - http://packetstormsecurity.com/files/150008/School-Attendance-Monitoring-System-1.0-Cross-Site-Request-Forgery.html
CVE ID: CVE-2018-18798 State: PUBLISHED Published: 2019-03-17T19:33:58 Last Updated: 2024-08-05T11:23:07.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150010/School-Attendance-Monitoring-System-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/45727/
CVE ID: CVE-2018-18799 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:07.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150009/School-Attendance-Monitoring-System-1.0-Shell-Upload.html - https://www.exploit-db.com/exploits/45726/
CVE ID: CVE-2018-18800 State: PUBLISHED Published: 2019-05-14T14:13:25 Last Updated: 2024-08-05T11:23:08.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45728/ - http://packetstormsecurity.com/files/150019/PayPal-Credit-Card-Debit-Card-Payment-1.0-SQL-Injection.html
CVE ID: CVE-2018-18801 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:08.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=[SQL] or index.php?q=single-item&id=[SQL]. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150017/E-Negosyo-System-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/45730/
CVE ID: CVE-2018-18802 State: PUBLISHED Published: 2019-06-18T15:20:05 Last Updated: 2024-08-05T11:23:08.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod_users/controller.php?action=edit. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45718
CVE ID: CVE-2018-18803 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:06.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45719/ - http://packetstormsecurity.com/files/150011/Curriculum-Evaluation-System-1.0-SQL-Injection.html
CVE ID: CVE-2018-18804 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:07.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45720/ - http://packetstormsecurity.com/files/150012/Bakeshop-Inventory-System-In-VB.Net-MS-Access-Database-1.0-SQL-Injection.html
CVE ID: CVE-2018-18805 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:08.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45721/ - http://packetstormsecurity.com/files/150013/Point-Of-Sales-POS-In-VB.Net-MYSQL-Database-1.0-SQL-Injection.html - https://www.sourcecodester.com/visual-basic-net/12655/point-sales-pos-vbnet-and-mysql-database.html
CVE ID: CVE-2018-18806 State: PUBLISHED Published: 2018-11-16T18:00:00 Last Updated: 2024-08-05T11:23:08.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149996/School-Equipment-Monitoring-System-1.0-SQL-Injection.html
CVE ID: CVE-2018-18807 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-16T19:51:25.569Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H) Vendors: TIBCO Software Inc. Products: TIBCO Statistica Server Problem Types: The impact of this vulnerability includes the theoretical possibility that an authenticated user could escalate privileges to gain administrative access to the web interface of the affected component. Description: The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS) attacks. Affected rele
tains vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and including 13.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-26-2018-tibco-statistica-server - http://www.tibco.com/services/support/advisories - http://www.securityfocus.com/bid/106021
CVE ID: CVE-2018-18808 State: PUBLISHED Published: 2019-03-07T22:00:00Z Last Updated: 2024-09-16T19:46:17.061Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS Problem Types: The impact of this vulnerability includes the theoretical possibility of gaining system admin access to the JasperReports Server process. Description: The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO Jaspe