Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1000113 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-16T16:18:16.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-731
CVE ID: CVE-2018-1000114 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-16T23:16:12.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-746
CVE ID: CVE-2018-1000115 State: PUBLISHED Published: 2018-03-05T14:00:00 Last Updated: 2024-08-05T12:33:49.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default. Additional Analyst Notes: - CVE Progr
s to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHBA-2018:2140 - https://access.redhat.com/errata/RHSA-2018:1593 - https://usn.ubuntu.com/3588-1/ - https://github.com/memcached/memcached/wiki/ReleaseNotes156 - https://www.exploit-db.com/exploits/44264/ - https://twitter.com/dormando/status/968579781729009664 - https://www.exploit-db.com/exploits/44265/ - https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974 - https://access.redhat.com/errata/RHSA-2018:2857 - https://access.redhat.com/errata/RHSA-2018:1627 - https://access.redhat
ttps://access.redhat.com/errata/RHSA-2018:2857 - https://access.redhat.com/errata/RHSA-2018:1627 - https://access.redhat.com/errata/RHSA-2018:2331 - https://www.debian.org/security/2018/dsa-4218 - https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html - https://github.com/memcached/memcached/issues/348 - https://www.synology.com/support/security/Synology_SA_18_07
CVE ID: CVE-2018-1000116 State: PUBLISHED Published: 2018-03-07T14:00:00 Last Updated: 2024-08-05T12:33:49.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4154 - https://lists.debian.org/debian-lts-announce/2018/03/msg00020.html - https://sourceforge.net/p/net-snmp/bugs/2821/
CVE ID: CVE-2018-1000117 State: PUBLISHED Published: 2018-03-07T14:00:00Z Last Updated: 2024-09-17T01:37:10.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python/cpython/pull/59
.0 and 3.6.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python/cpython/pull/5989 - https://bugs.python.org/issue33001
CVE ID: CVE-2018-1000118 State: PUBLISHED Published: 2018-03-07T14:00:00Z Last Updated: 2024-09-16T17:23:13.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it. Additional Analyst Notes:
y the black list used was not case insensitive allowing an attacker to potentially bypass it. Additional Analyst Notes: - CVE Program Container: References: - https://electronjs.org/releases#1.8.2-beta.5 - https://github.com/electron/electron/commit/ce361a12e355f9e1e99c989f1ea056c9e502dbe7
CVE ID: CVE-2018-1000119 State: PUBLISHED Published: 2018-03-07T14:00:00 Last Updated: 2024-08-05T12:33:49.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sinatra/rack-protection/pull/98 - https://access.redhat.com/errata/RHSA-2018:1060 - https://www.debian.org/security
.com/sinatra/rack-protection/pull/98 - https://access.redhat.com/errata/RHSA-2018:1060 - https://www.debian.org/security/2018/dsa-4247 - https://github.com/sinatra/sinatra/commit/8aa6c42ef724f93ae309fb7c5668e19ad547eceb#commitcomment-27964109
CVE ID: CVE-2018-1000120 State: PUBLISHED Published: 2018-03-14T18:00:00 Last Updated: 2024-08-05T12:33:49.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://access.redhat.com/errata/RHSA-2018:3558 - https://access.redhat.com/errata/RHSA-2018:3157 - https://www.debian.org/security/2018/dsa-4136 - htt
a/RHSA-2018:3558 - https://access.redhat.com/errata/RHSA-2018:3157 - https://www.debian.org/security/2018/dsa-4136 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html - http://www.securityfocus.com/bid/103414 - https://usn.ubuntu.com/3598-1/ - http://www.securitytracker.com/id/1040531 - https://curl.haxx.se/docs/adv_2018-9cd6.html - https://usn.ubuntu.com/3598-2/ - https://access.redhat.com/errata/RHBA-2019:0327 - https://access.redhat.com/errata/RHSA-2019:1543 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoc
e.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2020:0544 - https://access.redhat.com/errata/RHSA-2020:0594
CVE ID: CVE-2018-1000121 State: PUBLISHED Published: 2018-03-14T18:00:00 Last Updated: 2024-08-05T12:33:49.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://access.redhat.com/errata/RHSA-2018:3558 - https://access.redhat.com/errata/RHSA-2018:3157 - https://www.debian.org/security/2018/dsa-4136 - http://www.
018:3558 - https://access.redhat.com/errata/RHSA-2018:3157 - https://www.debian.org/security/2018/dsa-4136 - http://www.securityfocus.com/bid/103415 - http://www.securitytracker.com/id/1040529 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://curl.haxx.se/docs/adv_2018-97a2.html - https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html - https://usn.ubuntu.com/3598-1/ - https://usn.ubuntu.com/3598-2/ - https://access.redhat.com/errata/RHBA-2019:0327 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://access.redhat.com/errata/RHSA-2020:0544 - https://access.redhat.com/errata/RHSA-2020:0594
CVE ID: CVE-2018-1000122 State: PUBLISHED Published: 2018-03-14T18:00:00 Last Updated: 2024-08-05T12:33:49.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103436 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://access.redhat.com/errata/RHSA-2018:3558 - https://access.redhat.com/errata/RHSA-2
sory/cpujan2019-5072801.html - https://access.redhat.com/errata/RHSA-2018:3558 - https://access.redhat.com/errata/RHSA-2018:3157 - https://www.debian.org/security/2018/dsa-4136 - https://curl.haxx.se/docs/adv_2018-b047.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html - http://www.securitytracker.com/id/1040530 - https://usn.ubuntu.com/3598-1/ - https://usn.ubuntu.com/3598-2/ - https://access.redhat.com/errata/RHBA-2019:0327 - https://access.redhat.com/errata/RHSA-2019:1543 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://access.redhat.com/errata/RHSA-
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://access.redhat.com/errata/RHSA-2020:0544 - https://access.redhat.com/errata/RHSA-2020:0594
CVE ID: CVE-2018-1000123 State: PUBLISHED Published: 2018-03-13T21:00:00Z Last Updated: 2024-09-16T20:21:48.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ionic Team Cordova plugin iOS Keychain version before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf contains an Information Exposure Through Log Files (CWE-532) vulnerability in CDVKeychain.m that can result in login, password and other sensitive data leakage. This attack appear to be exploitable via Attacker must have access to victim's iOS logs. This vulnerability appears to have been fixed in after commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf. Additional Analyst Notes: - CVE Program Container: References: - https:/
ommit 18233ca25dfa92cca018b9c0935f43f78fd77fbf. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ionic-team/cordova-plugin-ios-keychain/pull/29/commits/980230645c8ea3b531b85401de5e4bca0f860e42#diff-936020291e4c2115faff0171f20672a4
CVE ID: CVE-2018-1000124 State: PUBLISHED Published: 2018-03-13T21:00:00Z Last Updated: 2024-09-17T02:01:01.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter form_import_textarea. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mkucej/i-librarian/issues/116
CVE ID: CVE-2018-1000125 State: PUBLISHED Published: 2018-03-13T21:00:00Z Last Updated: 2024-09-16T18:18:20.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack appear to be exploitable via an attacker crafting a token with a valid header and body and then requests it to be validated. This vulnerability appears to have been fixed in 1.3.0 and later or after commit 0d94dcef0133d699f21d217e9225
validated. This vulnerability appears to have been fixed in 1.3.0 and later or after commit 0d94dcef0133d699f21d217e922564adbb83a227. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inversoft/prime-jwt/blob/master/CHANGES - https://github.com/inversoft/prime-jwt/issues/2
CVE ID: CVE-2018-1000126 State: PUBLISHED Published: 2018-03-13T21:00:00Z Last Updated: 2024-09-16T23:27:02.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee
CVE ID: CVE-2018-1000127 State: PUBLISHED Published: 2018-03-13T21:00:00 Last Updated: 2024-08-05T12:33:49.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2290 - https://lists.debian.org/debian-lts-announce/
Container: References: - https://access.redhat.com/errata/RHSA-2018:2290 - https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html - https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00 - https://usn.ubuntu.com/3601-1/ - https://www.debian.org/security/2018/dsa-4218 - https://github.com/memcached/memcached/wiki/ReleaseNotes1437 - https://github.com/memcached/memcached/issues/271
CVE ID: CVE-2018-1000128 State: REJECTED Published: 2018-03-13T21:00:00 Last Updated: 2018-03-14T12:57:01 Description: No description available.
CVE ID: CVE-2018-1000129 State: PUBLISHED Published: 2018-03-14T13:00:00 Last Updated: 2024-08-05T12:33:49.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad - https://access.redhat.com/errata/RHSA-2018:3817 - https://jolokia.org/#Security_fixes_with_1.5.0 - https://access.redhat.com/errata/RHSA-2018:2669
CVE ID: CVE-2018-1000130 State: PUBLISHED Published: 2018-03-14T13:00:00 Last Updated: 2024-08-05T12:33:49.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server. Additional Analyst Notes: - CVE Program Container: References: - https://jolokia.org/#Security_fixes_with_1.5.0 - https://access.redhat.com/errata/RHSA-2018:2669
CVE ID: CVE-2018-1000131 State: PUBLISHED Published: 2018-03-14T13:00:00 Last Updated: 2024-08-05T12:33:49.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9041 - https://github.com/00theway/exp/blob/master/
rogram Container: References: - https://wpvulndb.com/vulnerabilities/9041 - https://github.com/00theway/exp/blob/master/wordpress/wpsupportplus.md - https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers
CVE ID: CVE-2018-1000132 State: PUBLISHED Published: 2018-03-14T13:00:00 Last Updated: 2024-08-05T12:33:49.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html - https://www.mercurial-scm.org/wiki/WhatsNew#Mercu
- https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29 - https://access.redhat.com/errata/RHSA-2019:2276 - https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
CVE ID: CVE-2018-1000133 State: PUBLISHED Published: 2018-03-16T14:04:00Z Last Updated: 2024-09-17T03:48:53.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to login, and could edit their profile and set the "System Administrator" permission to "yes" on themselves.. This vulnerability appears to have been fixed in 1.4.6 RC2. Additional Analyst Notes: - CVE Program Container: References:
s vulnerability appears to have been fixed in 1.4.6 RC2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tridentli/trident/releases/tag/DEV_1.4.6-RC2 - https://github.com/tridentli/pitchfork/issues/168 - https://github.com/tridentli/pitchfork/commit/9fd07cbe4f93e1367e142016e9a205366680dd54 - https://thomas-ward.net/security-advisories/trident-trusted-communications-platform-privilege-escalation-issue-advisory/ - https://github.com/tridentli/pitchfork/commit/33549f15707801099e1253dd5e79369bd48eb59b
CVE ID: CVE-2018-1000134 State: PUBLISHED Published: 2018-03-16T14:04:00 Last Updated: 2024-08-05T12:33:49.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonat
/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1713 - http://www.securityfocus.com/bid/103458 - https://github.com/pingidentity/ldapsdk/issues/40
CVE ID: CVE-2018-1000135 State: PUBLISHED Published: 2018-03-20T13:00:00 Last Updated: 2024-08-05T12:33:49.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla
t appear to be available at this time. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.gnome.org/show_bug.cgi?id=746422 - http://www.securityfocus.com/bid/103478 - https://bugzilla.redhat.com/show_bug.cgi?id=1553634 - https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1754671 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00005.html
CVE ID: CVE-2018-1000136 State: PUBLISHED Published: 2018-03-23T19:00:00 Last Updated: 2024-08-05T12:33:49.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.electronjs.o
n 1.7.13, 1.8.4, 2.0.0-beta.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.electronjs.org/blog/webview-fix - https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/
CVE ID: CVE-2018-1000137 State: PUBLISHED Published: 2018-03-23T21:00:00Z Last Updated: 2024-09-16T22:29:54.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password of the admin being forced to be changed without the administrator's knowledge. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mkucej/i-librarian/issues/121
CVE ID: CVE-2018-1000138 State: PUBLISHED Published: 2018-03-23T21:00:00Z Last Updated: 2024-09-16T20:58:08.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal resources. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mkucej/i-librarian/issues/120 - https://github.com/mkucej/i-librarian/blob/9535753a84bc615b210802d4c9542db73368d984/functions.php#L811