Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ecurityfocus.com/archive/1/542087/100/0/threaded - http://packetstormsecurity.com/files/148200/WebKitGTK-Data-Leak-Code-Execution.html - http://www.openwall.com/lists/oss-security/2018/06/14/1
CVE ID: CVE-2018-12295 State: PUBLISHED Published: 2019-05-13T12:31:26 Last Updated: 2024-08-05T08:30:59.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12296 State: PUBLISHED Published: 2019-05-13T12:32:56 Last Updated: 2024-08-05T08:30:59.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12297 State: PUBLISHED Published: 2019-05-13T12:33:43 Last Updated: 2024-08-05T08:30:59.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12298 State: PUBLISHED Published: 2019-05-13T12:34:50 Last Updated: 2024-08-05T08:30:59.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12299 State: PUBLISHED Published: 2019-05-13T12:35:33 Last Updated: 2024-08-05T08:30:59.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12300 State: PUBLISHED Published: 2019-05-13T12:36:58 Last Updated: 2024-08-05T08:30:59.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12301 State: PUBLISHED Published: 2019-05-13T12:38:07 Last Updated: 2024-08-05T08:30:59.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or localhost. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12302 State: PUBLISHED Published: 2019-05-13T12:38:56 Last Updated: 2024-08-05T08:30:59.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12303 State: PUBLISHED Published: 2019-05-13T12:39:37 Last Updated: 2024-08-05T08:30:59.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12304 State: PUBLISHED Published: 2019-05-13T12:40:24 Last Updated: 2024-08-05T08:30:59.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: Short Description, Publisher Name, Publisher Contact, or Website URL. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE ID: CVE-2018-12305 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12306 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12307 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12308 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12309 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12310 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12311 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12312 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12313 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12314 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12315 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12316 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12317 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12318 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12319 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:30:59.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CVE ID: CVE-2018-12320 State: PUBLISHED Published: 2018-06-13T16:00:00 Last Updated: 2024-08-05T08:30:59.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/10293 - https://github.com/radare/radare2/commit/90b71c017a7fa9732fe45fd21b245ee051b1f548
CVE ID: CVE-2018-12321 State: PUBLISHED Published: 2018-06-13T16:00:00 Last Updated: 2024-08-05T08:30:59.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/10296 - https://github.com/radare/radare2/commit/224e6bc13fa353dd3b7f7a2334588f1c4229e58d
CVE ID: CVE-2018-12322 State: PUBLISHED Published: 2018-06-13T16:00:00 Last Updated: 2024-08-05T08:30:59.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/bbb4af56003c1afdad67af0c4339267ca38b1017 - https://github.com/radare/radare2/issues/10294
CVE ID: CVE-2018-12323 State: PUBLISHED Published: 2018-06-13T16:00:00Z Last Updated: 2024-09-17T04:15:00.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for physically proximate attackers to login at the console. Additional Analyst Notes: - CVE Program Container: References: - https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE ID: CVE-2018-12326 State: PUBLISHED Published: 2018-06-17T14:00:00 Last Updated: 2024-08-05T08:30:59.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/fakhrizulkifli/f831f40ec6cde4f744c552503d8698f0 - https://www.exploit-db.com/exploits/44904/ - http
ps://gist.github.com/fakhrizulkifli/f831f40ec6cde4f744c552503d8698f0 - https://www.exploit-db.com/exploits/44904/ - https://access.redhat.com/errata/RHSA-2019:0052 - https://access.redhat.com/errata/RHSA-2019:0094 - https://github.com/antirez/redis/commit/9fdcc15962f9ff4baebe6fdd947816f43f730d50 - https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES - https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES - https://access.redhat.com/errata/RHSA-2019:1860
CVE ID: CVE-2018-12327 State: PUBLISHED Published: 2018-06-20T14:00:00 Last Updated: 2024-08-05T08:30:59.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3854 - https://gist.github.com/fakhrizulkifli/9b58ed8e0354e8
r: References: - https://access.redhat.com/errata/RHSA-2018:3854 - https://gist.github.com/fakhrizulkifli/9b58ed8e0354e8deee50b0eebd1c011f - http://www.securityfocus.com/bid/104517 - https://www.exploit-db.com/exploits/44909/ - https://access.redhat.com/errata/RHSA-2018:3853 - https://security.gentoo.org/glsa/201903-15 - https://access.redhat.com/errata/RHSA-2019:2077 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us - https://usn.ubuntu.com/4229-1/
CVE ID: CVE-2018-12329 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows a local attacker to duplicate an authentication factor via cloning. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12330 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:31:00.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via compromised firmware. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12331 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2.68 allows a man-in-the-middle attacker to compromise authentication keys and configurations via IP spoofing during "Easy Enrollment." Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12332 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete Cleanup vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via a compromised host PC after a reset. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12333 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate security relevant configurations and execute malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12334 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via a virtualization attack. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12335 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in ECOS System Management Appliance (aka SMA) 5.2.68 allows a user to compromise authentication keys, and access and manipulate security relevant configurations, via unrestricted database access during Easy Enrollment. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12336 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Undocumented Factory Backdoor in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows the vendor to extract confidential information via remote root SSH access. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12337 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reliance on Security Through Obscurity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to partially extract confidential configurations via user-space emulation. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12338 State: PUBLISHED Published: 2018-06-17T16:00:00 Last Updated: 2024-08-05T08:30:59.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: Undocumented Factory Backdoor in ECOS System Management Appliance (aka SMA) 5.2.68 allows the vendor to extract confidential information and manipulate security relevant configurations via remote root SSH access. Additional Analyst Notes: - CVE Program Container: References: - https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE ID: CVE-2018-12339 State: PUBLISHED Published: 2018-06-13T19:00:00Z Last Updated: 2024-09-17T00:25:33.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: ArticleCMS through 2017-02-19 has XSS via an "add an article" action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/woider/ArticleCMS/issues/4
CVE ID: CVE-2018-12353 State: PUBLISHED Published: 2018-06-13T23:00:00 Last Updated: 2024-08-05T08:31:00.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55
CVE ID: CVE-2018-12354 State: PUBLISHED Published: 2018-06-13T23:00:00 Last Updated: 2024-08-05T08:30:59.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55
CVE ID: CVE-2018-12355 State: PUBLISHED Published: 2018-06-13T23:00:00 Last Updated: 2024-08-05T08:30:59.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55