Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-16627 State: PUBLISHED Published: 2018-12-20T22:00:00 Last Updated: 2024-08-05T10:32:54.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16627
CVE ID: CVE-2018-16628 State: PUBLISHED Published: 2018-12-04T16:00:00 Last Updated: 2024-08-05T10:32:53.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: panel/login in Kirby v2.5.12 allows XSS via a blog name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16628/blob/master/kirby10.pdf
CVE ID: CVE-2018-16629 State: PUBLISHED Published: 2018-12-04T16:00:00 Last Updated: 2024-08-05T10:32:53.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16629/blob/master/subrion_cms.pdf
CVE ID: CVE-2018-16630 State: PUBLISHED Published: 2018-12-28T17:00:00 Last Updated: 2024-08-05T10:32:53.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16630/blob/master/Kirby_Insecure%20file%20validation.pdf
CVE ID: CVE-2018-16631 State: PUBLISHED Published: 2018-12-04T16:00:00 Last Updated: 2024-08-05T10:32:54.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16631/blob/master/Subrion_cms.pdf
CVE ID: CVE-2018-16632 State: PUBLISHED Published: 2018-12-28T17:00:00 Last Updated: 2024-08-05T10:32:52.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16632/blob/master/mezzanine_persistent%20XSS.pdf
CVE ID: CVE-2018-16633 State: PUBLISHED Published: 2018-12-04T16:00:00 Last Updated: 2024-08-05T10:32:52.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16633/blob/master/PLUCK_XSS.pdf
CVE ID: CVE-2018-16634 State: PUBLISHED Published: 2018-12-04T16:00:00 Last Updated: 2024-08-05T10:32:52.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pluck v4.7.7 allows CSRF via admin.php?action=settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16634/blob/master/PLUCK_CSRF.pdf
CVE ID: CVE-2018-16635 State: PUBLISHED Published: 2018-12-10T18:00:00 Last Updated: 2024-08-05T10:32:52.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16635/blob/master/blackcatcms.pdf
CVE ID: CVE-2018-16636 State: PUBLISHED Published: 2018-12-10T18:00:00 Last Updated: 2024-08-05T10:32:53.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NucleusCMS/NucleusCMS/issues/84 - https://github.com/security-breachlock/CVE-2018-16636/blob/master/nucleus_html.pdf
CVE ID: CVE-2018-16637 State: PUBLISHED Published: 2018-12-28T17:00:00 Last Updated: 2024-08-05T10:32:54.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16637/blob/master/evolution_xss_stored.pdf
CVE ID: CVE-2018-16638 State: PUBLISHED Published: 2018-12-28T17:00:00 Last Updated: 2024-08-05T10:32:52.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Evolution CMS 1.4.x allows XSS via the manager/ search parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-16638/blob/master/evolution_xss_reflected.pdf
CVE ID: CVE-2018-16639 State: PUBLISHED Published: 2019-05-13T12:52:00 Last Updated: 2024-08-05T10:32:53.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-provensec/CVE-2018-16639
CVE ID: CVE-2018-16640 State: PUBLISHED Published: 2018-09-06T22:00:00 Last Updated: 2024-08-05T10:32:52.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1201 - https://github.com/ImageMagick/ImageMagick/commit/76efa969342568841ecf320b5a041685a6d24e0b - https://usn.ubuntu.com/3785-1/
CVE ID: CVE-2018-16641 State: PUBLISHED Published: 2018-09-06T22:00:00 Last Updated: 2024-08-05T10:32:53.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in coders/tiff.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/256825d4eb33dc301496710d15cf5a7ae924088b - https://github.com/ImageMagick/ImageMagick/issues/1206
CVE ID: CVE-2018-16642 State: PUBLISHED Published: 2018-09-06T22:00:00 Last Updated: 2024-08-05T10:32:52.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/cc4ac341f29fa368da6ef01c207deaf8c61f6a2e - https://github.com/ImageMagick/ImageMagick/issues/1162 - https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html - https://www.debian.org/security/2018/dsa-4316 - https://usn.ubuntu.com/3785
/debian-lts-announce/2018/10/msg00002.html - https://www.debian.org/security/2018/dsa-4316 - https://usn.ubuntu.com/3785-1/
CVE ID: CVE-2018-16643 State: PUBLISHED Published: 2018-09-06T22:00:00 Last Updated: 2024-08-05T10:32:53.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1199 - https://github.com/ImageMagick/ImageMagick/commit/6b6bff054d569a77973f2140c0e86366e6168a6c - https://lists.
ssues/1199 - https://github.com/ImageMagick/ImageMagick/commit/6b6bff054d569a77973f2140c0e86366e6168a6c - https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html - https://usn.ubuntu.com/3785-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2018-16644 State: PUBLISHED Published: 2018-09-06T22:00:00 Last Updated: 2024-08-05T10:32:53.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/16916c8979c32765c542e216b31cee2671b7afe7 - https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html - https://github.com/ImageMagick/ImageMagick/commit/afa878a689870c28b6994ecf3bb8dbfb
-lts-announce/2018/10/msg00002.html - https://github.com/ImageMagick/ImageMagick/commit/afa878a689870c28b6994ecf3bb8dbfb2b76d135 - https://www.debian.org/security/2018/dsa-4316 - https://usn.ubuntu.com/3785-1/ - https://github.com/ImageMagick/ImageMagick/issues/1269 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-16645 State: PUBLISHED Published: 2018-09-06T22:00:00 Last Updated: 2024-08-05T10:32:53.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/ecb31dbad39ccdc65868d5d2a37f0f0521250832 - https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html - https://github.com/ImageMagick/ImageMagick/issues/1268 - https://www.
an.org/debian-lts-announce/2018/10/msg00002.html - https://github.com/ImageMagick/ImageMagick/issues/1268 - https://www.debian.org/security/2018/dsa-4316 - https://usn.ubuntu.com/3785-1/ - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-16646 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-08-05T10:32:52.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1622951 - https://lists.debian.org/debian-lts-announce/2018/11/msg00040.html - https://lists.debian.org/debian-lts-announce/2018/10/msg00024.html - https://usn.ubuntu.com/3837-2/ - https://lists.debian.org/debian-lts-announce/2018/12/msg00004.html - https:/
024.html - https://usn.ubuntu.com/3837-2/ - https://lists.debian.org/debian-lts-announce/2018/12/msg00004.html - https://usn.ubuntu.com/3837-1/ - https://access.redhat.com/errata/RHSA-2019:2022 - https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html
CVE ID: CVE-2018-16647 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-09-12T16:17:15.479381 Vendors: n/a Products: n/a Problem Types: n/a Description: In Artifex MuPDF 1.13.0, the pdf_get_xref_entry function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation fault in fz_write_data in fitz/output.c) via a crafted pdf file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=699686 - https://lists.debian.org/debian-lts-announce/2020/07/msg00019.html - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=351c99d8ce23bbf7099dbd52771a095f67e45a2c
CVE ID: CVE-2018-16648 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-09-12T16:13:55.443181 Vendors: n/a Products: n/a Problem Types: n/a Description: In Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows remote attackers to cause a denial of service (segmentation fault) via a crafted pdf file. This is caused by a pdf/pdf-device.c pdf_dev_alpha array-index underflow. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=699685 - https://lists.debian.org/debian-lts-announce/2020/07/msg00019.html - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=38f883fe129a5e89306252a4676eaaf4
0/07/msg00019.html - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=38f883fe129a5e89306252a4676eaaf4bc968824
CVE ID: CVE-2018-16650 State: PUBLISHED Published: 2018-09-07T05:00:00 Last Updated: 2024-08-05T10:32:53.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyFAQ before 2.9.11 allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyfaq.de/security/advisory-2018-09-02
CVE ID: CVE-2018-16651 State: PUBLISHED Published: 2018-09-07T05:00:00 Last Updated: 2024-08-05T10:32:53.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyfaq.de/security/advisory-2018-09-02
CVE ID: CVE-2018-16653 State: PUBLISHED Published: 2018-09-07T05:00:00 Last Updated: 2024-08-05T10:32:53.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZBWACD/CodeAudit/blob/master/rejucms_v2.1%20%20xss1
CVE ID: CVE-2018-16654 State: PUBLISHED Published: 2018-09-07T05:00:00 Last Updated: 2024-08-05T10:32:52.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/zurmo/zurmo/issues/441
CVE ID: CVE-2018-16655 State: PUBLISHED Published: 2018-09-07T05:00:00 Last Updated: 2024-08-05T10:32:52.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php. Additional Analyst Notes: - CVE Program Container: References: - https://lengjibo.github.io/gxlcms/ - https://github.com/lengjibo/lengjibo.github.io/blob/master/gxlcms/index.html
CVE ID: CVE-2018-16656 State: PUBLISHED Published: 2019-05-14T19:58:17 Last Updated: 2024-08-05T10:32:53.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: DoBox_CstmBox_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://mars-cheng.github.io/blog/2019/CVE-2018-16656
CVE ID: CVE-2018-16657 State: PUBLISHED Published: 2018-09-07T14:00:00 Last Updated: 2024-08-05T10:32:53.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Kamailio. The reason is missing input validation in the crcitt_string_array core function for calculating a CRC hash for To tags. (An additional error is present in the check_via_address core function: this function also misses input validation.) This could result in denial of service and potentially the execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: Referen
l of service and potentially the execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4292 - https://lists.debian.org/debian-lts-announce/2018/09/msg00013.html - https://skalatan.de/blog/advisory-hw-2018-06
CVE ID: CVE-2018-16658 State: PUBLISHED Published: 2018-09-07T14:00:00 Last Updated: 2024-08-05T10:32:53.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4 - https://usn.ubuntu.com/3797-2/ - https://usn.ubuntu.c
ds/linux.git/commit/?id=8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4 - https://usn.ubuntu.com/3797-2/ - https://usn.ubuntu.com/3797-1/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://usn.ubuntu.com/3820-1/ - https://usn.ubuntu.com/3820-2/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.6 - https://www.debian.org/security/2018/dsa-4308 - https://github.com/torvalds/linux/commit/8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4 - https://usn.ubuntu.com/3822-2/ - https://usn.ubuntu.com/3822-1/ - http://www.securityfocus.com/bid/105334 - https://usn.ubuntu.com/3820-3/ - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:20
usn.ubuntu.com/3820-3/ - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029 - https://access.redhat.com/errata/RHSA-2019:4154
CVE ID: CVE-2018-16659 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:32:53.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45500/
CVE ID: CVE-2018-16660 State: PUBLISHED Published: 2019-04-25T19:40:40 Last Updated: 2024-08-05T10:32:53.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated access to execute arbitrary OS commands on a vulnerable installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.imperva.com/products/securesphere/web-application-firewall/ - https://www.exploit-db.com/exploits/45542/
CVE ID: CVE-2018-16663 State: PUBLISHED Published: 2018-09-07T17:00:00 Last Updated: 2024-08-05T10:32:53.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parse_relations in os/storage/antelope/aql-parser.c while parsing AQL (storage of relations). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/issues/599
CVE ID: CVE-2018-16664 State: PUBLISHED Published: 2018-09-07T17:00:00 Last Updated: 2024-08-05T10:32:53.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow in lvm_set_type in os/storage/antelope/lvm.c while parsing AQL (lvm_set_op, lvm_set_relation, lvm_set_operand). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/issues/596
CVE ID: CVE-2018-16665 State: PUBLISHED Published: 2018-09-07T17:00:00 Last Updated: 2024-08-05T10:32:53.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvm_shift_for_operator in os/storage/antelope/lvm.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/issues/598
CVE ID: CVE-2018-16666 State: PUBLISHED Published: 2018-09-07T17:00:00 Last Updated: 2024-08-05T10:32:54.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in next_string in os/storage/antelope/aql-lexer.c while parsing AQL (parsing next string). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/issues/595
CVE ID: CVE-2018-16667 State: PUBLISHED Published: 2018-09-07T17:00:00 Last Updated: 2024-08-05T10:32:52.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG through 4.1. There is a buffer over-read in lookup in os/storage/antelope/lvm.c while parsing AQL (lvm_register_variable, lvm_set_variable_value, create_intersection, create_union). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/issues/597
CVE ID: CVE-2018-16668 State: PUBLISHED Published: 2018-09-18T20:00:00 Last Updated: 2024-08-05T10:32:52.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45384/ - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
CVE ID: CVE-2018-16669 State: PUBLISHED Published: 2018-09-18T20:00:00 Last Updated: 2024-08-05T10:32:53.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife panels. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45384/ - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
CVE ID: CVE-2018-16670 State: PUBLISHED Published: 2018-09-18T20:00:00 Last Updated: 2024-08-05T10:32:53.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45384/ - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
CVE ID: CVE-2018-16671 State: PUBLISHED Published: 2018-09-18T20:00:00 Last Updated: 2024-08-05T10:32:53.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45384/ - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
CVE ID: CVE-2018-16672 State: PUBLISHED Published: 2018-09-26T17:00:00 Last Updated: 2024-08-05T10:32:53.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIRCONTROL CirCarLife before 4.3. Due to the storage of multiple sensitive information elements in a JSON format at /services/system/setup.json, an authenticated but unprivileged user can exfiltrate critical setup information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45384/ - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
CVE ID: CVE-2018-16703 State: PUBLISHED Published: 2018-09-07T17:00:00 Last Updated: 2024-08-05T10:32:53.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in excess of the configured login attempt limit. The vulnerability is due to insufficient server-side access control and login attempt limit enforcement. An attacker could exploit this vulnerability by sending modified login attempts to the Portal login page. An exploit could allow the attacker to identify existing users and perfor