Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-7263 State: PUBLISHED Published: 2018-02-20T21:00:00 Last Updated: 2024-08-05T06:24:11.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1081784 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870608
CVE ID: CVE-2018-7264 State: PUBLISHED Published: 2018-02-28T17:00:00 Last Updated: 2024-08-05T06:24:11.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and sign errors, allowing a remote attacker to execute arbitrary code on vulnerable applications using the ActivePDF Toolkit to process untrusted images. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44251/ - http://seclists.org/fulldisclosure/2018/Feb/74
CVE ID: CVE-2018-7265 State: PUBLISHED Published: 2018-02-20T22:00:00 Last Updated: 2024-08-05T06:24:11.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shish/shimmie2/issues/631
CVE ID: CVE-2018-7268 State: PUBLISHED Published: 2018-05-21T15:00:00 Last Updated: 2024-08-05T06:24:11.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerability in which a local unprivileged user is able to read any root (uid 0) owned file on the system, regardless of the file permissions. Confidential information such as password hashes (/etc/shadow) or other secrets (such as log files or private keys) can be leaked to the attacker. The vulnerability has a confidentiality impact, but has no direct impact on system integrity or availability. Add
acker. The vulnerability has a confidentiality impact, but has no direct impact on system integrity or availability. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/magnicomp-sysinfo-information-exposure.txt - http://www.securityfocus.com/archive/1/542024/100/0/threaded - http://packetstormsecurity.com/files/147687/MagniComp-SysInfo-Information-Exposure.html
CVE ID: CVE-2018-7269 State: PUBLISHED Published: 2018-03-21T18:00:00 Last Updated: 2024-08-05T06:24:11.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input. Additional Analyst Notes: - CVE Program Container: References: - http://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/
CVE ID: CVE-2018-7271 State: PUBLISHED Published: 2018-02-21T00:00:00 Last Updated: 2024-08-05T06:24:11.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SQYY/CVE/blob/master/MetInfo_G.txt
CVE ID: CVE-2018-7272 State: PUBLISHED Published: 2018-02-21T00:00:00Z Last Updated: 2024-09-17T03:03:02.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file. Additional Analyst Notes: - CVE Program Container: References: - https://backstage.forgerock.com/knowledge/kb/book/b21824339 - https://hansesecure.de/vulnerability-in-am/
CVE ID: CVE-2018-7273 State: PUBLISHED Published: 2018-02-21T00:00:00 Last Updated: 2024-08-05T06:24:11.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections such as KASLR. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2018/2/20/669 - https://www.exploit-db.com/exploits/44325/ - http://www.securit
ner: References: - https://lkml.org/lkml/2018/2/20/669 - https://www.exploit-db.com/exploits/44325/ - http://www.securityfocus.com/bid/103088
CVE ID: CVE-2018-7274 State: PUBLISHED Published: 2018-02-21T00:00:00 Last Updated: 2024-08-05T06:24:11.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title), Widgets (Name), and Menus (Name). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103081 - https://github.com/YABhq/Quarx/issues/116
CVE ID: CVE-2018-7276 State: PUBLISHED Published: 2018-02-21T01:00:00Z Last Updated: 2024-09-16T18:34:47.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitive information via a /DbXmlInfo.xml request, as demonstrated by the Latitude/Longitude of the device. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.com/2018/02/bacnet-entrando-en-materia.html
CVE ID: CVE-2018-7277 State: PUBLISHED Published: 2018-02-21T01:00:00Z Last Updated: 2024-09-16T22:56:19.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.com/2018/02/bacnet-entrando-en-materia.html
CVE ID: CVE-2018-7278 State: PUBLISHED Published: 2018-02-21T01:00:00Z Last Updated: 2024-09-17T03:38:14.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.com/2018/02/bacnet-entrando-en-materia.html
CVE ID: CVE-2018-7279 State: PUBLISHED Published: 2018-03-14T13:00:00 Last Updated: 2024-08-05T06:24:11.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.alienvault.com/forums/discussion/17155/alienvault-v5-5-1-hotfix-important-update - https://www.alienvault.com/forums/discussion/17204/security-advisory-alienvault-v5-5-1-resolves-critical-vulnerability
CVE ID: CVE-2018-7280 State: PUBLISHED Published: 2018-02-21T16:00:00Z Last Updated: 2024-09-17T02:31:31.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ninja Forms plugin before 3.2.14 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ninja-forms/#developers
CVE ID: CVE-2018-7281 State: PUBLISHED Published: 2018-02-21T22:00:00 Last Updated: 2024-08-05T06:24:11.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. The binary takes a single command line argument and passes this argument to a system() call, thus allowing low privileged users to execute commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2018-003.md
CVE ID: CVE-2018-7282 State: PUBLISHED Published: 2019-12-06T16:56:09 Last Updated: 2024-08-05T06:24:11.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi. Additional Analyst Notes: - CVE Program Container: References: - http://ti-tool.com - http://print.com - https://fenceposterror.github.io/cve-2018-7282.txt
CVE ID: CVE-2018-7284 State: PUBLISHED Published: 2018-02-22T00:00:00 Last Updated: 2024-08-05T06:24:11.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash. Additional Analyst Notes: - CVE
ept headers were present, the code would write outside of its memory and cause a crash. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2018-004.html - https://www.exploit-db.com/exploits/44184/ - https://www.debian.org/security/2018/dsa-4320 - http://www.securityfocus.com/bid/103151 - http://www.securitytracker.com/id/1040416
CVE ID: CVE-2018-7285 State: PUBLISHED Published: 2018-02-22T00:00:00 Last Updated: 2024-08-05T06:24:11.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamic codecs and desired payload numbers. While an SDP negotiation may result in a codec using a different payload number, these desired ones are still stored internally. When an RTP packet was received, this registry would be consulted if the payload number was not found in the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payloa
the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payload number resulted in a codec of a different type than the RTP stream (for example, the payload number resulted in a video codec but the stream carried audio), a crash could occur if no stream of that type had been negotiated. This was due to the code incorrectly assuming that a stream of that type would always exist. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040415 - http://www.securityfocus.com/bid/103149 - http://downloads.asterisk.org/pub/security/AST-2018-001.html
CVE ID: CVE-2018-7286 State: PUBLISHED Published: 2018-02-22T00:00:00 Last Updated: 2024-08-05T06:24:11.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4320 - https://issues.asterisk.org/jira/browse/ASTERISK-27618 - http://downloads.asteris
ww.debian.org/security/2018/dsa-4320 - https://issues.asterisk.org/jira/browse/ASTERISK-27618 - http://downloads.asterisk.org/pub/security/AST-2018-005.html - https://www.exploit-db.com/exploits/44181/ - http://www.securitytracker.com/id/1040417 - http://www.securityfocus.com/bid/103129
CVE ID: CVE-2018-7287 State: PUBLISHED Published: 2018-02-22T00:00:00 Last Updated: 2024-08-05T06:24:11.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1. If the HTTP server is enabled (default is disabled), WebSocket payloads of size 0 are mishandled (with a busy loop). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040419 - http://www.securityfocus.com/bid/103120 - https://issues.asterisk.org/jira/browse/ASTERISK-27658 - http://downloads.digium.com/pub/security/AST-2018-006.html
CVE ID: CVE-2018-7289 State: PUBLISHED Published: 2018-02-21T18:00:00 Last Updated: 2024-08-05T06:24:11.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/armadito/armadito-windows-driver/issues/5 - https://www.exp
s: - CVE Program Container: References: - https://github.com/armadito/armadito-windows-driver/issues/5 - https://www.exploit-db.com/exploits/44169/
CVE ID: CVE-2018-7290 State: PUBLISHED Published: 2018-03-09T20:00:00 Last Updated: 2024-08-05T06:24:11.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/tikiwiki/code/65537 - http://www.openwall.com/lists/oss-security/2018/03/08/5
CVE ID: CVE-2018-7295 State: PUBLISHED Published: 2018-05-23T12:00:00 Last Updated: 2024-08-05T06:24:11.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/WizardShotTheFood/advisories/master/CVE-2018-7295.txt
CVE ID: CVE-2018-7296 State: PUBLISHED Published: 2018-02-22T19:00:00 Last Updated: 2024-08-05T06:24:11.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface. Additional Analyst Notes: - CVE Program Container: References: - http://atomic111.github.io/article/homematic-ccu2-fileread
CVE ID: CVE-2018-7297 State: PUBLISHED Published: 2018-02-22T19:00:00 Last Updated: 2024-08-05T06:24:11.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device. This vulnerability can be exploited by unauthenticated attackers with access to the web interface. Additional Analyst Notes: - CVE Program Container: References: - http://atomic111.github.io/article/homematic-ccu2-remote-code-execution - https://www.exploit-db.com/exploits/44368/
CVE ID: CVE-2018-7298 State: PUBLISHED Published: 2018-02-22T19:00:00 Last Updated: 2024-08-05T06:24:11.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position (which could be obtained via DNS spoofing of www.meine-homematic.de or other approaches) can exploit this issue in order to provide arbitrary malicious firmware updates to the CCU2. This can result in a full system compromise. Additional Analyst Notes:
rbitrary malicious firmware updates to the CCU2. This can result in a full system compromise. Additional Analyst Notes: - CVE Program Container: References: - http://atomic111.github.io/article/homematic-ccu2-firmware-via-plain-http
CVE ID: CVE-2018-7299 State: PUBLISHED Published: 2018-02-22T19:00:00 Last Updated: 2024-08-05T06:24:11.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or install malicious software on the device. Additional Analyst Notes: - CVE Program Container: References: - http://atomic111.github.io/article/homematic-ccu2-untrusted_addon
CVE ID: CVE-2018-7300 State: PUBLISHED Published: 2018-02-22T19:00:00 Last Updated: 2024-08-05T06:24:11.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface. Additional Analyst Notes: - CVE Program Container: References: - http://atomic111.github.io/article/homematic-ccu2-filewrite - https://www.exploit-db.com/exploits/44361/
CVE ID: CVE-2018-7301 State: PUBLISHED Published: 2018-02-22T19:00:00 Last Updated: 2024-08-05T06:24:11.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices. Additional Analyst Notes: - CVE Program Container: References: - http://atomic111.github.io/article/homematic-ccu2-xml-rpc
CVE ID: CVE-2018-7302 State: PUBLISHED Published: 2018-02-21T20:00:00Z Last Updated: 2024-09-16T17:24:11.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html
CVE ID: CVE-2018-7303 State: PUBLISHED Published: 2018-02-21T20:00:00Z Last Updated: 2024-09-16T19:01:06.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Calendar component in Tiki 17.1 allows HTML injection. Additional Analyst Notes: - CVE Program Container: References: - https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html
CVE ID: CVE-2018-7304 State: PUBLISHED Published: 2018-02-21T20:00:00Z Last Updated: 2024-09-16T17:57:46.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation. Additional Analyst Notes: - CVE Program Container: References: - https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html
CVE ID: CVE-2018-7305 State: PUBLISHED Published: 2018-02-21T20:00:00Z Last Updated: 2024-09-16T22:36:27.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://websecnerd.blogspot.in/2018/02/mybb-forum-1_21.html
CVE ID: CVE-2018-7307 State: PUBLISHED Published: 2018-03-06T15:00:00 Last Updated: 2024-08-05T06:24:11.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. Additional Analyst Notes: - CVE Program Container: References: - https://auth0.com/docs/security/bulletins/cve-2018-7307
CVE ID: CVE-2018-7308 State: PUBLISHED Published: 2018-02-21T21:00:00 Last Updated: 2024-08-05T06:24:11.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any hosting account. Additional Analyst Notes: - CVE Program Container: References: - http://www.andmp.com/2018/02/advisory-assigned-cve-2018-7308-csrf.html - https://github.com/DanWin/hosting/issues/18
CVE ID: CVE-2018-7311 State: PUBLISHED Published: 2018-02-21T22:00:00 Last Updated: 2024-08-05T06:24:11.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new VPN connection operations via the main PrivateVPN application. The privileged helper tool creates new VPN connections by executing the openvpn binary located in the /Applications/PrivateVPN.app/Contents/Resources directory. The openvpn
ns by executing the openvpn binary located in the /Applications/PrivateVPN.app/Contents/Resources directory. The openvpn binary can be overwritten by the default user, which allows an attacker that has already installed malicious software as the default user to replace the binary. When a new VPN connection is established, the privileged helper tool will launch this malicious binary, thus allowing an attacker to execute code as the root user. NOTE: the vendor has reportedly indicated that this behavior is "an acceptable part of their software. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/
A ADP Vulnrichment: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2018-004.md - https://github.com/VerSprite/research/blob/eba22c8b506be6f7128ef5356281915d5667bfff/advisories/VS-2018-004.md - https://gist.github.com/anonymous/cfc3f3419804b22ee9e82ee8d16a661d
CVE ID: CVE-2018-7312 State: PUBLISHED Published: 2018-02-22T19:00:00 Last Updated: 2024-08-05T06:24:11.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exploit-db.com/exploits/44162
CVE ID: CVE-2018-7313 State: PUBLISHED Published: 2018-02-22T14:00:00 Last Updated: 2024-08-05T06:24:11.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44158/