Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-17287 State: PUBLISHED Published: 2019-04-18T17:29:40 Last Updated: 2024-08-05T10:47:04.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17287-Information%20Disclosure-Kofax
CVE ID: CVE-2018-17288 State: PUBLISHED Published: 2019-04-18T17:42:22 Last Updated: 2024-08-05T10:47:04.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kofax Front Office Server version 4.1.1.11.0.5212 (both Thin Client and Administration Console) suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Filename" field in /Kofax/KFS/ThinClient/document/upload/ - (Thin Client) or (2) "DeviceName" field in /Kofax/KFS/Admin/DeviceService/device/ - (Administration Console). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17288-XSS-Kofax
CVE ID: CVE-2018-17289 State: PUBLISHED Published: 2019-04-18T17:47:25 Last Updated: 2024-08-05T10:47:04.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration (.ZIP file) within the Kofax/KFS/Admin/PackageService/package/upload file parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17289-XXE-Kofax
CVE ID: CVE-2018-17292 State: PUBLISHED Published: 2018-09-21T06:00:00 Last Updated: 2024-08-05T10:47:04.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WAVM before 2018-09-16. The loadModule function in Include/Inline/CLI.h lacks checking of the file length before a file magic comparison, allowing attackers to cause a Denial of Service (application crash caused by out-of-bounds read) by crafting a file that has fewer than 4 bytes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WAVM/WAVM/commit/2de6cf70c5ef31e22ed119a25ac2daeefd3d18a1 - https://github.com/WAVM/WAVM/issues/109
CVE ID: CVE-2018-17293 State: PUBLISHED Published: 2018-09-21T06:00:00 Last Updated: 2024-08-05T10:47:04.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WAVM/WAVM/commit/31d670b6489e6d7
es. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WAVM/WAVM/commit/31d670b6489e6d708c3b04b911cdf14ac43d846d - https://github.com/WAVM/WAVM/issues/110#issuecomment-421764693
CVE ID: CVE-2018-17294 State: PUBLISHED Published: 2018-09-21T06:00:00 Last Updated: 2024-08-05T10:47:04.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/liblouis/liblouis/issues/635 - https://usn.ubuntu.com/3782-1/ - http://www.securityfocus.com/bid/105511 - https://github.com/liblouis/liblouis/commit/5e4089659bb49b
buntu.com/3782-1/ - http://www.securityfocus.com/bid/105511 - https://github.com/liblouis/liblouis/commit/5e4089659bb49b3095fa541fa6387b4c40d7396e - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html
CVE ID: CVE-2018-17297 State: PUBLISHED Published: 2018-09-21T06:00:00 Last Updated: 2024-08-05T10:47:04.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/looly/hutool/issues/162
CVE ID: CVE-2018-17298 State: PUBLISHED Published: 2018-09-21T06:00:00 Last Updated: 2024-08-05T10:47:04.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password. Additional Analyst Notes: - CVE Program Container: References: - https://tuleap.net/plugins/tracker/?aid=12219 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b87d3b807f39c00371ebaa50f938cb0110113538 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=4050b0aafd18346d9a6a06967bfb1170824dab17
CVE ID: CVE-2018-17300 State: PUBLISHED Published: 2018-09-21T06:00:00 Last Updated: 2024-08-05T10:47:04.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-17300/blob/master/cuppa_xss.pdf - https://github.com/CuppaCMS/CuppaCMS/issues/4
CVE ID: CVE-2018-17301 State: PUBLISHED Published: 2018-09-21T06:00:00 Last Updated: 2024-08-05T10:47:04.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espocrm/espocrm/issues/1038 - https://github.com/security-breachlock/CVE-2018-17301/blob/master/Non-persistent%20XSS%20in%20EspoCRM.pdf
CVE ID: CVE-2018-17302 State: PUBLISHED Published: 2018-09-21T06:00:00 Last Updated: 2024-08-05T10:47:04.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espocrm/espocrm/issues/1039 - https://github.com/security-breachlock/CVE-2018-17302/blob/master/XSS%20%28Stored%29%20in%20EspoCRM.pdf
CVE ID: CVE-2018-17305 State: PUBLISHED Published: 2019-04-11T16:16:21 Last Updated: 2024-08-05T10:47:04.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leading to privilege escalation and remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.uipath.com/product/release-notes/uipath-v2018.1.7
CVE ID: CVE-2018-17309 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:04.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149493/RICOH-MP-C406Z-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17310 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:04.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45526/ - http://packetstormsecurity.com/files/149494/RICOH-MP-C1803-JPN-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17311 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:04.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149495/RICOH-MP-C6503-Plus-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17312 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:04.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149496/RICOH-Aficio-MP-301-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17313 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:04.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH MP C307 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45526/ - http://packetstormsecurity.com/files/149497/RICOH-MP-C307-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17314 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:04.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149501/RICOH-MP-305-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17315 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:03.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149502/RICOH-MP-C2003-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17316 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:04.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149505/RICOH-MP-C6003-Printer-Cross-Site-Scripting.html
CVE ID: CVE-2018-17317 State: PUBLISHED Published: 2018-09-21T18:00:00 Last Updated: 2024-08-05T10:47:04.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action, io_in_iface, io_in_set, io_in_ip, io_in_mask, io_in_gw, io_out_iface, io_out_set, io_out_mask, io_out_gw, iface, or domain parameter to /www/script/config_iface.php, or the newSSID, hostapd_secure, hostapd_wpa_passphrase, or supplicant_ssid parameter to /www/page_config.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PatatasFri
to /www/page_config.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PatatasFritas/PatataWifi/issues/1 - http://blog.51cto.com/010bjsoft/2175710 - https://github.com/xtr4nge/FruityWifi/issues/276
CVE ID: CVE-2018-17320 State: PUBLISHED Published: 2018-09-21T18:00:00Z Last Updated: 2024-09-17T02:12:01.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ucms/ucms/issues/1
CVE ID: CVE-2018-17321 State: PUBLISHED Published: 2018-09-22T02:00:00Z Last Updated: 2024-09-16T18:44:42.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorandomset action. Additional Analyst Notes: - CVE Program Container: References: - https://secwk.blogspot.com/2018/09/seacms-664-xss-vulnerability_14.html
CVE ID: CVE-2018-17322 State: PUBLISHED Published: 2018-09-22T02:00:00Z Last Updated: 2024-09-17T03:47:58.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php/index/category/index in YUNUCMS 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the area parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/yunucms/issues/1
CVE ID: CVE-2018-17332 State: PUBLISHED Published: 2018-09-22T16:00:00 Last Updated: 2024-08-05T10:47:04.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libsvg2 through 2012-10-19. The svgGetNextPathField function in svg_string.c returns its input pointer in certain circumstances, which might result in a memory leak caused by wasteful malloc calls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/agambier/libsvg2/issues/2
CVE ID: CVE-2018-17333 State: PUBLISHED Published: 2018-09-22T16:00:00 Last Updated: 2024-08-05T10:47:03.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in svgStringToLength in svg_types.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because sscanf is misused. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/agambier/libsvg2/issues/4
CVE ID: CVE-2018-17334 State: PUBLISHED Published: 2018-09-22T16:00:00 Last Updated: 2024-08-05T10:47:04.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in the svgGetNextPathField function in svg_string.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because a strncpy copy limit is miscalculated. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/agambier/libsvg2/issues/3
CVE ID: CVE-2018-17336 State: PUBLISHED Published: 2018-09-22T16:00:00 Last Updated: 2024-08-05T10:47:04.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/storaged-project/udisks/issues/578 - https://usn.ubuntu.com/3772-1/ - https://access.redhat.com/errata/RHSA-2019:2178
CVE ID: CVE-2018-17337 State: PUBLISHED Published: 2018-10-10T21:00:00 Last Updated: 2024-08-05T10:47:04.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Oct/18
CVE ID: CVE-2018-17338 State: PUBLISHED Published: 2018-09-23T05:00:00 Last Updated: 2024-08-05T10:47:04.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in pdfalto through 0.2. It is a heap-based buffer overflow in the function TextPage::dump in XmlAltoOutputDev.cc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grandnew/software-vulnerabilities/tree/master/pdfalto#heap-buffer-overflow-in-function-textpagedump - https://github.com/kermitt2/pdfalto/issues/29
CVE ID: CVE-2018-17341 State: PUBLISHED Published: 2018-09-23T05:00:00Z Last Updated: 2024-09-16T19:14:18.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtree_htaccess_url=admin/images/..\ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/345
CVE ID: CVE-2018-17358 State: PUBLISHED Published: 2018-09-23T18:00:00 Last Updated: 2024-08-05T10:47:04.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=23686 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.op
lla/show_bug.cgi?id=23686 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://seclists.org/bugtraq/2020/Jan/25 - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-17359 State: PUBLISHED Published: 2018-09-23T18:00:00 Last Updated: 2024-08-05T10:47:04.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=23686 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-sec
86 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-17360 State: PUBLISHED Published: 2018-09-23T18:00:00 Last Updated: 2024-08-05T10:47:04.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=23685 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensus
how_bug.cgi?id=23685 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-17361 State: PUBLISHED Published: 2018-09-23T18:00:00 Last Updated: 2024-08-05T10:47:04.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alterebro/WeaselCMS/issues/7
CVE ID: CVE-2018-17364 State: PUBLISHED Published: 2018-09-23T18:00:00 Last Updated: 2024-08-05T10:47:04.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter. Additional Analyst Notes: - CVE Program Container: References: - https://xiaohuihui1.blogspot.com/2018/09/otcms-361-command-execution.html
CVE ID: CVE-2018-17365 State: PUBLISHED Published: 2018-09-26T21:00:00 Last Updated: 2024-08-05T10:47:04.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter. Additional Analyst Notes: - CVE Program Container: References: - http://blog.51cto.com/13770310/2177226 - https://github.com/sfh320/seacms/issues/1
CVE ID: CVE-2018-17366 State: PUBLISHED Published: 2018-09-23T18:00:00 Last Updated: 2024-08-05T10:47:04.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/IM1DA
CVE ID: CVE-2018-17368 State: PUBLISHED Published: 2018-09-23T22:00:00 Last Updated: 2024-08-05T10:47:04.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, which makes it easier to conduct brute-force attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sanluan/PublicCMS/issues/18
CVE ID: CVE-2018-17369 State: PUBLISHED Published: 2018-09-23T22:00:00 Last Updated: 2024-08-05T10:47:04.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qzw1210/springboot_authority/issues/4
CVE ID: CVE-2018-17374 State: PUBLISHED Published: 2019-06-19T17:18:54 Last Updated: 2024-08-05T10:47:04.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filter_order_Dir or filter_order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45456
CVE ID: CVE-2018-17375 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45465/ - http://packetstormsecurity.com/files/149521/Joomla-Music-Collection-3.0.3-SQL-Injection.html