Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-7363 State: PUBLISHED Published: 2018-11-16T15:00:00 Last Updated: 2024-08-05T06:24:12.021Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ZTE Products: ZXHN F670 Problem Types: Improper Authorization Description: All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization delay, an attacker can be allowed to brute force account credentials. Additional Analyst Notes: - CVE Program Container: References: - http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009383
CVE ID: CVE-2018-7364 State: PUBLISHED Published: 2018-12-07T00:00:00 Last Updated: 2024-08-05T06:24:11.900Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: ZTE Products: ZXIN10-European region Problem Types: CWE-284 Description: All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges. Additional Analyst Notes: - CVE Program Container: References: - http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=100994
tes: - CVE Program Container: References: - http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943 - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943 - https://github.com/orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p
CVE ID: CVE-2018-7365 State: PUBLISHED Published: 2018-12-20T14:00:00 Last Updated: 2024-08-05T06:24:11.865Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ZTE Products: uSmartView Problem Types: CWE-426 Description: All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized user to perform unauthorized operations. Additional Analyst Notes: - CVE Program Container: References: - http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010005
CVE ID: CVE-2018-7366 State: PUBLISHED Published: 2018-12-28T16:00:00 Last Updated: 2024-08-05T06:24:11.870Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: ZTE Products: ZXV10 B860AV2.1_ChinaMobile Problem Types: Improper Access Control Description: ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentication bypass vulnerability, which may allows an unauthorized user to perform unauthorized operations. Additional Analyst Notes: - CVE Program Container: References: - http://support.zte.com.cn/support/news/LoopholeI
tions. Additional Analyst Notes: - CVE Program Container: References: - http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010023
CVE ID: CVE-2018-7367 State: REJECTED Published: 2019-10-24T20:06:00 Last Updated: 2019-10-24T20:06:00 Description: No description available.
CVE ID: CVE-2018-7368 State: REJECTED Published: 2019-10-24T20:07:45 Last Updated: 2019-10-24T20:07:45 Description: No description available.
CVE ID: CVE-2018-7405 State: PUBLISHED Published: 2018-03-13T19:00:00 Last Updated: 2024-08-05T06:24:11.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/community/topic/security-notice - https://www.manageengine.com/products/eventlog/release-notes.html
CVE ID: CVE-2018-7406 State: PUBLISHED Published: 2018-05-24T21:00:00 Last Updated: 2024-08-05T06:24:11.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the u3d images inside of a pdf. The issue results from the lack of proper validation of user-supplied data, which can result in an array indexing issue. An attacker can leverage this to execute code in the context of the
d data, which can result in an array indexing issue. An attacker can leverage this to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.securityfocus.com/bid/104300 - https://srcincite.io/advisories/src-2018-0017/
CVE ID: CVE-2018-7407 State: PUBLISHED Published: 2018-05-24T21:00:00 Last Updated: 2024-08-05T06:24:12.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists when rendering U3D images inside of pdf files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the con
-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.securityfocus.com/bid/104300 - https://srcincite.io/advisories/src-2018-0018/
CVE ID: CVE-2018-7408 State: PUBLISHED Published: 2018-02-22T18:00:00 Last Updated: 2024-08-05T06:24:11.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/npm/npm/commit
"correctMkdir" issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0 - https://github.com/npm/npm/issues/19883 - http://blog.npmjs.org/post/171169301000/v571
CVE ID: CVE-2018-7409 State: PUBLISHED Published: 2018-02-22T18:00:00 Last Updated: 2024-08-05T06:24:11.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.unixodbc.org/unixODBC-2.3.5.tar.gz - https://sourceforge.net/projects/unixodbc/files/unixODBC/2.3.5/ChangeLog/download - https://access.redhat.com/errata/RHSA-2019:2336
CVE ID: CVE-2018-7417 State: PUBLISHED Published: 2018-02-23T22:00:00 Last Updated: 2024-08-05T06:24:11.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the IPMI dissector could crash. This was addressed in epan/dissectors/packet-ipmi-picmg.c by adding support for crafted packets that lack an IPMI header. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/04/msg00018.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=81216a176b25dd8a616e11808a951e141a467009 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14409 - https://lists.debian
16a176b25dd8a616e11808a951e141a467009 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14409 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html - http://www.securityfocus.com/bid/103156 - https://www.wireshark.org/security/wnpa-sec-2018-12.html
CVE ID: CVE-2018-7418 State: PUBLISHED Published: 2018-02-23T22:00:00 Last Updated: 2024-08-05T06:24:11.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by correcting the extraction of the length value. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/04/msg00018.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14410 - http://www.securityfocus.com/bid/103157 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html - https://www.wireshark.org/security/wnp
bid/103157 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html - https://www.wireshark.org/security/wnpa-sec-2018-13.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=29d920b8309905dda11ad397596fe8aafc9b4bf7
CVE ID: CVE-2018-7419 State: PUBLISHED Published: 2018-02-23T22:00:00 Last Updated: 2024-08-05T06:24:11.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the NBAP dissector could crash. This was addressed in epan/dissectors/asn1/nbap/nbap.cnf by ensuring DCH ID initialization. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/04/msg00018.html - https://www.debian.org/security/2018/dsa-4217 - https://www.wireshark.org/security/wnpa-sec-2018-14.html - http://www.securityfocus.com/bid/103159 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14443 - https://code.wir
- http://www.securityfocus.com/bid/103159 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14443 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=bebd3a1f50b0a27738d8d3da5b33c1b392eb7273
CVE ID: CVE-2018-7420 State: PUBLISHED Published: 2018-02-23T22:00:00 Last Updated: 2024-08-05T06:24:11.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the pcapng file parser could crash. This was addressed in wiretap/pcapng.c by adding a block-size check for sysdig event blocks. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=129e41f9f63885ad8224ef413c2860788fb9e849 - https://lists.debian.org/debian-lts-announce/2018/04/msg00018.html - http://www.securityfocus.com/bid/103163 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.h
sg00018.html - http://www.securityfocus.com/bid/103163 - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14403 - https://www.wireshark.org/security/wnpa-sec-2018-11.html
CVE ID: CVE-2018-7421 State: PUBLISHED Published: 2018-02-23T22:00:00 Last Updated: 2024-08-05T06:24:12.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the DMP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dmp.c by correctly supporting a bounded number of Security Categories for a DMP Security Classification. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=656812ee1f2a8ddfd383b02a066e888f5919e17a - https://www.wireshark.org/security/wnpa-sec-2018-06.html - https://code.wireshark.org/review/gitweb?p=w
6e888f5919e17a - https://www.wireshark.org/security/wnpa-sec-2018-06.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e8be5adae469ba563acfad2c2b98673e1afaf901 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14408
CVE ID: CVE-2018-7422 State: PUBLISHED Published: 2018-03-19T14:00:00 Last Updated: 2024-08-05T06:24:12.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/40 - https://www.exploit-db.com/exploits/44340/ - https://wpvulndb.com/vulnerabilities/9044
CVE ID: CVE-2018-7427 State: PUBLISHED Published: 2018-10-23T21:00:00 Last Updated: 2024-08-05T06:24:11.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/view/SP-CAAAP5T
CVE ID: CVE-2018-7429 State: PUBLISHED Published: 2018-10-23T21:00:00 Last Updated: 2024-08-05T06:24:11.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Splunkd in Splunk Enterprise 6.2.x before 6.2.14 6.3.x before 6.3.11, and 6.4.x before 6.4.8; and Splunk Light before 6.5.0 allow remote attackers to cause a denial of service via a malformed HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/view/SP-CAAAP5T
CVE ID: CVE-2018-7431 State: PUBLISHED Published: 2018-10-23T21:00:00 Last Updated: 2024-08-05T06:24:12.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Splunk Django App in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allows remote authenticated users to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/view/SP-CAAAP5T
CVE ID: CVE-2018-7432 State: PUBLISHED Published: 2018-10-23T21:00:00 Last Updated: 2024-08-05T06:24:11.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Splunk Enterprise 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allow remote attackers to cause a denial of service via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/view/SP-CAAAP5T
CVE ID: CVE-2018-7433 State: PUBLISHED Published: 2018-03-02T20:00:00 Last Updated: 2024-08-05T06:24:11.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/better-wp-security/#developers
CVE ID: CVE-2018-7434 State: PUBLISHED Published: 2018-02-24T03:00:00 Last Updated: 2024-08-05T06:24:11.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kongxin520/zzcms/blob/master/zzcms_8.2_bug.md - https://kongxin.gitbook.io/zzcms-8-2-bug/
CVE ID: CVE-2018-7435 State: PUBLISHED Published: 2018-02-23T21:00:00 Last Updated: 2024-08-05T06:24:12.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroy_cell function. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html - https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE - https://www.debian.org/security/2018/dsa-4129 - https://bugzilla.redhat.com/show_bug.cgi?id=1547879 - https://security.gentoo.org/glsa/202007-44
CVE ID: CVE-2018-7436 State: PUBLISHED Published: 2018-02-23T21:00:00 Last Updated: 2024-08-05T06:24:12.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a pointer dereference of the parse_SST function. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html - https://bugzilla.redhat.com/show_bug.cgi?id=1547883 - https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE - https://www.debian.org/security/2018/dsa-4129 - https://security.gentoo.org/glsa/202007-44
CVE ID: CVE-2018-7437 State: PUBLISHED Published: 2018-02-23T21:00:00 Last Updated: 2024-08-05T06:24:12.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy call of the parse_SST function. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html - https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE - https://www.debian.org/security/2018/dsa-4129 - https://bugzilla.redhat.com/show_bug.cgi?id=1547885 - https://security.gentoo.org/glsa/202007-44
CVE ID: CVE-2018-7438 State: PUBLISHED Published: 2018-02-23T21:00:00 Last Updated: 2024-08-05T06:24:11.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_unicode_string function. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html - https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE - https://bugzilla.redhat.com/show_bug.cgi?id=1547889 - https://www.debian.org/security/2018/dsa-4129 - https://security.gentoo.org/glsa/202007-44
CVE ID: CVE-2018-7439 State: PUBLISHED Published: 2018-02-23T21:00:00 Last Updated: 2024-08-05T06:24:12.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the function read_mini_biff_next_record. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00000.html - https://groups.google.com/forum/#%21topic/spatialite-users/b-d9iB5TDPE - https://bugzilla.redhat.com/show_bug.cgi?id=1547892 - https://www.debian.org/security/2018/dsa-4129 - https://security.gentoo.org/glsa/202007-44
CVE ID: CVE-2018-7440 State: PUBLISHED Published: 2018-02-23T00:00:00 Last Updated: 2024-08-05T06:24:12.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00005.html - https://github.com/DanBloomberg/leptonica/issues/303#issuecomment-366472212 - https://security.gentoo.org/glsa/202312-01
CVE ID: CVE-2018-7441 State: PUBLISHED Published: 2018-02-23T00:00:00 Last Updated: 2024-08-05T06:24:12.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junk_split_image.ps in prog/splitimage2pdf.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts/2018/02/msg00054.html - https://security.gentoo.org/glsa/202312-01
CVE ID: CVE-2018-7442 State: PUBLISHED Published: 2018-02-23T00:00:00 Last Updated: 2024-08-05T06:24:12.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts/2018/02/msg00086.html - https://security.gentoo.org/glsa/202312-01
CVE ID: CVE-2018-7443 State: PUBLISHED Published: 2018-02-23T22:00:00 Last Updated: 2024-08-05T06:24:11.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the amount of image data in a file, which allows remote attackers to cause a denial of service (memory allocation failure in the AcquireMagickMemory function in MagickCore/memory.c). Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/02/msg00028.html - https://github.com/ImageMagick/ImageMagick/issues/999 - https://usn.ubuntu.com/3681-1/ - https://lists.debian.org/de
l - https://github.com/ImageMagick/ImageMagick/issues/999 - https://usn.ubuntu.com/3681-1/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2018-7445 State: PUBLISHED Published: 2018-03-19T21:00:00.000Z Last Updated: 2025-10-21T23:45:55.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
before versions 6.41.3/6.42rc27 are vulnerable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/103427 - http://seclists.org/fulldisclosure/2018/Mar/38 - https://www.exploit-db.com/exploits/44290/ - https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow
CVE ID: CVE-2018-7447 State: PUBLISHED Published: 2018-02-24T02:00:00 Last Updated: 2024-08-05T06:24:11.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: mojoPortal through 2.6.0.0 is prone to multiple persistent cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. The 'Title' and 'Subtitle' fields of the 'Blog' page are vulnerable. NOTE: The software maintainer disputes this as a vulnerability because the fields claimed to be vulnerable to XSS are only available to administrators who are supposed to have access to add scripts Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://www.securityfocus.com/
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://www.securityfocus.com/bid/103263 - https://github.com/i7MEDIA/mojoportal/issues/82