Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-16292 State: PUBLISHED Published: 2018-10-08T16:00:00 Last Updated: 2024-08-05T10:17:38.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled
CVE ID: CVE-2018-16293 State: PUBLISHED Published: 2018-10-08T16:00:00 Last Updated: 2024-08-05T10:17:38.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled
CVE ID: CVE-2018-16294 State: PUBLISHED Published: 2018-10-08T16:00:00 Last Updated: 2024-08-05T10:17:38.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled
CVE ID: CVE-2018-16295 State: PUBLISHED Published: 2018-10-08T16:00:00 Last Updated: 2024-08-05T10:17:38.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled
CVE ID: CVE-2018-16296 State: PUBLISHED Published: 2018-10-08T16:00:00 Last Updated: 2024-08-05T10:17:38.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled
CVE ID: CVE-2018-16297 State: PUBLISHED Published: 2018-10-08T16:00:00 Last Updated: 2024-08-05T10:17:38.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16296. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled
CVE ID: CVE-2018-16298 State: PUBLISHED Published: 2018-08-31T23:00:00Z Last Updated: 2024-09-17T00:25:28.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/23
CVE ID: CVE-2018-16299 State: PUBLISHED Published: 2018-09-24T22:00:00 Last Updated: 2024-08-05T10:17:38.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Sep/33 - https://www.exploit-db.com/exploits/45439/ - https://github.com/julianburr/wp-plugin-localizemypost/issues/1 - https://packetstormsecurity.com/files/149433/WordPress-Localize-My-Post-1.0-Local-File-Inclusion.html
CVE ID: CVE-2018-16300 State: PUBLISHED Published: 2019-10-03T15:52:39 Last Updated: 2024-08-05T10:17:38.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES - https://github.com/the-tcpdump-group/tcpdump/commit/af2cf04a9394c1a56227c2289ae8da262828294a - https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.org
0/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html - https://seclists.org/bugtraq/2019/Oct/28 - https://www.debian.org/security/2019/dsa-4547 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ - https://support.apple.com/kb/HT210788
ge-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ - https://support.apple.com/kb/HT210788 - https://seclists.org/bugtraq/2019/Dec/23 - http://seclists.org/fulldisclosure/2019/Dec/26 - https://security.netapp.com/advisory/ntap-20200120-0001/ - https://usn.ubuntu.com/4252-2/ - https://usn.ubuntu.com/4252-1/
CVE ID: CVE-2018-16301 State: PUBLISHED Published: 2019-10-03T15:55:20 Last Updated: 2024-08-05T10:17:38.421Z Vendors: The Tcpdump Group Products: tcpdump Problem Types: CWE-190, CWE-787 Description: The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/commit/ad7c25bc0decf96dc7768c9e903734d38528b1bd
CVE ID: CVE-2018-16302 State: PUBLISHED Published: 2018-09-01T14:00:00 Last Updated: 2024-08-05T10:17:38.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44828/
CVE ID: CVE-2018-16303 State: PUBLISHED Published: 2018-09-01T14:00:00 Last Updated: 2024-08-05T10:17:38.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564. Additional Analyst Notes: - CVE Program Container: References: - https://forum.tracker-software.com/viewtopic.php?f=62&t=31419
CVE ID: CVE-2018-16307 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:17:38.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name (containing a random string) is used in the HTTP Host header, the application performs an HTTP request to the specified domain. The response from that request is then included in the application's own response. Additional Analyst Notes: - CVE Program Container: Refer
hat request is then included in the application's own response. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149196/MIWiFi-Xiaomi_55DD-2.8.50-Out-Of-Band-Resource-Load.html
CVE ID: CVE-2018-16308 State: PUBLISHED Published: 2018-09-01T18:00:00 Last Updated: 2024-08-05T10:17:38.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ninja-forms/#developers - https://www.exploit-db.com/exploits/45234/ - https://packetstormsecurity.com/files/148993/WordPress-Ninja-Forms-3.3.13-CSV-Injection.html
CVE ID: CVE-2018-16309 State: REJECTED Published: 2018-09-17T04:00:00 Last Updated: 2018-09-17T03:57:01 Description: No description available.
CVE ID: CVE-2018-16310 State: PUBLISHED Published: 2018-09-06T23:00:00 Last Updated: 2024-08-27T20:20:11.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Technicolor TG588V V2 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by macof. NOTE: this might overlap CVE-2018-15852 and CVE-2018-15907. NOTE: Technicolor denies that the described behavior is a vulnerability and states that Wi-Fi traffic is slowed or stopped only while the devices are exposed to a MAC flooding attack. This has been confirmed through testing against official up-to-date versions Additional Analyst Notes: - CISA ADP Vulnrich
is has been confirmed through testing against official up-to-date versions Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://buddieshub27.blogspot.com/2018/09/cve-2018-16310-technicolor-tg588v-v2.html
CVE ID: CVE-2018-16313 State: PUBLISHED Published: 2018-09-01T18:00:00 Last Updated: 2024-08-05T10:17:38.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bludit 2.3.4 allows XSS via a user name. Additional Analyst Notes: - CVE Program Container: References: - https://blog.csdn.net/F_carry/article/details/81536424
CVE ID: CVE-2018-16314 State: PUBLISHED Published: 2018-09-01T18:00:00 Last Updated: 2024-08-05T10:17:38.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/35
CVE ID: CVE-2018-16315 State: PUBLISHED Published: 2018-09-01T18:00:00 Last Updated: 2024-08-05T10:17:38.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caokang/waimai/issues/3
CVE ID: CVE-2018-16316 State: PUBLISHED Published: 2018-09-01T18:00:00 Last Updated: 2024-08-05T10:17:38.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/portainer/portainer/commit/1ad150c99460a35224d6adfe48ddda9ee056b7d2
CVE ID: CVE-2018-16320 State: PUBLISHED Published: 2018-09-01T18:00:00 Last Updated: 2024-08-05T10:17:38.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/41
CVE ID: CVE-2018-16323 State: PUBLISHED Published: 2018-09-01T18:00:00 Last Updated: 2024-08-05T10:17:38.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45890/ - https://github.com/ImageMagick/ImageMagick/commit/216d117f05bff87b9dc4db55a1b1fadb38bcb786 - https://usn.ubuntu.c
890/ - https://github.com/ImageMagick/ImageMagick/commit/216d117f05bff87b9dc4db55a1b1fadb38bcb786 - https://usn.ubuntu.com/3785-1/ - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-16324 State: PUBLISHED Published: 2018-09-01T18:00:00 Last Updated: 2024-08-05T10:17:38.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2018080098 - https://packetstormsecurity.com/files/148887/IceWarp-WebMail-12.0.3.1-Cross-Site-Scripting.html
CVE ID: CVE-2018-16325 State: PUBLISHED Published: 2018-09-01T22:00:00 Last Updated: 2024-08-05T10:17:38.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1284
CVE ID: CVE-2018-16326 State: PUBLISHED Published: 2018-10-04T21:00:00 Last Updated: 2024-08-05T10:17:38.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Olx Clone 3.4.2 has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://googlequeens.com/2018/09/02/cve-2018-16326-olx_clone-3-4-2-stored-xss-via-search-by-keyword/
CVE ID: CVE-2018-16327 State: PUBLISHED Published: 2018-09-01T22:00:00 Last Updated: 2024-08-05T10:17:38.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/issues/771
CVE ID: CVE-2018-16328 State: PUBLISHED Published: 2018-09-01T22:00:00Z Last Updated: 2024-09-16T17:28:05.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1224
CVE ID: CVE-2018-16329 State: PUBLISHED Published: 2018-09-01T22:00:00Z Last Updated: 2024-09-17T00:40:34.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1225
CVE ID: CVE-2018-16330 State: PUBLISHED Published: 2018-09-02T03:00:00 Last Updated: 2024-08-05T10:17:38.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pandao/editor.md/issues/612
CVE ID: CVE-2018-16331 State: PUBLISHED Published: 2018-09-02T03:00:00 Last Updated: 2024-08-05T10:24:31.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Vict00r/poc/issues/1
CVE ID: CVE-2018-16332 State: PUBLISHED Published: 2018-09-02T03:00:00 Last Updated: 2024-08-05T10:24:31.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/31
CVE ID: CVE-2018-16333 State: PUBLISHED Published: 2018-09-02T03:00:00 Last Updated: 2024-08-05T10:24:31.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server. While processing the ssid parameter for a POST request, the value is directly used in a sprintf call to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://git
of the function, causing a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZIllR0/Routers/blob/master/Tenda/oob1.md
CVE ID: CVE-2018-16334 State: PUBLISHED Published: 2018-09-02T03:00:00 Last Updated: 2024-08-05T10:24:32.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-04/tenda.md
CVE ID: CVE-2018-16335 State: PUBLISHED Published: 2018-09-02T03:00:00 Last Updated: 2024-08-05T10:24:31.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4349 - http://bugzilla.maptools.org/show_bug.cgi?id=2809
CVE ID: CVE-2018-16336 State: PUBLISHED Published: 2018-09-02T03:00:00 Last Updated: 2024-08-05T10:24:31.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/400 - https://usn.ubuntu.com/3852-1/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00012.html
CVE ID: CVE-2018-16337 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chshcms/cscms/issues/2
CVE ID: CVE-2018-16338 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auracms/AuraCMS/issues/3
CVE ID: CVE-2018-16339 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sbmzhcn/EmpireCMS/issues/1
CVE ID: CVE-2018-16342 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:32.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: ShowDoc v1.8.0 has XSS via a new page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/issues/325
CVE ID: CVE-2018-16343 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:32.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cumtxujiabin/CmsPoc/blob/master/Seacms_v6.61_backend_RCE.md - http://zhinianyuxin.postach.io/post/seacms-v6-61-latest-version-backend-rce
CVE ID: CVE-2018-16344 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cumtxujiabin/CmsPoc/blob/master/zzcms_8.3_file_del.md
CVE ID: CVE-2018-16345 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/teameasy/EasyCMS/issues/5
CVE ID: CVE-2018-16346 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChemCMS 1.0.6 has XSS via the "setting -> website information" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chemcms/ChemCMS/issues/2
CVE ID: CVE-2018-16347 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gleez/cms/issues/798
CVE ID: CVE-2018-16348 State: PUBLISHED Published: 2018-09-02T18:00:00 Last Updated: 2024-08-05T10:24:31.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Jas0nwhy/vulnerability/blob/master/Seacmsxss.md