Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-8890 State: PUBLISHED Published: 2018-10-12T13:00:00Z Last Updated: 2024-09-16T16:14:12.982Z Vendors: BlackBerry Products: UEM Problem Types: Information disclosure Description: An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user. Additional Analyst Notes: - CVE Program Container: References: - http://support.blackberry.com/kb/articleDetail?articleNumber=000052161&language=en_US
CVE ID: CVE-2018-8891 State: PUBLISHED Published: 2018-12-20T20:00:00 Last Updated: 2024-08-05T07:10:46.960Z Vendors: BlackBerry Products: BlackBerry UEM Problem Types: Stored Cross-Site Scripting Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator. Additional Analyst Notes: - CVE Program Container: References: - http://support.blackberry.com/kb/articleDetail?articleNumber=000054162
CVE ID: CVE-2018-8892 State: PUBLISHED Published: 2018-12-20T20:00:00 Last Updated: 2024-08-05T07:10:46.755Z Vendors: BlackBerry Products: BlackBerry UEM Problem Types: Cross-Site Request Forgery Description: A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrator. Additional Analyst Notes: - CVE Program Container: References: - http://support.blackberry.com/kb/articleDetail?articleNumber=000054162
CVE ID: CVE-2018-8893 State: PUBLISHED Published: 2018-03-31T22:00:00 Last Updated: 2024-08-05T07:10:46.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://www.secz.org/0day/2569.html
CVE ID: CVE-2018-8894 State: PUBLISHED Published: 2018-03-22T04:00:00 Last Updated: 2024-08-05T07:10:46.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2345 Security Guard 3.6, the driver file (2345BdPcSafe.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222108. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222108
CVE ID: CVE-2018-8895 State: PUBLISHED Published: 2018-03-22T04:00:00 Last Updated: 2024-08-05T07:10:46.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222040. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/2345DumpBlock.sys-0x00222040
CVE ID: CVE-2018-8896 State: PUBLISHED Published: 2018-03-22T04:00:00 Last Updated: 2024-08-05T07:10:46.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222044. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/2345DumpBlock.sys-0x00222044
CVE ID: CVE-2018-8897 State: PUBLISHED Published: 2018-05-08T18:00:00 Last Updated: 2024-08-05T07:10:46.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap
crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3
hat transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 - http://openwall.com/lists/oss-security/2018/05/08/4 - http://www.securitytracker.com/id/1040849 - http://www.securityfocus.com/bid/104071 - https://access.redhat.com/errata/RHSA-2018:1350 - https://support.citrix.com/article/CTX234679 - https://access.redhat.com/errata/RHSA-2018:1347 - https://www.exploi
50 - https://support.citrix.com/article/CTX234679 - https://access.redhat.com/errata/RHSA-2018:1347 - https://www.exploit-db.com/exploits/44697/ - https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html - http://www.securitytracker.com/id/1040866 - https://lists.debian.org/debian-lts-announce/2018/11/msg00013.html - https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html - https://support.apple.com/HT208742 - https://access.redhat.com/errata/RHSA-2018:1346 - https://access.redhat.com/errata/RHSA-2018:1348 - https://access.redhat.com/errata/RHSA-2018:1354 - https://svnweb.freebsd.org/base?view=revision&revision=333368 - https://www.debian.org/security/2018/dsa-4196 - htt
54 - https://svnweb.freebsd.org/base?view=revision&revision=333368 - https://www.debian.org/security/2018/dsa-4196 - https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc - http://www.securitytracker.com/id/1040744 - https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html - https://access.redhat.com/errata/RHSA-2018:1351 - https://bugzilla.redhat.com/show_bug.cgi?id=1567074 - https://xenbits.xen.org/xsa/advisory-260.html - https://access.redhat.com/errata/RHSA-2018:1319 - https://www.debian.org/security/2018/dsa-4201 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://access.redhat.
struxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://access.redhat.com/errata/RHSA-2018:1355 - https://security.netapp.com/advisory/ntap-20180927-0002/ - https://access.redhat.com/errata/RHSA-2018:1345 - https://www.exploit-db.com/exploits/45024/ - https://access.redhat.com/errata/RHSA-2018:1349 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897 - https://access.redhat.com/errata/RHSA-2018:1352 - https://access.redhat.com/errata/RHSA-2018:1318 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 - https://patchwork.kernel.org/patch/10386677/ - h
orvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9 - https://patchwork.kernel.org/patch/10386677/ - https://www.kb.cert.org/vuls/id/631579 - https://github.com/can1357/CVE-2018-8897/ - https://access.redhat.com/errata/RHSA-2018:1524 - http://openwall.com/lists/oss-security/2018/05/08/1 - http://www.securitytracker.com/id/1040861 - https://access.redhat.com/errata/RHSA-2018:1353 - https://usn.ubuntu.com/3641-2/ - https://www.synology.com/support/security/Synology_SA_18_21 - http://www.securitytracker.com/id/1040882 - https://usn.ubuntu.com/3641-1/ - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-en
CVE ID: CVE-2018-8898 State: PUBLISHED Published: 2018-05-23T16:00:00 Last Updated: 2024-08-05T07:10:47.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67") allows unauthenticated attackers to perform arbitrary modification (read, write) to passwords and configurations meanwhile an administrator is logged into the web panel. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147708/D-Link-DSL-3782-Authentication-Bypass.html - https://www.exploit-db.com/exploi
tp://packetstormsecurity.com/files/147708/D-Link-DSL-3782-Authentication-Bypass.html - https://www.exploit-db.com/exploits/44657/
CVE ID: CVE-2018-8899 State: PUBLISHED Published: 2018-03-22T05:00:00 Last Updated: 2024-08-05T07:10:47.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895 - https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3 - https://github.com/IdentityServer/IdentityServer4/issues/2164 - https://github.com/IdentityServer/IdentityServ
g/2.1.3 - https://github.com/IdentityServer/IdentityServer4/issues/2164 - https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3
CVE ID: CVE-2018-8900 State: PUBLISHED Published: 2018-05-02T21:00:00 Last Updated: 2024-08-05T07:10:47.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf - https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing
CVE ID: CVE-2018-8901 State: PUBLISHED Published: 2018-06-29T15:00:00 Last Updated: 2024-08-05T07:10:46.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. A local user with database access privileges can read the encrypted passwords for users who authenticate via LDAP to Avalanche services. These passwords are stored in the Avalanche databases. This issue only affects customers who have enabled LDAP authentication in their configuration. Additional Analyst Notes: - CVE Program Container: References: - https://community.ivanti.com/docs/DOC-68406
CVE ID: CVE-2018-8902 State: PUBLISHED Published: 2018-06-29T15:00:00 Last Updated: 2024-08-05T07:10:46.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt data. A user with access to system databases can use the discovered key to access potentially confidential stored data, which may include Wi-Fi passwords. This discovered key can be used for all instances of the product. Additional Analyst Notes: - CVE Program Container: References: - https://community.ivanti.com/docs/DOC-68406
CVE ID: CVE-2018-8903 State: PUBLISHED Published: 2018-03-22T21:00:00 Last Updated: 2024-08-05T07:10:46.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen. Additional Analyst Notes: - CVE Program Container: References: - https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html - https://www.exploit-db.com/exploits/44354/
CVE ID: CVE-2018-8904 State: PUBLISHED Published: 2018-03-22T04:00:00 Last Updated: 2024-08-05T07:10:46.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002000. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002000
CVE ID: CVE-2018-8905 State: PUBLISHED Published: 2018-03-22T04:00:00 Last Updated: 2024-08-05T07:10:46.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2780 - https://lists.debian.org/debian-lts-announce/2018/05/msg00009.html - https://lists.debian.org/debian-lts-announce/2018/05/msg00008.html - https://github.com/halfbitteam/POCs/tree/master/libtiff-4.08_tiff2ps_heap_overflow - https://usn.ubuntu.com/3864-1/ - https:/
://github.com/halfbitteam/POCs/tree/master/libtiff-4.08_tiff2ps_heap_overflow - https://usn.ubuntu.com/3864-1/ - https://www.debian.org/security/2018/dsa-4349 - https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html - https://gitlab.com/libtiff/libtiff/commit/58a898cb4459055bb488ca815c23b880c242a27d - https://access.redhat.com/errata/RHSA-2019:2053
CVE ID: CVE-2018-8906 State: PUBLISHED Published: 2018-03-22T04:00:00 Last Updated: 2024-08-05T07:10:46.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/address_id/2.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xuheunbaicai/cangku/blob/master/cve/dsmall_v20180320_bug.md
CVE ID: CVE-2018-8908 State: PUBLISHED Published: 2018-03-31T22:00:00 Last Updated: 2024-08-05T07:10:47.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens due to lack of an anti-CSRF token in state modification requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44383/ - http://securitywarrior9.blogspot.in/2018/03/cross-site-req
r: References: - https://www.exploit-db.com/exploits/44383/ - http://securitywarrior9.blogspot.in/2018/03/cross-site-request-forgery-frog-cms-cve.html
CVE ID: CVE-2018-8909 State: PUBLISHED Published: 2018-03-22T06:00:00Z Last Updated: 2024-09-16T23:05:25.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to AssetService.scala. Additional Analyst Notes: - CVE Program Container: References: - https://www.x41-dsec.de/reports/X41-Kudelski-Wire-Security-Review-Android.pdf
CVE ID: CVE-2018-8910 State: PUBLISHED Published: 2018-05-10T13:00:00Z Last Updated: 2024-09-16T23:46:48.184Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Drive Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_18_05
CVE ID: CVE-2018-8911 State: PUBLISHED Published: 2018-05-09T13:00:00Z Last Updated: 2024-09-16T23:20:43.743Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Note Station Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/zh-tw/support/security/Synology_SA_18_03
CVE ID: CVE-2018-8912 State: PUBLISHED Published: 2018-05-09T13:00:00Z Last Updated: 2024-09-17T02:27:30.032Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Note Station Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via the commit_msg parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/zh-tw/support/security/Synology_SA_18_03
CVE ID: CVE-2018-8913 State: PUBLISHED Published: 2019-04-01T14:23:46.446649Z Last Updated: 2024-09-16T23:51:27.715Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Web Station Problem Types: CWE-756 Description: Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_18_29
CVE ID: CVE-2018-8914 State: PUBLISHED Published: 2018-05-10T13:00:00Z Last Updated: 2024-09-16T17:42:57.562Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Synology Products: Media Server Problem Types: CWE-89 Description: SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_18_04
CVE ID: CVE-2018-8915 State: PUBLISHED Published: 2018-05-10T13:00:00Z Last Updated: 2024-09-16T23:51:35.408Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Calendar Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary web script or HTML via title parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_18_06
CVE ID: CVE-2018-8916 State: PUBLISHED Published: 2018-06-08T13:00:00Z Last Updated: 2024-09-16T18:59:05.978Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-620 Description: Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_18_24
CVE ID: CVE-2018-8917 State: PUBLISHED Published: 2018-12-24T15:00:00Z Last Updated: 2024-09-16T16:43:47.090Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_18_14
CVE ID: CVE-2018-8918 State: PUBLISHED Published: 2018-12-24T15:00:00Z Last Updated: 2024-09-17T03:12:24.697Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arbitrary web script or HTML via the host parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_18_25
CVE ID: CVE-2018-8919 State: PUBLISHED Published: 2018-12-24T15:00:00Z Last Updated: 2024-09-16T18:34:52.888Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-200 Description: Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_18_14
CVE ID: CVE-2018-8920 State: PUBLISHED Published: 2018-12-24T15:00:00Z Last Updated: 2024-09-17T00:06:52.970Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-116 Description: Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_18_14
CVE ID: CVE-2018-8921 State: PUBLISHED Published: 2018-06-01T13:00:00Z Last Updated: 2024-09-16T23:56:17.996Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Drive Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_18_11
CVE ID: CVE-2018-8922 State: PUBLISHED Published: 2018-06-01T13:00:00Z Last Updated: 2024-09-16T22:30:30.967Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: Drive Problem Types: CWE-284 Description: Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_18_11