Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-17376 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filter_letter parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45475/ - http://packetstormsecurity.com/files/149531/Joomla-Reverse-Auction-Factory-4.3.8-SQL-Injection.html
CVE ID: CVE-2018-17377 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45468/ - http://packetstormsecurity.com/files/149523/Joomla-Questions-1.4.3-SQL-Injection.html
CVE ID: CVE-2018-17378 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45466/ - http://packetstormsecurity.com/files/149522/Joomla-Penny-Auction-Factory-2.0.4-SQL-Injection.html
CVE ID: CVE-2018-17379 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45464/ - http://packetstormsecurity.com/files/149520/Joomla-Raffle-Factory-3.5.2-SQL-Injection.html
CVE ID: CVE-2018-17380 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_end_date parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149533/Joomla-Article-Factory-Manager-4.3.9-SQL-Injection.html - https://www.exploit-db.com/exploits/45477/
CVE ID: CVE-2018-17381 State: PUBLISHED Published: 2019-06-19T17:17:24 Last Updated: 2024-08-05T10:47:04.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Dutch Auction Factory 2.0.2 component for Joomla! via the filter_order_Dir or filter_order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45462
CVE ID: CVE-2018-17382 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter_letter parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149524/Joomla-Jobs-Factory-2.0.4-SQL-Injection.html - https://www.exploit-db.com/exploits/45469/
CVE ID: CVE-2018-17383 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45474/ - http://packetstormsecurity.com/files/149530/Joomla-Collection-Factory-4.1.9-SQL-Injection.html
CVE ID: CVE-2018-17384 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45473/ - http://packetstormsecurity.com/files/149529/Joomla-Swap-Factory-2.2.1-SQL-Injection.html
CVE ID: CVE-2018-17385 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radius] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149525/Joomla-Social-Factory-3.8.3-SQL-Injection.html - https://www.exploit-db.com/exploits/45470/
CVE ID: CVE-2018-17386 State: PUBLISHED Published: 2019-06-19T17:10:10 Last Updated: 2024-08-05T10:47:04.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATH_INFO to mydeals/ or listdeals/. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45452
CVE ID: CVE-2018-17387 State: PUBLISHED Published: 2019-06-19T17:04:39 Last Updated: 2024-08-05T10:47:04.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/42648
CVE ID: CVE-2018-17388 State: PUBLISHED Published: 2019-06-19T17:00:59 Last Updated: 2024-08-05T10:47:04.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in Twilio WEB To Fax Machine System 1.0 via the email or password parameter to login_check.php, or the id parameter to add_email.php or edit_content.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/46139
CVE ID: CVE-2018-17389 State: PUBLISHED Published: 2019-06-19T16:55:08 Last Updated: 2024-08-05T10:47:04.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF exists in server.php in Live Call Support Application 1.5 for adding an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/46140
CVE ID: CVE-2018-17391 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149519/Super-Cms-Blog-Pro-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/45463/
CVE ID: CVE-2018-17393 State: PUBLISHED Published: 2019-06-19T16:46:41 Last Updated: 2024-08-05T10:47:04.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in HealthNode Hospital Management System 1.0 via the id parameter to dashboard/Patient/info.php or dashboard/Patient/patientdetails.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/46148
CVE ID: CVE-2018-17394 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45478/ - http://packetstormsecurity.com/files/149534/Joomla-Timetable-Schedule-3.6.8-SQL-Injection.html
CVE ID: CVE-2018-17397 State: PUBLISHED Published: 2018-09-28T00:00:00 Last Updated: 2024-08-05T10:47:04.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45476/ - http://packetstormsecurity.com/files/149532/Joomla-AlphaIndex-Dictionaries-1.0-SQL-Injection.html
CVE ID: CVE-2018-17398 State: PUBLISHED Published: 2019-06-19T16:44:56 Last Updated: 2024-08-05T10:47:04.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the AMGallery 1.2.3 component for Joomla! via the filter_category_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45451
CVE ID: CVE-2018-17399 State: PUBLISHED Published: 2019-06-19T16:41:56 Last Updated: 2024-08-05T10:47:04.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/author/?a=8844 - https://www.exploit-db.com/exploits/45524
CVE ID: CVE-2018-17400 State: PUBLISHED Published: 2018-09-23T22:00:00 Last Updated: 2024-08-05T10:47:04.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by intercepting the user name and PIN during the initial configuration of the application. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is
form provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/PhonePe-%20Authentication%20Bypass-1.pdf
CVE ID: CVE-2018-17401 State: PUBLISHED Published: 2018-09-23T22:00:00 Last Updated: 2024-08-05T10:47:04.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or m
turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20Authentication%20Bypass-2.pdf
CVE ID: CVE-2018-17402 State: PUBLISHED Published: 2018-09-23T22:00:00 Last Updated: 2024-08-05T10:47:04.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiration date, and CVV number. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malic
ing on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20-%20Credit%20and%20Debit%20Card%20Leak.pdf
CVE ID: CVE-2018-17403 State: PUBLISHED Published: 2018-09-23T22:00:00 Last Updated: 2024-08-05T10:47:04.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to impersonate a user and set up their account without their knowledge. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or maliciou
on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/PhonePe-%20User%20Impersonation.pdf
CVE ID: CVE-2018-17404 State: PUBLISHED Published: 2018-09-23T22:00:00 Last Updated: 2024-08-05T10:47:04.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private information such as mobile number, PAN number (from a government-issued ID), and date of birth. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/SBI_PrivacyViolation.pdf
CVE ID: CVE-2018-17407 State: PUBLISHED Published: 2018-09-23T21:00:00 Last Updated: 2024-08-05T10:47:04.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeX-Live/texlive-source/commit/6ed0077520e2b0da1fd060c7f88db7b2e6068e4c - https://www.debian.org/security/2018/dsa-4299 - https://lists.debian.org/deb
/6ed0077520e2b0da1fd060c7f88db7b2e6068e4c - https://www.debian.org/security/2018/dsa-4299 - https://lists.debian.org/debian-security-announce/2018/msg00230.html - https://usn.ubuntu.com/3788-1/ - https://usn.ubuntu.com/3788-2/
CVE ID: CVE-2018-17408 State: PUBLISHED Published: 2018-10-03T20:00:00 Last Updated: 2024-08-05T10:47:04.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file that is accessed through the Import CSV File menu. Additional Analyst Notes: - CVE Program Container: References: - https://blog.spentera.id/zahir-accounting-enterprise-plus-6/ - https://www.exploit-db.com/exploits/45560/ - https://www.exploit-db.com/exploits/45505/
CVE ID: CVE-2018-17410 State: PUBLISHED Published: 2018-09-26T21:00:00 Last Updated: 2024-08-05T10:47:04.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI. Additional Analyst Notes: - CVE Program Container: References: - https://lab.insightsecurity.com.br/horus-cms/
CVE ID: CVE-2018-17411 State: PUBLISHED Published: 2018-09-26T22:00:00 Last Updated: 2024-08-05T10:47:04.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MrR3boot/CVE-Hunting/blob/master/iWay%20DQS%20XXE.pdf
CVE ID: CVE-2018-17412 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seedis/zzcms/blob/master/README.md
CVE ID: CVE-2018-17413 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seedis/zzcms-xss/blob/master/README.md
CVE ID: CVE-2018-17414 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seedis/zzcms/blob/master/SQL%20injection.md
CVE ID: CVE-2018-17415 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seedis/zzcms/blob/master/SQL%20injection%20in%20zs_elite.php.md
CVE ID: CVE-2018-17416 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seedis/zzcms/blob/master/SQL%20injection%20in%20%20addclass.md
CVE ID: CVE-2018-17418 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbidden_types variable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AlwaysHereFight/monstra_cms-3.0.4--getshell/blob/master/README.md
CVE ID: CVE-2018-17419 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miekg/dns/issues/742
CVE ID: CVE-2018-17420 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/94fzb/zrlog/issues/37
CVE ID: CVE-2018-17421 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathname. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/94fzb/zrlog/issues/39
CVE ID: CVE-2018-17422 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/issues/15286
CVE ID: CVE-2018-17423 State: PUBLISHED Published: 2019-06-19T16:38:15 Last Updated: 2024-08-05T10:47:04.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in e107 v2.1.9. There is a XSS attack on e107_admin/comment.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/e107inc/e107/issues/3414 - https://github.com/Kiss-sh0t/e107_v2.1.9_XSS_poc
CVE ID: CVE-2018-17425 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/153
CVE ID: CVE-2018-17426 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/154
CVE ID: CVE-2018-17427 State: PUBLISHED Published: 2018-10-01T08:00:00 Last Updated: 2024-08-05T10:47:04.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: SIMDComp before 0.1.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) because it can read (and then discard) extra bytes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lemire/simdcomp/issues/21
CVE ID: CVE-2018-17428 State: PUBLISHED Published: 2018-10-03T20:00:00 Last Updated: 2024-08-05T10:47:04.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45518/
CVE ID: CVE-2018-17429 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-05T10:47:04.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: /console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jetiben/jtbc/issues/4
CVE ID: CVE-2018-17431 State: PUBLISHED Published: 2019-01-29T23:00:00 Last Updated: 2024-08-05T10:47:04.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437 - https://drive.google.com/file/d/0BzFJhNQNHcoTbndsUmNjVWNGYWNJaWxYcWNyS2ZDajluTDFz/view - http://packetstormsecurity.com/files/159246/Comodo-Unified-Threat-Management-Web-Console-2.7.0-Remote-Code-Execution.html
CVE ID: CVE-2018-17432 State: PUBLISHED Published: 2018-09-24T14:00:00 Last Updated: 2024-08-05T10:47:04.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln6#null-pointer-dereference-in-h5o_sdspace_encode