Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ccess.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://crbug.com/881659 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18349 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.430Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/894399 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - htt
es.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18350 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.492Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/799747 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/b
access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18351 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.656Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/833847 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://w
esktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18352 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.564Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/849942 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://
desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18353 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.542Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/884179 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/d
annel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18354 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.554Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external programs via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://crbug.com/889459 - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/
/access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18355 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.459Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/896717 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityf
- https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18356 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.499Z Vendors: Google Products: Chrome Problem Types: Use after free Description: An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0373 - https://usn.ubuntu.com/3897-1/ - https://crbug.com/883666 - https://lists.debian.org/debian-lts-announce/2019/02/msg00023.html - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/389
.org/debian-lts-announce/2019/02/msg00023.html - https://security.gentoo.org/glsa/201903-04 - https://usn.ubuntu.com/3896-1/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00024.html - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2019:0374 - https://www.debian.org/security/2019/dsa-4391 - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2019/dsa-4392 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201904-07 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html - https://a
urity.gentoo.org/glsa/201904-07 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html - https://access.redhat.com/errata/RHSA-2019:1144 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18357 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.325Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/895207 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityf
CVE ID: CVE-2018-18358 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.713Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/899126 - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.
ps://access.redhat.com/errata/RHSA-2018:3803 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18359 State: PUBLISHED Published: 2018-12-11T15:00:00 Last Updated: 2024-08-05T11:08:21.411Z Vendors: Google Products: Chrome Problem Types: Out of bounds read Description: Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html - https://access.redhat.com/errata/RHSA-2018:3803 - https://crbug.com/907714 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://securit
g.com/907714 - https://www.debian.org/security/2018/dsa-4352 - http://www.securityfocus.com/bid/106084 - https://security.gentoo.org/glsa/201908-18
CVE ID: CVE-2018-18361 State: PUBLISHED Published: 2018-10-15T15:00:00 Last Updated: 2024-08-05T11:08:21.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html allows XSS via the name parameter, as demonstrated by a value beginning with home_content and containing a crafted SRC attribute of an IMG element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gnat/nc-cms/issues/10
CVE ID: CVE-2018-18362 State: PUBLISHED Published: 2018-12-06T19:00:00 Last Updated: 2024-08-05T11:08:21.415Z Vendors: Symantec Corporation Products: Norton Password Manager Problem Types: Cross Site Scripting Description: Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_U
e same-origin policy. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1470.html - http://www.securityfocus.com/bid/106055
CVE ID: CVE-2018-18363 State: PUBLISHED Published: 2019-01-24T20:00:00Z Last Updated: 2024-09-17T01:45:56.053Z Vendors: Symantec Corporation Products: Norton App Lock Problem Types: App lock bypass Description: Norton App Lock prior to 1.4.0.445 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1473.html - http://www.securityfocus.com/bid/106450
CVE ID: CVE-2018-18364 State: PUBLISHED Published: 2019-02-08T17:00:00Z Last Updated: 2024-09-16T22:35:04.102Z Vendors: Symantec Corporation Products: Ghost Solution Suite (GSS) Problem Types: DLL Hijack Description: Symantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL hijacking vulnerability, which is a type of issue whereby a potential attacker attempts to execute unexpected code on your machine. This occurs via placement of a potentially foreign file (DLL) that the attacker then attempts to run via a linked application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106684 - https://support.symantec.co
lyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106684 - https://support.symantec.com/en_US/article.SYMSA1474.html
CVE ID: CVE-2018-18365 State: PUBLISHED Published: 2019-04-09T19:04:35 Last Updated: 2024-08-05T11:08:21.553Z Vendors: n/a Products: Norton Password Manager Problem Types: Address Spoof Description: Norton Password Manager may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1475.html
CVE ID: CVE-2018-18366 State: PUBLISHED Published: 2019-04-25T19:13:05 Last Updated: 2024-08-05T11:08:21.470Z Vendors: Symantec Corporation Products: Norton Security, SEP (Windows client), SEP SBE, SEP Cloud Problem Types: Kernel memory disclosure Description: Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be susceptible to a kernel memory disclosure, which is a type of issue where a specially crafted IRP request can cause the driver to return uninitialized memory. Additional Analyst Notes: - CVE Program
cially crafted IRP request can cause the driver to return uninitialized memory. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1479.html - http://www.securityfocus.com/bid/107994
CVE ID: CVE-2018-18367 State: PUBLISHED Published: 2019-04-25T19:22:17 Last Updated: 2024-08-05T11:08:21.714Z Vendors: Symantec Corporation Products: Symantec Endpoint Protection Manager Problem Types: DLL Preloading Description: Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1479.html - http://www.securityfocus.com/bid/10799
tainer: References: - https://support.symantec.com/en_US/article.SYMSA1479.html - http://www.securityfocus.com/bid/107996
CVE ID: CVE-2018-18368 State: PUBLISHED Published: 2019-11-15T16:58:10 Last Updated: 2024-08-05T11:08:21.448Z Vendors: n/a Products: Symantec Endpoint Protection Manager (SEPM) Problem Types: Privilege Escalation Description: Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1488.html
CVE ID: CVE-2018-18369 State: PUBLISHED Published: 2019-04-25T16:55:04 Last Updated: 2024-08-05T11:08:21.684Z Vendors: Symantec Corporation Products: Norton Security, Symantec Endpoint Protection Small Business Edition Problem Types: DLL Preloading Description: Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Additional Analyst Notes: - CVE Program Container: References: - https://support.s
vides a malicious DLL to use instead. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1479.html - http://www.securityfocus.com/bid/107997
CVE ID: CVE-2018-18370 State: PUBLISHED Published: 2019-08-29T22:13:35 Last Updated: 2024-08-05T11:08:21.643Z Vendors: Symantec Corporation Products: Symantec Advanced Secure Gateway (ASG), Symantec ProxySG Problem Types: Cross-site-scripting (XSS) Description: The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server
P server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1472.html
CVE ID: CVE-2018-18371 State: PUBLISHED Published: 2019-08-29T22:14:58 Last Updated: 2024-08-05T11:08:21.699Z Vendors: Symantec Corporation Products: Symantec Advanced Secure Gateway (ASG), Symantec ProxySG Problem Types: Information disclosure Description: The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6,
web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1472.html
CVE ID: CVE-2018-18372 State: PUBLISHED Published: 2018-10-17T14:00:00 Last Updated: 2024-08-05T11:08:21.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored XSS vulnerability has been discovered in KAASoft Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149805/Library-CMS-2.1.1-Cross-Site-Scripting.html
CVE ID: CVE-2018-18373 State: PUBLISHED Published: 2018-10-17T14:00:00 Last Updated: 2024-08-05T11:08:21.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149806/WordPress-Support-Board-1.2.3-Cross-Site-Scripting.html - https://wpvulndb.com/vulnerabilities/9707
CVE ID: CVE-2018-18374 State: PUBLISHED Published: 2018-10-16T01:00:00Z Last Updated: 2024-09-17T04:14:50.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://mang0.me/archives/a5c61176/
CVE ID: CVE-2018-18375 State: PUBLISHED Published: 2018-10-16T01:00:00Z Last Updated: 2024-09-16T18:56:07.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/remix30303/AirBoxAPNLeaks
CVE ID: CVE-2018-18376 State: PUBLISHED Published: 2018-10-16T01:00:00Z Last Updated: 2024-09-16T19:46:10.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/remix30303/AirboxLeak
CVE ID: CVE-2018-18377 State: PUBLISHED Published: 2018-10-16T01:00:00Z Last Updated: 2024-09-16T19:51:51.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/remix30303/AirBoxDoom
CVE ID: CVE-2018-18379 State: PUBLISHED Published: 2019-10-07T11:28:17 Last Updated: 2024-08-05T11:08:21.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.contextis.com/resources/advisories - https://elementor.com/blog/ - https://www.contextis.com/en/resources/advisories/cve-2018-18379
CVE ID: CVE-2018-18380 State: PUBLISHED Published: 2018-10-19T20:00:00 Last Updated: 2024-08-05T11:08:21.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/zionspike/680eb504db7c86296fad0eff30c6317f - https://github.com/bigtreecms/BigTree-CMS/tree/4.2.24 - https://github.com/bigtreecms/BigTree-CMS/commit/c69402c4764ed9a76301c57
github.com/bigtreecms/BigTree-CMS/tree/4.2.24 - https://github.com/bigtreecms/BigTree-CMS/commit/c69402c4764ed9a76301c57277aefe70141b6418
CVE ID: CVE-2018-18381 State: PUBLISHED Published: 2018-10-16T07:00:00 Last Updated: 2024-08-05T11:08:21.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seedis/Z-BlogPHP/blob/master/Z-BlogPHP_stored_xss.md