Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ulnerability-alert/45938 - https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf - https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txt - https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937 - https://github.com/pkp/pkp-lib/issues/3805
CVE ID: CVE-2018-12589 State: PUBLISHED Published: 2018-06-28T14:00:00 Last Updated: 2024-08-05T08:38:06.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/148312/Polaris-Office-2017-8.1-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/44985/
CVE ID: CVE-2018-12590 State: PUBLISHED Published: 2018-06-20T12:00:00Z Last Updated: 2024-09-16T22:55:54.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/311884
CVE ID: CVE-2018-12591 State: PUBLISHED Published: 2018-06-20T12:00:00Z Last Updated: 2024-09-16T23:20:44.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an improperly neutralized element in an OS command due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary shell instructions. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/313245
CVE ID: CVE-2018-12592 State: PUBLISHED Published: 2018-06-20T12:00:00 Last Updated: 2024-08-05T08:38:06.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Polycom RealPresence Web Suite before 2.2.0 does not block a user's video for a few seconds upon joining a meeting (when the user has explicitly chosen to turn off the video using a specific option). During those seconds, a meeting invitee may unknowingly be on camera with other participants able to view. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104524 - https://support.polycom.com/content/dam/polycom-support/global/documentation/security-advisory-vulnerability-on-polyc
- https://support.polycom.com/content/dam/polycom-support/global/documentation/security-advisory-vulnerability-on-polycom-realpresence-web-suite-v-1-0.pdf
CVE ID: CVE-2018-12594 State: PUBLISHED Published: 2018-06-20T13:00:00Z Last Updated: 2024-09-16T17:54:43.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reliable Controls MACH-ProWebCom 7.80 devices allow remote attackers to obtain sensitive information via a direct request for the data/fileinfo.xml or job/job.json file, as demonstrated the Master Password field. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97345
CVE ID: CVE-2018-12596 State: PUBLISHED Published: 2018-10-10T21:00:00 Last Updated: 2024-08-05T08:38:06.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden (normally available exclusively for local admins). Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45577/ - http://seclists.org/fulldisclosure/2018/Oct/15 - https://github.com/alt3kx/CVE-2018-12596 - https://medium.com/%40alt
- http://seclists.org/fulldisclosure/2018/Oct/15 - https://github.com/alt3kx/CVE-2018-12596 - https://medium.com/%40alt3kx/ektron-content-management-system-cms-9-20-sp2-remote-re-enabling-users-cve-2018-12596-bdf1e3a05158
CVE ID: CVE-2018-12599 State: PUBLISHED Published: 2018-06-20T18:00:00 Last Updated: 2024-08-05T08:38:06.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/06/msg00004.html - https://usn.ubuntu.com/3711-1/ - https://github.com/ImageMagick/ImageMagick/issues/1177 - https://www.debian.org/security/2018/dsa-4245
CVE ID: CVE-2018-12600 State: PUBLISHED Published: 2018-06-20T18:00:00 Last Updated: 2024-08-05T08:38:06.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/06/msg00004.html - https://usn.ubuntu.com/3711-1/ - https://github.com/ImageMagick/ImageMagick/issues/1178 - https://www.debian.org/security/2018/dsa-4245
CVE ID: CVE-2018-12601 State: PUBLISHED Published: 2018-06-20T18:00:00 Last Updated: 2024-08-05T08:38:06.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer overflow in ReadImage in input-tga.ci in sam2p 0.49.4 that leads to a denial of service or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/08/msg00010.html - https://github.com/pts/sam2p/issues/41
CVE ID: CVE-2018-12602 State: PUBLISHED Published: 2018-06-25T15:00:00 Last Updated: 2024-08-05T08:38:06.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/43/ - http://packetstormsecurity.com/files/148268/LFCMS-3.7.0-Cross-Site-Request-Forgery.html - https://www.cnblogs.com/v1vvwv/p/9203740.html - https://www.exploit-db.com/exploits/44918/
CVE ID: CVE-2018-12603 State: PUBLISHED Published: 2018-06-25T20:00:00 Last Updated: 2024-08-05T08:38:06.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/148268/LFCMS-3.7.0-Cross-Site-Request-Forgery.html - https://www.exploit-db.com/exploits/44919/ - https://www.cnblogs.com/v1vvwv/p/9203899.html - http://www.iwantacve.cn/index.php/
/www.exploit-db.com/exploits/44919/ - https://www.cnblogs.com/v1vvwv/p/9203899.html - http://www.iwantacve.cn/index.php/archives/44/
CVE ID: CVE-2018-12604 State: PUBLISHED Published: 2018-06-20T19:00:00 Last Updated: 2024-08-05T08:38:06.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44922/ - https://github.com/GreenCMS/GreenCMS/issues/110
CVE ID: CVE-2018-12605 State: PUBLISHED Published: 2018-08-03T18:00:00 Last Updated: 2024-08-05T08:38:06.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'url_for' contained a XSS issue due to it allowing arbitrary protocols as a parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/45168 - https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/
CVE ID: CVE-2018-12606 State: PUBLISHED Published: 2018-08-03T18:00:00 Last Updated: 2024-08-05T08:38:06.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/46957 - https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/
CVE ID: CVE-2018-12607 State: PUBLISHED Published: 2018-08-03T18:00:00 Last Updated: 2024-08-05T08:38:06.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/45903 - https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/
CVE ID: CVE-2018-12608 State: PUBLISHED Published: 2018-09-10T17:00:00 Last Updated: 2024-08-05T08:38:06.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moby/moby/pull/33182
CVE ID: CVE-2018-12609 State: PUBLISHED Published: 2019-01-29T23:00:00 Last Updated: 2024-08-05T08:38:06.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery. Additional Analyst Notes: - CVE Program Container: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_4789_7.6.3_2018-06-25.pdf - http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4791_7.8.4_2018-06-25.pdf - http://seclists.org/fulldisclosure/2019/Jan/10 - https://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4790_7.8.3_2018-06-25.pdf
CVE ID: CVE-2018-12610 State: PUBLISHED Published: 2019-01-29T23:00:00 Last Updated: 2024-08-05T08:38:06.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite 7.8.4 and earlier allows Information Exposure. Additional Analyst Notes: - CVE Program Container: References: - http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4791_7.8.4_2018-06-25.pdf - http://seclists.org/fulldisclosure/2019/Jan/10 - https://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4790_7.8.3_2018-06-25.pdf
CVE ID: CVE-2018-12611 State: PUBLISHED Published: 2019-01-29T23:00:00 Last Updated: 2024-08-05T08:38:06.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite 7.8.4 and earlier allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_4789_7.6.3_2018-06-25.pdf - http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4791_7.8.4_2018-06-25.pdf - http://seclists.org/fulldisclosure/2019/Jan/10 - https://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4790_7.8.3_2018-06-25.pdf
CVE ID: CVE-2018-12613 State: PUBLISHED Published: 2018-06-21T20:00:00 Last Updated: 2024-08-05T08:38:06.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] =
fy any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication). Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2018-4/ - https://www.exploit-db.com/exploits/45020/ - http://www.securityfocus.com/bid/104532 - https://www.exploit-db.com/exploits/44924/ - https://www.exploit-db.com/exploits/44928/ - https://security.gentoo.org/glsa/201904-16 - http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html
CVE ID: CVE-2018-12615 State: PUBLISHED Published: 2018-06-21T15:00:00Z Last Updated: 2024-09-17T04:24:12.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8
CVE ID: CVE-2018-12617 State: PUBLISHED Published: 2018-06-21T18:00:00 Last Updated: 2024-08-05T08:38:06.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00
itional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00041.html - https://gist.github.com/fakhrizulkifli/c7740d28efa07dafee66d4da5d857ef6 - https://usn.ubuntu.com/3826-1/ - https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg03385.html - http://www.securityfocus.com/bid/104531 - https://www.exploit-db.com/exploits/44925/ - https://www.debian.org/security/2019/dsa-4454 - https://seclists.org/bugtraq/2019/May/76
CVE ID: CVE-2018-12621 State: PUBLISHED Published: 2019-07-05T16:11:13 Last Updated: 2024-08-05T08:38:06.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the current_page parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/blob/master/CHANGELOG.md - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-12622 State: PUBLISHED Published: 2019-07-10T11:42:38 Last Updated: 2024-08-05T08:38:06.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the field_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/blob/master/CHANGELOG.md - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-12623 State: PUBLISHED Published: 2019-07-10T11:43:24 Last Updated: 2024-08-05T08:38:06.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the current_page parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/blob/master/CHANGELOG.md - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-12624 State: PUBLISHED Published: 2019-05-24T17:13:27 Last Updated: 2024-08-05T08:38:06.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eventum 3.5.0. /htdocs/post_note.php has XSS via the garlic_prefix parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/blob/master/CHANGELOG.md - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-12625 State: PUBLISHED Published: 2019-07-10T11:44:16 Last Updated: 2024-08-05T08:38:06.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/blob/master/CHANGELOG.md - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-12626 State: PUBLISHED Published: 2019-07-10T11:44:47 Last Updated: 2024-08-05T08:38:06.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/blob/master/CHANGELOG.md - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-12627 State: PUBLISHED Published: 2019-07-10T11:45:27 Last Updated: 2024-08-05T08:38:06.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the show_notification_list_issues or show_authorized_issues parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/blob/master/CHANGELOG.md - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-12628 State: PUBLISHED Published: 2019-07-10T11:45:57 Last Updated: 2024-08-05T08:38:06.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventum/eventum/blob/master/CHANGELOG.md - https://github.com/eventum/eventum/releases/tag/v3.5.2
CVE ID: CVE-2018-12630 State: PUBLISHED Published: 2018-06-21T22:00:00Z Last Updated: 2024-09-16T18:19:32.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: NEWMARK (aka New Mark) NMCMS 2.1 allows SQL Injection via the sect_id parameter to the /catalog URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44911/
CVE ID: CVE-2018-12631 State: PUBLISHED Published: 2018-06-21T22:00:00Z Last Updated: 2024-09-17T02:00:36.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redatam7 (formerly Redatam WebServer) allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/text?LFN=../ directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44905/
CVE ID: CVE-2018-12632 State: PUBLISHED Published: 2018-06-21T22:00:00Z Last Updated: 2024-09-17T03:03:28.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redatam7 (formerly Redatam WebServer) allows remote attackers to discover the installation path via an invalid LFN parameter to the /redbin/rpwebutilities.exe/text URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44905/
CVE ID: CVE-2018-12633 State: PUBLISHED Published: 2018-06-22T00:00:00 Last Updated: 2024-08-05T08:38:06.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage. A
ere kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.kernel.org/show_bug.cgi?id=200131 - https://github.com/torvalds/linux/commit/bd23a7269834dc7c1f93e83535d16ebc44b75eba - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bd23a7269834dc7c1f93e83535d16ebc44b75eba
CVE ID: CVE-2018-12634 State: PUBLISHED Published: 2018-06-22T00:00:00 Last Updated: 2024-08-05T08:38:06.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45384/ - https://www.seebug.org/vuldb/ssvid-97353 - https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life
CVE ID: CVE-2018-12635 State: PUBLISHED Published: 2018-06-22T00:00:00Z Last Updated: 2024-09-16T20:41:38.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97353
CVE ID: CVE-2018-12636 State: PUBLISHED Published: 2018-06-22T16:00:00 Last Updated: 2024-08-05T08:38:06.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44943/ - https://wordpress.org/plugins/better-wp-security/#developers - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2018-12638 State: PUBLISHED Published: 2019-03-17T18:27:44 Last Updated: 2024-08-05T08:38:06.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151018/Base-Soundtouch-18.1.4-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2019/Jan/16
CVE ID: CVE-2018-12640 State: PUBLISHED Published: 2018-06-23T19:00:00 Last Updated: 2024-08-05T08:38:06.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: The webService binary on Insteon HD IP Camera White 2864-222 devices has a Buffer Overflow via a crafted pid, pwd, or usr key in a GET request on port 34100. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/badnack/Insteon_2864-222