Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/RHSA-2019:2804 - https://access.redhat.com/errata/RHSA-2019:2858 - https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3002 - https://access.redhat.com/errata/RHSA-2019:3140 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissu
.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3892 - https://access.redhat.com/errata/RHSA-2019:4037 - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://nvd.nist.gov/vuln/detail/CVE-2017-7525 - https://access.redhat.com/errata/RHSA-2019:0782 -
rts/cpuoct2020.html - https://nvd.nist.gov/vuln/detail/CVE-2017-7525 - https://access.redhat.com/errata/RHSA-2019:0782 - https://github.com/FasterXML/jackson-databind/issues/2032
CVE ID: CVE-2018-11309 State: PUBLISHED Published: 2018-05-28T16:00:00 Last Updated: 2024-08-05T08:01:52.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request. Additional Analyst Notes: - CVE Program Container: References: - https://blog.riccardoancarani.it/cve-2018-11309-blind-sql-injection-in-membermouse-plugin/
CVE ID: CVE-2018-11311 State: PUBLISHED Published: 2018-05-20T22:00:00 Last Updated: 2024-08-05T08:01:52.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server on port 2121, and upload files or list directories, by entering these credentials. Additional Analyst Notes: - CVE Program Container: References: - https://emreovunc.com/blog/en/mySCADA-myPRO7-Exploit.pdf - https://github.com/EmreOvunc/mySCADA-myPRO-7-Hardcoded-FTP-Username-and-Password - https://www.exploit-db.com/exploits/44656/
CVE ID: CVE-2018-11314 State: PUBLISHED Published: 2018-07-03T00:00:00 Last Updated: 2024-08-05T08:01:52.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability - https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 - https://support.roku.com/article/125543889378
cking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 - https://support.roku.com/article/12554388937879
CVE ID: CVE-2018-11315 State: PUBLISHED Published: 2018-05-20T13:00:00 Last Updated: 2024-08-05T08:01:52.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat t_heat request that accesses a device purchased in the Spring of 2018, and sets a home's target temperature to 95 degrees Fahrenheit. This vulnerability might be described as an addendum to CVE-2013-4860. Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/chromecast-roku-s
013-4860. Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability - https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 - https://github.com/brannondorsey/radio-thermostat
CVE ID: CVE-2018-11316 State: PUBLISHED Published: 2018-07-03T16:00:00 Last Updated: 2024-08-05T08:01:52.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability - https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
CVE ID: CVE-2018-11317 State: PUBLISHED Published: 2019-07-03T15:37:18 Last Updated: 2024-08-05T08:01:52.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS before 4.1.4 has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/blob/610b21d3ff185bd287d55fe016d4266abf04a3bf/includes/classes/ia.admin.sitemap.php#L79-L83 - https://github.com/intelliants/subrion/releases/tag/v4.1.4
CVE ID: CVE-2018-11319 State: PUBLISHED Published: 2018-05-20T20:00:00 Last Updated: 2024-08-05T08:01:52.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed. Additional Analyst Notes: - CVE Program Container: Referen
ficult after 3.8.0 because filename prediction may be needed. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4261 - https://github.com/vim-syntastic/syntastic/commit/6d7c0b394e001233dd09ec473fbea2002c72632f - https://lists.debian.org/debian-lts-announce/2018/07/msg00036.html - https://github.com/vim-syntastic/syntastic/issues/2170 - https://bugs.debian.org/894736
CVE ID: CVE-2018-11320 State: PUBLISHED Published: 2018-05-21T14:00:00Z Last Updated: 2024-09-16T23:47:04.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/4578
CVE ID: CVE-2018-11321 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T08:01:52.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/734-20180506-core-filter-field-in-com-fields-allows-remote-code-execution.html - http://www.securityfocus.com/bid/104271 - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-11322 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T08:01:52.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/730-20180502-core-add-phar-files-to-the-upload-blacklist.html - http://www.securityfocus.com/bid/104272 - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-11323 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T08:01:52.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higher permissions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104276 - https://developer.joomla.org/security-centre/729-20180501-core-acl-violation-in-access-levels.html - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-11324 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T08:01:52.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core or extension updates, could create a race condition where a session that was expected to be destroyed would be recreated. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/735-20180507-core-session-deletion-race-condition.html - http://www.securityfocus.com/bid/104274 - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-11325 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T08:01:52.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104278 - https://developer.joomla.org/security-centre/732-20180504-core-installer-leaks-plain-text-password-to-local-user.html - http://www.security
oomla.org/security-centre/732-20180504-core-installer-leaks-plain-text-password-to-local-user.html - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-11326 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T08:01:52.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104270 - https://developer.joomla.org/security-centre/733-20180505-core-xss-vulnerabilities-additional-hadering.html - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-11327 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T08:01:52.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104273 - https://developer.joomla.org/security-centre/731-20180503-core-information-disclosure-about-unpublished-tags.html - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-11328 State: PUBLISHED Published: 2018-05-22T15:00:00 Last Updated: 2024-08-05T08:01:52.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI containing a username and password when the Location: header cannot be used), a lack of escaping the user-info component of the URI could result in an XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104269 - https://developer.joomla.org/security-centre/736-20180508-core-possible-xss-attack-in-the-redirect-method.html - http://www.securitytracker.c
mla.org/security-centre/736-20180508-core-possible-xss-attack-in-the-redirect-method.html - http://www.securitytracker.com/id/1040966
CVE ID: CVE-2018-11329 State: PUBLISHED Published: 2018-05-22T05:00:00 Last Updated: 2024-08-05T08:01:52.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's ownership, aka ceoAnyone. After that, all the digital assets (including Ether balance and tokens) might be manipulated by the attackers, as exploited in the wild in May 2018. Additional Analyst Notes: - CVE Program Container: References: - https://peckshield.com/2018/05/21/ceoAnyone/
CVE ID: CVE-2018-11330 State: PUBLISHED Published: 2018-05-21T21:00:00Z Last Updated: 2024-09-16T18:43:37.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/58 - https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e
CVE ID: CVE-2018-11331 State: PUBLISHED Published: 2018-05-21T21:00:00Z Last Updated: 2024-09-16T20:22:25.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/58 - https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e
CVE ID: CVE-2018-11332 State: PUBLISHED Published: 2018-05-24T16:00:00 Last Updated: 2024-08-05T08:01:52.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClipperCMS/ClipperCMS/issues/483 - https://www.exploit-db.com/exploits/44775/
CVE ID: CVE-2018-11334 State: PUBLISHED Published: 2018-05-23T12:00:00 Last Updated: 2024-08-05T08:01:52.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain privileges or cause a denial of service via \\.\pipe\WindscribeService. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/drmint80/e5f8a3b8b8324c50a85d9b8623197c68
CVE ID: CVE-2018-11335 State: PUBLISHED Published: 2018-07-04T00:00:00 Last Updated: 2024-08-05T08:01:53.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: GVToken Genesis Vision (GVT) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md - https://github.com/dwfault/AirTokens/tree/master/GVT
CVE ID: CVE-2018-11338 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T08:01:52.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (MITM) attacks via unspecified vectors. The customer list contains each customer's full name, social security number (SSN), address, job title, phone number, Email address, spouse's phone/Email address, and other sensitive information. After the client software authenticates to the server data
pouse's phone/Email address, and other sensitive information. After the client software authenticates to the server database, the server sends the customer list. There is no need for further exploitation as all sensitive data is exposed. This vulnerability was validated on Intuit Lacerte 2017, however older versions of Lacerte may be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://corporateblue.com/your-taxes-are-being-leaked/ - https://www.themikewylie.com/intuit-lacerte-vulnerability-and-data-exposure-cve-2018-11338-cve-2018-14833/
CVE ID: CVE-2018-11339 State: PUBLISHED Published: 2018-05-22T01:00:00 Last Updated: 2024-08-05T08:01:52.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/frappe/issues/5546 - https://www.exploit-db.com/exploits/44691/ - https://discuss.erpnext.com/t/stored-xss-in-erpnext-demo-website/36587
CVE ID: CVE-2018-11340 State: PUBLISHED Published: 2018-05-22T01:00:00 Last Updated: 2024-08-05T08:01:53.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed. Additional Analyst Notes: - CVE Program Container: References: - https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation - https://github.com/mefulton/asustorexploit - http://seclists.org/fulldisclosure/2018/May/2
CVE ID: CVE-2018-11341 State: PUBLISHED Published: 2018-05-22T01:00:00 Last Updated: 2024-08-05T08:01:52.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation - https://github.com/mefulton/asustorexploit - http://seclists.org/fulldisclosure/2018/May/2
CVE ID: CVE-2018-11342 State: PUBLISHED Published: 2018-05-22T01:00:00 Last Updated: 2024-08-05T08:01:52.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the dest_folder parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation - https://github.com/mefulton/asustorexploit - http://seclists.org/fulldisclosure/2018/May/2
CVE ID: CVE-2018-11343 State: PUBLISHED Published: 2018-05-22T01:00:00 Last Updated: 2024-08-05T08:01:53.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross site scripting payloads via the 'playlist' POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation - https://github.com/mefulton/asustorexploit - http://seclists.org/fulldisclosure/2018/May/2
CVE ID: CVE-2018-11344 State: PUBLISHED Published: 2018-05-22T01:00:00 Last Updated: 2024-08-05T08:01:52.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation - https://github.com/mefulton/asustorexploit - http://seclists.org/fulldisclosure/2018/May/2
CVE ID: CVE-2018-11345 State: PUBLISHED Published: 2018-05-22T01:00:00 Last Updated: 2024-08-05T08:01:52.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is vulnerable to path traversal and allows the attacker to place the file anywhere on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-
otes: - CVE Program Container: References: - https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation - https://github.com/mefulton/asustorexploit - http://seclists.org/fulldisclosure/2018/May/2
CVE ID: CVE-2018-11346 State: PUBLISHED Published: 2018-05-22T01:00:00 Last Updated: 2024-08-05T08:01:53.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings" action and then specify files arbitrarily throughout the system via the act parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation - https://github.com/mefulton/asustorexploit - http://seclists.org/fulldisclosure/2018/May/2
CVE ID: CVE-2018-11347 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:01:52.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to perform other attacks such as user redirection to a malicious website, HTTP response splitting, or HTTP cache poisoning. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/10/yunohost-
oning. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/10/yunohost-2-7-2-to-2-7-14-multiple-vulnerabilities/
CVE ID: CVE-2018-11348 State: PUBLISHED Published: 2018-12-04T17:00:00 Last Updated: 2024-08-05T08:01:53.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 web application. By injecting a JavaScript payload, these flaws could be used to manipulate a user's session. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/10/yunohost-2-7-2-to-2-7-14-multiple-vulnerabilities/
CVE ID: CVE-2018-11349 State: PUBLISHED Published: 2018-07-07T17:00:00 Last Updated: 2024-08-05T08:01:52.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: search_by_name, search_by_hash, and search_link. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/06/jirafeau-version-3-3-0-multiple-vulnerabilities/