Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-16137 State: PUBLISHED Published: 2019-05-13T20:18:45 Last Updated: 2024-08-05T10:17:37.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/web/multiple/2019/02/01/Multiple-Vulnerabilities-IPBrick.html
CVE ID: CVE-2018-16138 State: PUBLISHED Published: 2019-05-13T20:19:57 Last Updated: 2024-08-05T10:17:38.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/web/multiple/2019/02/01/Multiple-Vulnerabilities-IPBrick.html
CVE ID: CVE-2018-16139 State: PUBLISHED Published: 2019-05-13T19:48:36 Last Updated: 2024-08-05T10:17:38.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/web/xss/2019/02/01/XSS-Bibliosoft.html
CVE ID: CVE-2018-16140 State: PUBLISHED Published: 2018-08-30T01:00:00 Last Updated: 2024-08-05T10:17:37.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/mcj/tickets/28/ - https://usn.ubuntu.com/3760-1/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00018.html
CVE ID: CVE-2018-16141 State: PUBLISHED Published: 2018-08-30T05:00:00 Last Updated: 2024-08-05T10:17:37.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server. Additional Analyst Notes: - CVE Program Container: References: - https://unothing.github.io/posts/thinkcmfx223/
CVE ID: CVE-2018-16142 State: PUBLISHED Published: 2018-08-30T05:00:00 Last Updated: 2024-08-05T10:17:37.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function. Additional Analyst Notes: - CVE Program Container: References: - https://unothing.github.io/posts/phpok48278/
CVE ID: CVE-2018-16144 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:17:37.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to improper sanitization of the rancid_password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.opsview.com/v5.4/docs/whats-new - https://seclists.org/fulldisclosure/2018/Sep/3 - https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities - https://knowledge.opsview.com/v5.3/docs/whats-new
CVE ID: CVE-2018-16145 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:17:38.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of the appliance. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.opsview.com/v5.4/docs/whats-new - https://seclists.org/fulldisclosure/2018/Sep/3 - https://www.coresecurity.com/advisories/opsview-moni
4/docs/whats-new - https://seclists.org/fulldisclosure/2018/Sep/3 - https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities - https://knowledge.opsview.com/v5.3/docs/whats-new
CVE ID: CVE-2018-16146 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:17:37.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection with the privileges of the nagios user account. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.opsview.com/v5.4/docs/whats-new - https://seclists.org/fulldisclosure/2018/Sep/3 - https://www.coresecuri
ps://knowledge.opsview.com/v5.4/docs/whats-new - https://seclists.org/fulldisclosure/2018/Sep/3 - https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities
CVE ID: CVE-2018-16147 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:17:37.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.opsview.com/v5.4/docs/whats-new - https://seclists.org/fulldisclosure/2018/Sep/3 - https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities - https://knowledge.opsview.com/v5.3/docs/whats-new
CVE ID: CVE-2018-16148 State: PUBLISHED Published: 2018-09-05T21:00:00 Last Updated: 2024-08-05T10:17:38.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.opsview.com/v5.4/docs/whats-new - https://seclists.org/fulldisclosure/2018/Sep/3 - https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities - https://knowledge.opsview.com/v5.3/docs/whats-new
CVE ID: CVE-2018-16149 State: PUBLISHED Published: 2018-11-07T20:00:00 Last Updated: 2024-08-05T10:17:37.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponents are being used, a remote attacker can generate purposefully crafted signatures (and put them on X.509 certificates) to induce illegal memory access and crash the verifier. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/igrr/axtls-8266/commit/5efe2947ab45e81d84b5f707c51d1c64be52f36c - https:/
am Container: References: - https://github.com/igrr/axtls-8266/commit/5efe2947ab45e81d84b5f707c51d1c64be52f36c - https://sourceforge.net/p/axtls/mailman/message/36459928/
CVE ID: CVE-2018-16150 State: PUBLISHED Published: 2018-11-07T20:00:00 Last Updated: 2024-08-05T10:17:38.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509 certificates. This is a variant of CVE-2006-4340. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/igrr/axtls-8266/commit/5efe2947ab45e81d84b5f707c51d1c64be52f36c - https://sourceforge.net/p/axtls
: - https://github.com/igrr/axtls-8266/commit/5efe2947ab45e81d84b5f707c51d1c64be52f36c - https://sourceforge.net/p/axtls/mailman/message/36459928/
CVE ID: CVE-2018-16151 State: PUBLISHED Published: 2018-09-26T21:00:00 Last Updated: 2024-08-05T10:17:37.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification. Similar to the flaw in the same version of strongSwan regarding digestAlgorithm.parameters, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. Additio
s are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4305 - https://security.gentoo.org/glsa/201811-16 - https://www.strongswan.org/blog/2018/09/24/strongswan-vulnerability-%28cve-2018-16151%2C-cve-2018-16152%29.html - https://lists.debian.org/debian-lts-announce/2018/09/msg00032.html - https://usn.ubuntu.com/3771-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-0
nsuse.org/opensuse-security-announce/2019-12/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html
CVE ID: CVE-2018-16152 State: PUBLISHED Published: 2018-09-26T21:00:00 Last Updated: 2024-08-05T10:17:38.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568. Additional Analyst Note
ignature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4305 - https://security.gentoo.org/glsa/201811-16 - https://www.strongswan.org/blog/2018/09/24/strongswan-vulnerability-%28cve-2018-16151%2C-cve-2018-16152%29.html - https://lists.debian.org/debian-lts-announce/2018/09/msg00032.html - https://usn.ubuntu.com/3771-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html
CVE ID: CVE-2018-16153 State: PUBLISHED Published: 2023-12-12T00:00:00.000Z Last Updated: 2025-05-27T14:35:51.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.apereo.org/projects/opencast/news - https://github.com/advisories/GHSA-hcxx-mp6g-6gr9 - https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51 - https://docs.opencast.org/r/10.x/admin/#changelog
CVE ID: CVE-2018-16156 State: PUBLISHED Published: 2019-05-17T17:20:27 Last Updated: 2024-08-05T10:17:38.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYST
refore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege. Additional Analyst Notes: - CVE Program Container: References: - https://www.securifera.com/advisories/cve-2018-16156/ - http://packetstormsecurity.com/files/160832/PaperStream-IP-TWAIN-1.42.0.5685-Local-Privilege-Escalation.html
CVE ID: CVE-2018-16157 State: PUBLISHED Published: 2018-08-30T13:00:00 Last Updated: 2024-08-05T10:17:38.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart&a=save item_totals parameter to zero, the entire cart is sold for free. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caokang/waimai/issues/5
CVE ID: CVE-2018-16158 State: PUBLISHED Published: 2018-08-30T05:00:00Z Last Updated: 2024-09-17T04:19:10.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins (to uid 0) via the PubkeyAuthentication option. Additional Analyst Notes: - CVE Program Container: References: - https://www.ctrlu.net/vuln/0006.html - http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf
CVE ID: CVE-2018-16159 State: PUBLISHED Published: 2018-08-30T15:00:00 Last Updated: 2024-08-05T10:17:37.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9117 - https://www.exploit-db.com/exploits/45255/
CVE ID: CVE-2018-16160 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T10:17:38.326Z Vendors: Feitian Japan Co., Ltd Products: SecureCore Standard Edition Problem Types: Authentication bypass Description: SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windows PC. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN21528670/index.html
CVE ID: CVE-2018-16161 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T10:17:38.292Z Vendors: Life Sciences Computing Corporation Products: OpenDolphin Problem Types: Privilege escalation Description: OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN59394343/index.html - http://www.opendolphin.com/security20181023.html
CVE ID: CVE-2018-16162 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T10:17:37.664Z Vendors: Life Sciences Computing Corporation Products: OpenDolphin Problem Types: Information Disclosure Description: OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN59394343/index.html - http://www.opendolphin.com/security20181023.html
CVE ID: CVE-2018-16163 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T10:17:37.630Z Vendors: Life Sciences Computing Corporation Products: OpenDolphin Problem Types: Authentication bypass Description: OpenDolphin 2.7.0 and earlier allows authenticated attackers to bypass authentication to create and/or delete other users accounts via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN59394343/index.html - http://www.opendolphin.com/security20181023.html
CVE ID: CVE-2018-16164 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.214Z Vendors: Web-Dorado Products: Event Calendar WD version Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN75738023/index.html - https://wpvulndb.com/vulnerabilities/9199 - https://plugins.trac.wordpress.org/changeset/1961423/ - https://wordpress.org/plugins/event-calendar-wd/#developers
CVE ID: CVE-2018-16165 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.201Z Vendors: JPCERT Coordination Center Products: LogonTracer Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in LogonTracer 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1 - https://jvn.jp/en/vu/JVNVU98026636/index.html
CVE ID: CVE-2018-16166 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:37.672Z Vendors: JPCERT Coordination Center Products: LogonTracer Problem Types: XML external entities (XXE) Description: LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1 - https://jvn.jp/en/vu/JVNVU98026636/index.html
CVE ID: CVE-2018-16167 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:37.618Z Vendors: JPCERT Coordination Center Products: LogonTracer Problem Types: OS Command Injection Description: LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1 - https://jvn.jp/en/vu/JVNVU98026636/index.html
CVE ID: CVE-2018-16168 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:37.840Z Vendors: JPCERT Coordination Center Products: LogonTracer Problem Types: Code injection Description: LogonTracer 1.2.0 and earlier allows remote attackers to conduct Python code injection attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1 - https://jvn.jp/en/vu/JVNVU98026636/index.html
CVE ID: CVE-2018-16169 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.319Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Unrestricted Upload of File with Dangerous Type Description: Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cybozu.support/article/34311/ - https://jvn.jp/en/jp/JVN23161885/index.html
CVE ID: CVE-2018-16170 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.299Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Directory traversal Description: Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 for Windows allows remote authenticated attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cybozu.support/article/34301/ - https://jvn.jp/en/jp/JVN23161885/index.html
CVE ID: CVE-2018-16171 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.199Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Directory traversal Description: Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cybozu.support/article/35259/ - https://jvn.jp/en/jp/JVN23161885/index.html
CVE ID: CVE-2018-16172 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.320Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: User Interface (UI) Misrepresentation of Critical Information Description: Improper countermeasure against clickjacking attack in client certificates management screen was discovered in Cybozu Remote Service 3.0.0 to 3.1.8, that allows remote attackers to trick a user to delete the registered client certificate. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cybozu.support/article/35260/ - https://jvn.jp/en/jp/JVN23161885/index.html
CVE ID: CVE-2018-16173 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.322Z Vendors: ThimPress Products: LearnPress Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/learnpress/ - https://jvn.jp/en/jp/JVN85760090/index.html
CVE ID: CVE-2018-16174 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.356Z Vendors: ThimPress Products: LearnPress Problem Types: Open Redirect Description: Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/learnpress/ - https://jvn.jp/en/jp/JVN85760090/index.html
CVE ID: CVE-2018-16175 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.216Z Vendors: ThimPress Products: LearnPress Problem Types: SQL Injection Description: SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/learnpress/ - https://jvn.jp/en/jp/JVN85760090/index.html
CVE ID: CVE-2018-16176 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T10:17:38.370Z Vendors: Japan Atomic Energy Agency Products: Installer of Mapping Tool Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN33677949/index.html - https://emdb.jaea.go.jp/emdb/en/mappingtool.html