Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-19881 State: PUBLISHED Published: 2018-12-06T00:00:00 Last Updated: 2024-09-16T15:58:50.373564 Vendors: n/a Products: n/a Problem Types: n/a Description: In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=700442 - https://github.com/TeamSeri0us/pocs/tree/master/mupdf/20181203 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNRE
f/20181203 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY/ - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=c8f7e48ff74720a5e984ae19d978a5ab4d5dde5b
CVE ID: CVE-2018-19882 State: PUBLISHED Published: 2018-12-06T00:00:00 Last Updated: 2024-09-12T16:44:07.268542 Vendors: n/a Products: n/a Problem Types: n/a Description: In Artifex MuPDF 1.14.0, the svg_run_image function in svg/svg-run.c allows remote attackers to cause a denial of service (href_att NULL pointer dereference and application crash) via a crafted svg file, as demonstrated by mupdf-gl. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=700342 - https://github.com/TeamSeri0us/pocs/tree/master/mupdf/20181203 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZM
81203 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY/ - http://www.ghostscript.com/cgi-bin/findgit.cgi?a7f7d91cdff8d303c11d458fa8b802776f73c8cc
CVE ID: CVE-2018-19886 State: PUBLISHED Published: 2018-12-06T00:00:00 Last Updated: 2024-08-05T11:44:20.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 8 case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faac/issues/23 - https://security.gentoo.org/glsa/202208-16
CVE ID: CVE-2018-19887 State: PUBLISHED Published: 2018-12-06T00:00:00Z Last Updated: 2024-09-16T18:23:19.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 4 case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faac/issues/21
CVE ID: CVE-2018-19888 State: PUBLISHED Published: 2018-12-06T00:00:00Z Last Updated: 2024-09-17T00:30:54.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the HCB_ESC case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faac/issues/25
CVE ID: CVE-2018-19889 State: PUBLISHED Published: 2018-12-06T00:00:00Z Last Updated: 2024-09-17T00:26:23.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 6 case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faac/issues/22
CVE ID: CVE-2018-19890 State: PUBLISHED Published: 2018-12-06T00:00:00Z Last Updated: 2024-09-17T00:07:03.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 2 case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faac/issues/20
CVE ID: CVE-2018-19891 State: PUBLISHED Published: 2018-12-06T00:00:00Z Last Updated: 2024-09-16T16:42:58.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 10 case. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knik0/faac/issues/24
CVE ID: CVE-2018-19892 State: PUBLISHED Published: 2018-12-06T03:00:00 Last Updated: 2024-08-05T11:44:20.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domainmod/domainmod/issues/85
CVE ID: CVE-2018-19893 State: PUBLISHED Published: 2018-12-06T03:00:00 Last Updated: 2024-08-05T11:44:20.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Pbootcms/Pbootcms/issues/3
CVE ID: CVE-2018-19894 State: PUBLISHED Published: 2018-12-06T04:00:00Z Last Updated: 2024-09-17T03:07:16.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinkcmf/cmfx/issues/26
CVE ID: CVE-2018-19895 State: PUBLISHED Published: 2018-12-06T04:00:00Z Last Updated: 2024-09-17T03:48:28.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinkcmf/cmfx/issues/26
CVE ID: CVE-2018-19896 State: PUBLISHED Published: 2018-12-06T04:00:00Z Last Updated: 2024-09-16T16:53:24.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinkcmf/cmfx/issues/26
CVE ID: CVE-2018-19897 State: PUBLISHED Published: 2018-12-06T04:00:00Z Last Updated: 2024-09-16T17:03:14.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinkcmf/cmfx/issues/26
CVE ID: CVE-2018-19898 State: PUBLISHED Published: 2018-12-06T04:00:00Z Last Updated: 2024-09-17T01:35:49.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an article edit_post action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinkcmf/cmfx/issues/26
CVE ID: CVE-2018-19901 State: PUBLISHED Published: 2018-12-31T15:00:00 Last Updated: 2024-08-05T11:51:17.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-19901/blob/master/XSS-1.pdf
CVE ID: CVE-2018-19902 State: PUBLISHED Published: 2018-12-31T15:00:00 Last Updated: 2024-08-05T11:51:17.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-19902/blob/master/XSS.pdf
CVE ID: CVE-2018-19903 State: PUBLISHED Published: 2018-12-31T15:00:00 Last Updated: 2024-08-05T11:51:17.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-breachlock/CVE-2018-19903/blob/master/XSS1.pdf
CVE ID: CVE-2018-19904 State: PUBLISHED Published: 2018-12-31T15:00:00.000Z Last Updated: 2025-05-06T19:35:22.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/security-breachlock/CVE-2018-19904/blob/master/XSS2.pdf
CVE ID: CVE-2018-19905 State: PUBLISHED Published: 2018-12-31T15:00:00.000Z Last Updated: 2025-05-06T19:03:19.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/security-breachlock/CVE-2018-19905/blob/master/RAZOR_HTML.pdf
CVE ID: CVE-2018-19906 State: PUBLISHED Published: 2018-12-31T15:00:00.000Z Last Updated: 2025-05-06T18:24:17.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/smiffy6969/razorCMS/issues/56 - https://github.com/security-breachlock/CVE-2018-19906/blob/master/razor_xss.pdf
CVE ID: CVE-2018-19907 State: PUBLISHED Published: 2018-12-06T07:00:00 Last Updated: 2024-08-05T11:51:17.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40buxuqua/rce-vulnerability-in-crafter-cms-server-side-template-injection-19d8708ce242 - https://github.com/craftercms/craftercms/issues/26
rability-in-crafter-cms-server-side-template-injection-19d8708ce242 - https://github.com/craftercms/craftercms/issues/2677
CVE ID: CVE-2018-19908 State: PUBLISHED Published: 2018-12-06T16:00:00 Last Updated: 2024-08-05T11:51:17.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/211ac0737281b65e7da160f0aac52f401a94e1a3 - https://github.com/MISP/MISP/releases/tag/v2.4.99 - https://www.ex
ISP/commit/211ac0737281b65e7da160f0aac52f401a94e1a3 - https://github.com/MISP/MISP/releases/tag/v2.4.99 - https://www.exploit-db.com/exploits/46401/
CVE ID: CVE-2018-19911 State: PUBLISHED Published: 2018-12-06T18:00:00Z Last Updated: 2024-09-16T17:27:51.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/iSafeBlue/freeswitch_rce/blob/master/freeswitch_rce.py -
otes: - CVE Program Container: References: - https://github.com/iSafeBlue/freeswitch_rce/blob/master/freeswitch_rce.py - https://github.com/iSafeBlue/freeswitch_rce/blob/master/README-en.md
CVE ID: CVE-2018-19913 State: PUBLISHED Published: 2018-12-06T19:00:00 Last Updated: 2024-08-05T11:51:17.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45967/ - https://github.com/domainmod/domainmod/issues/86
CVE ID: CVE-2018-19914 State: PUBLISHED Published: 2018-12-06T19:00:00 Last Updated: 2024-08-05T11:51:17.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domainmod/domainmod/issues/87 - https://www.exploit-db.com/exploits/46375/
CVE ID: CVE-2018-19915 State: PUBLISHED Published: 2018-12-06T19:00:00 Last Updated: 2024-08-05T11:51:17.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domainmod/domainmod/issues/87 - https://www.exploit-db.com/exploits/46376/
CVE ID: CVE-2018-19917 State: PUBLISHED Published: 2019-03-17T19:21:00 Last Updated: 2024-08-05T11:51:17.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151005/Microweber-1.0.8-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2019/Jan/12 - http://seclists.org/fulldisclosure/2019/Jan/25 - https://github.com/microweber/microweber/commits/master - https://www.netsparker.com/web-applications-advisories/ns-18-038-reflected-cross-site-scripting-in-microweber/
CVE ID: CVE-2018-19918 State: PUBLISHED Published: 2018-12-31T15:00:00.000Z Last Updated: 2025-05-06T19:02:43.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/security-breachlock/CVE-2018-19918/blob/master/cuppa_svg.pdf - https://github.com/CuppaCMS/CuppaCMS/issues/3
CVE ID: CVE-2018-19919 State: PUBLISHED Published: 2018-12-06T21:00:00Z Last Updated: 2024-09-16T18:39:46.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php data[title] parameter, as demonstrated by a crafted onload attribute of an SVG element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pixelimity/pixelimity/issues/19
CVE ID: CVE-2018-19921 State: PUBLISHED Published: 2018-12-06T22:00:00Z Last Updated: 2024-09-16T21:09:00.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me.html
CVE ID: CVE-2018-19922 State: PUBLISHED Published: 2018-12-06T22:00:00Z Last Updated: 2024-09-16T17:14:57.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd' URL parameter in a /urlfilter.cmd POST request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/logern5/c1000a_xss/blob/master/README.md
CVE ID: CVE-2018-19923 State: PUBLISHED Published: 2018-12-06T23:00:00Z Last Updated: 2024-09-17T00:27:00.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is member/member_email.php?action=edit CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Venan24/SCMS/issues/2
CVE ID: CVE-2018-19924 State: PUBLISHED Published: 2018-12-06T23:00:00Z Last Updated: 2024-09-16T22:36:07.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Venan24/SCMS/issues/2
CVE ID: CVE-2018-19925 State: PUBLISHED Published: 2018-12-06T23:00:00Z Last Updated: 2024-09-17T02:33:10.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. It has SQL injection via the member/member_order.php type parameter, related to the O_state parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Venan24/SCMS/issues/3
CVE ID: CVE-2018-19926 State: PUBLISHED Published: 2018-12-06T23:00:00 Last Updated: 2024-08-05T11:51:17.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - https://misteralfa-hack.blogspot.com/2018/12/zenitel-ip-stationweb-cross-site-script.html
CVE ID: CVE-2018-19927 State: PUBLISHED Published: 2018-12-06T23:00:00 Last Updated: 2024-08-05T11:51:17.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases. Additional Analyst Notes: - CVE Program Container: References: - https://misteralfa-hack.blogspot.com/2018/12/zenitel-ip-stationweb-cross-site-script.html
CVE ID: CVE-2018-19931 State: PUBLISHED Published: 2018-12-07T07:00:00 Last Updated: 2024-08-05T11:51:17.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=23942 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=5f60af5d24d181371d67534fa273dd221df20c07 - https://security.netapp.com/advisory/ntap-201
tweb.cgi?p=binutils-gdb.git%3Bh=5f60af5d24d181371d67534fa273dd221df20c07 - https://security.netapp.com/advisory/ntap-20190221-0004/ - http://www.securityfocus.com/bid/106144 - https://security.gentoo.org/glsa/201908-01 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-19932 State: PUBLISHED Published: 2018-12-07T07:00:00 Last Updated: 2024-08-05T11:51:17.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20190221-0004/ - http://www.securityfocus.com/bid/106144 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=beab453223769279cc1cef68a1622ab8978641f7 - https://sourceware.org/bugzilla/show_
g/git/gitweb.cgi?p=binutils-gdb.git%3Bh=beab453223769279cc1cef68a1622ab8978641f7 - https://sourceware.org/bugzilla/show_bug.cgi?id=23932 - https://security.gentoo.org/glsa/201908-01 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html - https://usn.ubuntu.com/4336-1/
CVE ID: CVE-2018-19933 State: PUBLISHED Published: 2018-12-17T18:00:00 Last Updated: 2024-08-05T11:51:17.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46014/ - https://github.com/rdincel1/Bolt-CMS-3.6.2---Cross-Site-Scripting - https://www.raifberkaydincel.com/bolt-cms-xss-vulnerability.html
CVE ID: CVE-2018-19934 State: PUBLISHED Published: 2019-03-17T19:35:49 Last Updated: 2024-08-05T11:51:17.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL path and HTTP POST parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151474/SolarWinds-Serv-U-FTP-15.1.6.25-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2019/Feb/5 - https://www.themissinglink.com.au/security-advisories-cve-2018-19934
CVE ID: CVE-2018-19935 State: PUBLISHED Published: 2018-12-07T09:00:00 Last Updated: 2024-08-05T11:51:17.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4353 - https://bugs.php.net/bug.php?id=77020 - http://www.securityfocus.com/bid/106143 - https://security.netapp.com/advisory/ntap-20181221-0003/ - https://lists.debian.org/debian-lts-announce/2018/12
106143 - https://security.netapp.com/advisory/ntap-20181221-0003/ - https://lists.debian.org/debian-lts-announce/2018/12/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html