Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-15598 State: PUBLISHED Published: 2018-08-21T01:00:00 Last Updated: 2024-08-05T10:01:53.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/containous/traefik/pull/3790 - https://github.com/containous/traefik/pull/3790/commits/368bd170913078732bde58160f92f202f370278b - https://github.com/containous/traefik/releases/tag/v1.6.6 - https://github.com/containous/traefik/pull/3790/commits/113250ce5735d554c502ca16fb03bb9119
traefik/releases/tag/v1.6.6 - https://github.com/containous/traefik/pull/3790/commits/113250ce5735d554c502ca16fb03bb9119ca79f1
CVE ID: CVE-2018-15599 State: PUBLISHED Published: 2018-08-21T01:00:00 Last Updated: 2024-08-05T10:01:54.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase. Additional Analyst Notes: - CVE Program Container: References: - https://matt.ucc.asn.au/dropbear/CHANGES - http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002109.html - http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html - https://
/pipermail/dropbear/2018q3/002109.html - http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html - https://lists.debian.org/debian-lts-announce/2018/08/msg00026.html - https://old.reddit.com/r/blackhat/comments/97ywnm/openssh_username_enumeration/e4e05n2/
CVE ID: CVE-2018-15601 State: PUBLISHED Published: 2018-08-21T02:00:00Z Last Updated: 2024-09-17T03:37:47.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jbroadway/elefant/commit/afb3346e50b992bcba143660ca2149e563430e05
CVE ID: CVE-2018-15602 State: PUBLISHED Published: 2018-08-26T21:00:00 Last Updated: 2024-08-05T10:01:54.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel VMG3312 B10B devices are affected by a persistent XSS vulnerability via the pages/connectionStatus/connectionStatus-hostEntry.cmd hostname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/f4lcone/e786fa8fc2919c8ec6f90d8a7ba555ea
CVE ID: CVE-2018-15603 State: PUBLISHED Published: 2018-08-21T02:00:00Z Last Updated: 2024-09-17T02:16:27.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VictorAlagwu/CMSsite/issues/2
CVE ID: CVE-2018-15605 State: PUBLISHED Published: 2018-08-24T19:00:00 Last Updated: 2024-08-05T10:01:54.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105168 - http://www.securitytracker.com/id/1041548 - https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1 - https://www.phpmyadmin.net/security/PMASA-2018-5/
CVE ID: CVE-2018-15606 State: PUBLISHED Published: 2018-09-26T17:00:00 Last Updated: 2024-08-05T10:01:53.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message. Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/#anchor-7.10.8
CVE ID: CVE-2018-15607 State: PUBLISHED Published: 2018-08-21T15:00:00 Last Updated: 2024-08-05T10:01:53.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1255 - http://www.securityf
es: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1255 - http://www.securityfocus.com/bid/105137 - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-15608 State: PUBLISHED Published: 2018-08-28T19:00:00 Last Updated: 2024-08-05T10:01:54.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45254/
CVE ID: CVE-2018-15610 State: PUBLISHED Published: 2018-09-12T21:00:00 Last Updated: 2024-08-05T10:01:53.663Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H) Vendors: Avaya Products: IP Office Problem Types: CWE-284 Description: A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101051984 - https://packetstormsecurity.com/files/149284/Avaya-one-X-9.x-
- https://downloads.avaya.com/css/P8/documents/101051984 - https://packetstormsecurity.com/files/149284/Avaya-one-X-9.x-10.0.x-10.1.x-Arbitrary-File-Disclosure-Deletion.html
CVE ID: CVE-2018-15611 State: PUBLISHED Published: 2018-09-27T23:00:00Z Last Updated: 2024-09-16T23:01:41.772Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Avaya Products: Communication Manager Problem Types: CWE-284 Description: A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101052550
CVE ID: CVE-2018-15612 State: PUBLISHED Published: 2018-09-21T18:00:00 Last Updated: 2024-08-05T10:01:54.357Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Orchestration Designer Problem Types: CWE-352 Description: A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101052293
CVE ID: CVE-2018-15613 State: PUBLISHED Published: 2018-09-21T18:00:00 Last Updated: 2024-08-05T10:01:53.675Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Orchestration Designer Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101052293
CVE ID: CVE-2018-15614 State: PUBLISHED Published: 2019-01-23T17:00:00 Last Updated: 2024-08-05T10:01:54.170Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Avaya Products: IP Office Problem Types: CWE-79 Description: A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101054317
CVE ID: CVE-2018-15615 State: PUBLISHED Published: 2018-09-24T13:00:00 Last Updated: 2024-08-05T10:01:54.243Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Call Management System Supervisor Problem Types: CWE-200 Description: A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101052300 - http://www.securityfocus.com/bid/105392
CVE ID: CVE-2018-15616 State: PUBLISHED Published: 2018-10-17T19:00:00 Last Updated: 2024-08-05T10:01:53.739Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Avaya Aura® System Platform Problem Types: CWE-502 Description: A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101052865
CVE ID: CVE-2018-15617 State: PUBLISHED Published: 2019-02-01T15:00:00 Last Updated: 2024-08-05T10:01:54.491Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Avaya Products: Communication Manager Problem Types: CWE-399 Description: A vulnerability in the "capro" (Call Processor) process component of Avaya Aura Communication Manager could allow a remote, unauthenticated user to cause denial of service. Affected versions include 6.3.x, all 7.x versions prior to 7.1.3.2, and all 8.x versions prior to 8.0.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106826 - https://downloads.avaya.com/css/P8/documents/1010
ram Container: References: - http://www.securityfocus.com/bid/106826 - https://downloads.avaya.com/css/P8/documents/101055396
CVE ID: CVE-2018-15618 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15619 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15620 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15621 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15622 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15623 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15624 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15625 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15626 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15627 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15628 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15629 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-15630 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15631 State: PUBLISHED Published: 2019-04-09T15:41:20 Last Updated: 2024-08-05T10:01:54.359Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-284 Description: Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory/cve-2018-15631/ - https://github.com/odoo/odoo/issues/32516
CVE ID: CVE-2018-15632 State: PUBLISHED Published: 2020-12-22T16:25:31 Last Updated: 2024-08-05T10:01:54.286Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-20 Description: Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/63700
CVE ID: CVE-2018-15633 State: PUBLISHED Published: 2020-12-22T16:25:32 Last Updated: 2024-08-05T10:01:54.221Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-79 Description: Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/63701
CVE ID: CVE-2018-15634 State: PUBLISHED Published: 2020-12-22T16:25:33 Last Updated: 2024-08-05T10:01:54.274Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-79 Description: Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/63702
CVE ID: CVE-2018-15635 State: PUBLISHED Published: 2019-04-09T15:41:20 Last Updated: 2024-08-05T10:01:54.167Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-79 Description: Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a crafted name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/32515
CVE ID: CVE-2018-15636 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15637 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15638 State: PUBLISHED Published: 2020-12-22T16:25:33 Last Updated: 2024-08-05T10:01:54.270Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-79 Description: Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/63703
CVE ID: CVE-2018-15639 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15640 State: PUBLISHED Published: 2019-04-09T15:41:20.453639Z Last Updated: 2024-09-16T22:02:03.889Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Odoo Products: Odoo Enterprise Problem Types: CWE-284 Description: Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/32514
CVE ID: CVE-2018-15641 State: PUBLISHED Published: 2020-12-22T16:25:34 Last Updated: 2024-08-05T10:01:54.277Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-79 Description: Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/63704
CVE ID: CVE-2018-15642 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15643 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15644 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15645 State: PUBLISHED Published: 2020-12-22T16:25:35 Last Updated: 2024-08-05T10:01:54.575Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-284 Description: Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/63705
CVE ID: CVE-2018-15646 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15647 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15648 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15649 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15650 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15651 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15652 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15653 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15654 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2018-15655 State: PUBLISHED Published: 2019-02-05T03:00:00 Last Updated: 2024-08-05T10:01:54.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in 42Gears SureMDM before 2018-11-27, related to CORS settings. Cross-origin access is possible. Additional Analyst Notes: - CVE Program Container: References: - https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-found-in-mobile-device-management-software/
CVE ID: CVE-2018-15656 State: PUBLISHED Published: 2019-02-05T03:00:00 Last Updated: 2024-08-05T10:01:54.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email, where :email is a base64 encoded e-mail address, to receive confirmation as to whether a user account exists in the system with the specified e-mail address. The request must be made with an "apiKey" value in the "ApiKey" header. Additional Analyst Notes: - CVE Program Container: References: - https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-fo
: - CVE Program Container: References: - https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-found-in-mobile-device-management-software/
CVE ID: CVE-2018-15657 State: PUBLISHED Published: 2019-02-05T03:00:00 Last Updated: 2024-08-05T10:01:53.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46305/ - https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-found-in-mobile-device-management-software/
CVE ID: CVE-2018-15658 State: PUBLISHED Published: 2019-02-05T03:00:00 Last Updated: 2024-08-05T10:01:54.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master.html, an attacker is able to see the markup that would be presented to an authenticated user. This is caused by the session validation occurring after the initial markup is loaded. This results in a list of unprotected API endpoints that disclose call logs, SMS logs, and user-account data. Additional Analyst Notes: - CVE Program Container: References: - https://research.digitalinterruption.com/2019/01/31/mul
Additional Analyst Notes: - CVE Program Container: References: - https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-found-in-mobile-device-management-software/
CVE ID: CVE-2018-15659 State: PUBLISHED Published: 2019-02-05T03:00:00 Last Updated: 2024-08-05T10:01:54.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications. Cross-origin access is possible. Additional Analyst Notes: - CVE Program Container: References: - https://research.digitalinterruption.com/2019/01/31/multiple-vulnerabilities-found-in-mobile-device-management-software/