Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-10759 State: PUBLISHED Published: 2018-05-16T14:00:00 Last Updated: 2024-08-05T07:46:46.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/30
CVE ID: CVE-2018-10760 State: PUBLISHED Published: 2018-05-16T14:00:00 Last Updated: 2024-08-05T07:46:47.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document root. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/30
CVE ID: CVE-2018-10761 State: REJECTED Published: 2018-06-04T06:00:00 Last Updated: 2018-06-04T05:57:01 Description: No description available.
CVE ID: CVE-2018-10762 State: REJECTED Published: 2018-06-04T06:00:00 Last Updated: 2018-06-04T05:57:01 Description: No description available.
CVE ID: CVE-2018-10763 State: PUBLISHED Published: 2018-09-14T21:00:00 Last Updated: 2024-08-05T07:46:46.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45386/ - http://packetstormsecurity.com/files/149324/SynaMan-4.0-Build-1488-Cross-Site-Scripting.html
CVE ID: CVE-2018-10767 State: PUBLISHED Published: 2018-05-06T23:00:00 Last Updated: 2024-08-05T07:46:46.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1575188 - https://access.redhat.com/errata/RHSA-2018:3505 - https://access.redhat.com/errata/RHSA-2018:3140 - https://access.redha
https://access.redhat.com/errata/RHSA-2018:3505 - https://access.redhat.com/errata/RHSA-2018:3140 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2018-10768 State: PUBLISHED Published: 2018-05-06T23:00:00 Last Updated: 2024-08-05T07:46:47.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=106408 - https://lists.debian.org/debian-lts-announce/2018/10/msg00024.html - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3647-1/
n-lts-announce/2018/10/msg00024.html - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3647-1/ - https://access.redhat.com/errata/RHSA-2018:3140 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2018-10769 State: PUBLISHED Published: 2018-08-10T15:00:00 Last Updated: 2024-08-05T07:46:46.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: The transferProxy and approveProxy functions of a smart contract implementation for SmartMesh (SMT), an Ethereum ERC20 token, allow attackers to accomplish an unauthorized transfer of digital assets because replay attacks can occur with the same-named functions (with the same signatures) in other tokens: First (FST), GG Token (GG), M2C Mesh Network (MTC), M2C Mesh Network (mesh), and UG Token (UGT). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nkbai/defcon26/blob/master/docs/Replay%20Att
al Analyst Notes: - CVE Program Container: References: - https://github.com/nkbai/defcon26/blob/master/docs/Replay%20Attacks%20on%20Ethereum%20Smart%20Contracts.md - https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E
CVE ID: CVE-2018-10770 State: PUBLISHED Published: 2018-05-09T18:00:00 Last Updated: 2024-08-05T07:46:46.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote attackers to download the configuration (without a login) to discover the password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/D0neMkj/EXP_IOT/tree/master/CAMERA/XVR_camera - https://github.com/D0neMkj/EXP_IOT/blob/master/CAMERA/XVR_camera/readme
CVE ID: CVE-2018-10771 State: PUBLISHED Published: 2018-05-07T02:00:00 Last Updated: 2024-08-05T07:46:46.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the get_key function in parse.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/open?id=1HE9cht7WJPauA66acyJrEywXX8R4Hg-2 - https://github.com/leesavide/abcm2ps/issues/17 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSTB65NYYCKU7O6RF5B6CYY5IA6CA66Y/ - https://l
oject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSTB65NYYCKU7O6RF5B6CYY5IA6CA66Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6DUTXB4EC3TQHTTAAIBKJ54GJTF6Y7V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGDXW2I3MY3QH4PJXLJET5QZZXMXTNWO/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00015.html
CVE ID: CVE-2018-10772 State: PUBLISHED Published: 2018-05-07T02:00:00 Last Updated: 2024-08-05T07:46:47.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1566260 - https://access.redhat.com/errata/RHSA-2019:2101
CVE ID: CVE-2018-10773 State: PUBLISHED Published: 2018-05-07T07:00:00 Last Updated: 2024-08-05T07:46:46.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by copac2xml. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1k598A16gV9HPwFXnYkyrPwoRbnbFX6LAMRyzb_dxLCM/edit
CVE ID: CVE-2018-10774 State: PUBLISHED Published: 2018-05-07T07:00:00 Last Updated: 2024-08-05T07:46:46.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: Read access violation in the isiin_keyword function in isiin.c in libbibutils.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by isi2xml. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1BuCxbXaGL_3DyaWF8sGnMAWolmYQneRrxHt4mNPkBE4/edit
CVE ID: CVE-2018-10775 State: PUBLISHED Published: 2018-05-07T07:00:00 Last Updated: 2024-08-05T07:46:47.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash), as demonstrated by end2xml. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/drive/u/1/folders/1qtq272m7jJaEUPGFLvyXmIl5zNJv7rd1
CVE ID: CVE-2018-10776 State: PUBLISHED Published: 2018-05-07T07:00:00 Last Updated: 2024-08-05T07:46:47.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: The getbits function in mpglibDBL/common.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (segmentation fault and application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1gkHfRWO9f-FTBhZ3ZT3RMZZ_JbJ18ZIkH2GlVTV35cQ/edit
CVE ID: CVE-2018-10777 State: PUBLISHED Published: 2018-05-07T07:00:00 Last Updated: 2024-08-05T07:46:46.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the WriteMP3GainAPETag function in apetag.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/11Ms9j82hpH8iA0oc4QH0qUG6gq-ZOiqI0YroAFMrcD8/edit
CVE ID: CVE-2018-10778 State: PUBLISHED Published: 2018-05-07T07:00:00 Last Updated: 2024-08-05T07:46:47.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: Read access violation in the III_dequantize_sample function in mpglibDBL/layer3.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, a different vulnerability than CVE-2017-9872 and CVE-2017-14409. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/11qVnW4frI-9PGRVkSOGb9IaF3ylzrc32bJXyO1OsfQM/edit
CVE ID: CVE-2018-10779 State: PUBLISHED Published: 2018-05-07T07:00:00 Last Updated: 2024-08-05T07:46:46.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104089 - http://bugzilla.maptools.org/show_bug.cgi?id=2788 - https://usn.ubuntu.com/3906-1/ - https://usn.ubuntu.com/3906-2/ - https://access.redhat.com/errata/RHSA-2019:2053
CVE ID: CVE-2018-10780 State: PUBLISHED Published: 2018-05-07T07:00:00 Last Updated: 2024-08-05T07:46:46.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-based buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-14 - https://bugzilla.redhat.com/show_bug.cgi?id=1575201
CVE ID: CVE-2018-10790 State: PUBLISHED Published: 2021-08-25T13:54:26 Last Updated: 2024-08-05T07:46:47.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory allocation failure, as demonstrated by mp2aac. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1OSwQjtyALgV3OulmWGaTqZrSzk7Ta-xGrcLI0I7SPyM - https://github.com/axiomatic-systems/Bento4/issues/390
CVE ID: CVE-2018-10795 State: PUBLISHED Published: 2018-05-07T13:00:00 Last Updated: 2024-08-05T07:46:46.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or html/js/editor/fckeditor/editor/filemanager/browser/liferay/browser.html URI. NOTE: the vendor disputes this issue because file upload is an expected feature, subject to Role Based Access Control checks where only authenticated users with proper permissions can upload files Additional Analy
ole Based Access Control checks where only authenticated users with proper permissions can upload files Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2018050029
CVE ID: CVE-2018-10796 State: PUBLISHED Published: 2018-05-07T14:00:00 Last Updated: 2024-08-05T07:46:46.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222014. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345NetFirewall.sys-0x00222014
CVE ID: CVE-2018-10798 State: PUBLISHED Published: 2018-05-07T14:00:00Z Last Updated: 2024-09-16T18:09:17.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling of JavaScript code that triggers the reload of a page continuously with an interval of 1 second. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/181686
CVE ID: CVE-2018-10799 State: PUBLISHED Published: 2018-05-07T14:00:00Z Last Updated: 2024-09-16T23:40:25.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the mishandling of a long URL formed by window.location+='?\u202a\uFEFF\u202b'; concatenation in a SCRIPT element. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/181558
CVE ID: CVE-2018-10801 State: PUBLISHED Published: 2018-05-08T06:00:00Z Last Updated: 2024-09-16T18:23:57.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: TIFFClientOpen in tif_unix.c in LibTIFF 3.8.2 has memory leaks, as demonstrated by bmp2tiff. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2790
CVE ID: CVE-2018-10803 State: PUBLISHED Published: 2018-05-10T14:00:00 Last Updated: 2024-08-05T07:46:46.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104251 - https://www.manageengine.com/products/netflow/readme.html#123125
CVE ID: CVE-2018-10804 State: PUBLISHED Published: 2018-05-08T07:00:00 Last Updated: 2024-08-05T07:46:46.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/1053
CVE ID: CVE-2018-10805 State: PUBLISHED Published: 2018-05-08T07:00:00 Last Updated: 2024-08-05T07:46:47.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1054 - https://usn.ubuntu.com/3681-1/
CVE ID: CVE-2018-10806 State: PUBLISHED Published: 2018-05-08T07:00:00 Last Updated: 2024-08-05T07:46:47.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. This can be used in conjunction with CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/philippe/FrogCMS/issues/10
CVE ID: CVE-2018-10809 State: PUBLISHED Published: 2018-05-08T07:00:00 Last Updated: 2024-08-05T07:46:47.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222040. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-8873. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44600/ - http://packetstormsecurity.com/files/147538/2345-Security-Guard-3.7-Denial-Of-Service.html - https://github.com/anhk
/ - http://packetstormsecurity.com/files/147538/2345-Security-Guard-3.7-Denial-Of-Service.html - https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345NetFirewall.sys-0x00222040
CVE ID: CVE-2018-10810 State: PUBLISHED Published: 2018-05-16T13:00:00 Last Updated: 2024-08-05T07:46:47.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://chat.livezilla.net/ticket.php?id=93482&hash=DE9C7230EA79&salt=e98942058530ead9b4f481f4d54b1f17
CVE ID: CVE-2018-10811 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T07:46:47.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-16 - https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-%28cve-2018-10811%29.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBO6ZQKLB5RY3TV7MXADFTQKXA2LUEIL/ - https://download.strongswan.org/security/CVE-2018-10811/ - https://usn.ubuntu.com/37
UBO6ZQKLB5RY3TV7MXADFTQKXA2LUEIL/ - https://download.strongswan.org/security/CVE-2018-10811/ - https://usn.ubuntu.com/3771-1/ - https://www.debian.org/security/2018/dsa-4229 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html
CVE ID: CVE-2018-10812 State: PUBLISHED Published: 2018-05-08T19:00:00Z Last Updated: 2024-09-16T22:03:33.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users to steal currency by leveraging root access to read /com.biepie/shared_prefs/com.bitpie_preferences.xml (on Android) or a plist file in the app data folder (on iOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/edwardz246003/misc/blob/master/Bitpie.md
CVE ID: CVE-2018-10813 State: PUBLISHED Published: 2018-06-05T15:00:00 Last Updated: 2024-08-05T07:46:47.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune - https://github.com/aprendecondedo
digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune - https://github.com/aprendecondedos/dedos-web/pull/1
CVE ID: CVE-2018-10814 State: PUBLISHED Published: 2018-09-14T21:00:00 Last Updated: 2024-08-05T07:46:47.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/149326/SynaMan-40-Build-1488-SMTP-Credential-Disclosure.html - https://www.exploit-db.com/exploits/45387/
CVE ID: CVE-2018-10815 State: PUBLISHED Published: 2019-05-24T16:58:56 Last Updated: 2024-08-05T07:46:47.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and 5.15.x before 5.15.1. A read-only user can access sensitive cluster information. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com/ - https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
CVE ID: CVE-2018-10817 State: PUBLISHED Published: 2018-05-09T03:00:00 Last Updated: 2024-08-05T07:46:47.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: Severalnines ClusterControl before 1.6.0-4699 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://support.severalnines.com/hc/en-us/articles/212425943-ChangeLog
CVE ID: CVE-2018-10821 State: PUBLISHED Published: 2018-06-14T16:00:00 Last Updated: 2024-08-05T07:46:47.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BlackCatDevelopment/BlackCatCMS/issues/384 - https://github.com/BlackCatDevelopment/BlackCatCMS/commit/a817755828cd0bfd4b87b0eb5cec59ffe57d3c3e
CVE ID: CVE-2018-10822 State: PUBLISHED Published: 2018-10-17T14:00:00 Last Updated: 2024-08-05T07:46:47.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary files via a /.. or // after "GET /uir" in an HTTP request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-6190. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclos
fix for CVE-2017-6190. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Oct/36 - http://sploit.tech/2018/10/12/D-Link.html
CVE ID: CVE-2018-10823 State: PUBLISHED Published: 2018-10-17T14:00:00 Last Updated: 2024-08-05T07:46:47.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Oct/36 - http://sploit.tech/2018/10/12/D-Link.html