deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10183
Published: 2018-04-17
Description: An issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib/less.php/test/index.php because of a $_SERVER['REQUEST_URI'] echo, as demonstrated by the dir parameter in a file=charsets action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigtreecms/BigTree-CMS/issues/333; https://github.com/bigtreecms/BigTree-CMS/issues/333
CVE: CVE-2018-1371
Published: 2018-04-17
Description: An IBM WebSphere MQ 8.0.0.8, 9.0.0.2, and 9.0.4 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. IBM X-Force ID: 137771.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22012983; https://exchange.xforce.ibmcloud.com/vulnerabilities/137771; http://www.ibm.com/support/docview.wss?uid=swg22012983
CVE: CVE-2018-1445
Published: 2018-04-17
Description: IBM WebSphere Portal 8.0.0 through 8.0.0.1, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139907.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg22015407; http://www.securitytracker.com/id/1040647; https://exchange.xforce.ibmcloud.com/vulnerabilities/139907
CVE: CVE-2018-5429
Published: 2018-04-17
Description: A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow analytic reports that contain scripting to perform arbitrary code execution. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2;6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO JasperReports Library: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.1; 6.4.2, TIBCO JasperReports Library Community Edition: versions up to and including 6.4.3, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2, TIBCO Jaspersoft Studio: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO Jaspersoft Studio Community Edition: versions up to and including 6.4.3, TIBCO Jaspersoft Studio for ActiveMatrix BPM: versions up to and including 6.4.2.
CVSS Score: 8.8 (HIGH)
References: https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5429; https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5429
CVE: CVE-2018-5430
Published: 2018-04-17
Description: The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-200
References: https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/; https://www.exploit-db.com/exploits/44623/; https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430
CVE: CVE-2018-5431
Published: 2018-04-17
Description: The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which may allow, in the context of a non-default permissions configuration, persisted cross-site scripting (XSS) attacks. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5431; https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5431
CVE: CVE-2014-2294
Published: 2018-04-17
Description: Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://karmainsecurity.com/KIS-2014-03; http://www.openwebanalytics.com/?p=388; https://secuniaresearch.flexerasoftware.com/advisories/56999
CVE: CVE-2018-10185
Published: 2018-04-17
Description: An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yeyinshi/tuzicms/issues/1; https://github.com/yeyinshi/tuzicms/issues/1
CVE: CVE-2018-7514
Published: 2018-04-17
Description: Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may cause a stack-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-100-02; https://ics-cert.us-cert.gov/advisories/ICSA-18-100-02
CVE: CVE-2018-7530
Published: 2018-04-17
Description: Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may allow the pointer to call an incorrect object resulting in an access of resource using incompatible type condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-118
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-100-02; https://ics-cert.us-cert.gov/advisories/ICSA-18-100-02
CVE: CVE-2018-8834
Published: 2018-04-17
Description: Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may cause a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-100-02; https://ics-cert.us-cert.gov/advisories/ICSA-18-100-02
CVE: CVE-2017-2871
Published: 2018-04-17
Description: Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery using a custom image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0378; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0378
CVE: CVE-2018-10186
Published: 2018-04-17
Description: In radare2 2.5.0, there is a heap-based buffer over-read in the r_hex_bin2str function (libr/util/hex.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. This issue is different from CVE-2017-15368.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/radare/radare2/issues/9915; https://github.com/radare/radare2/issues/9915
CVE: CVE-2018-10187
Published: 2018-04-17
Description: In radare2 2.5.0, there is a heap-based buffer over-read in the dalvik_op function (libr/anal/p/anal_dalvik.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted DEX file. Note that this issue is different from CVE-2018-8809, which was patched earlier.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/radare/radare2/issues/9913; https://github.com/radare/radare2/issues/9913
CVE: CVE-2018-10189
Published: 2018-04-17
Description: An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/mautic/mautic/releases/tag/2.13.0; https://github.com/mautic/mautic/releases/tag/2.13.0
CVE: CVE-2018-10190
Published: 2018-04-17
Description: A vulnerability in London Trust Media Private Internet Access (PIA) VPN Client v77 for Windows could allow an unauthenticated, local attacker to run executable files with elevated privileges. The vulnerability is due to insufficient implementation of access controls. The "Changelog" and "Help" options available from the system tray context menu spawn an elevated instance of the user's default web browser. An attacker could exploit this vulnerability by selecting "Run as Administrator" from the context menu of an executable file within the file browser of the spawned default web browser. This may allow the attacker to execute privileged commands on the targeted system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-019.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-019.md
CVE: CVE-2018-6797
Published: 2018-04-17
Description: An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securitytracker.com/id/1040681; http://www.securitytracker.com/id/1042004; https://access.redhat.com/errata/RHSA-2018:1192
CVE: CVE-2018-6798
Published: 2018-04-17
Description: An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securitytracker.com/id/1040681; https://access.redhat.com/errata/RHSA-2018:1192; https://rt.perl.org/Public/Bug/Display.html?id=132063
CVE: CVE-2018-6913
Published: 2018-04-17
Description: Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103953; http://www.securitytracker.com/id/1040681; https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html
CVE: CVE-2018-7539
Published: 2018-04-17
Description: On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such as GET /../../../../../../../../../../../../etc/passwd) to the web server (fuzzd/0.1.1) running the Maintenance Center on port TCP/8088. This can lead to full compromise of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/Apr/34; http://seclists.org/fulldisclosure/2018/Apr/34
CVE: CVE-2018-10191
Published: 2018-04-17
Description: In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/mruby/mruby/commit/[PII_REDACTED]a6a2925c[PII_REDACTED]48e568330626; https://github.com/mruby/mruby/issues/3995; https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html
CVE: CVE-2018-10192
Published: 2018-04-17
Description: IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The `com.ipvanish.osx.vpnhelper` LaunchDaemon implements an insecure XPC service that could allow an attacker to execute arbitrary code as the root user. IPVanish uses a third-party library for converting `xpc_object_t` types in to `NSObject` types for sending XPC messages. When IPVanish establishes a new connection, the following XPC message is sent to the `com.ipvanish.osx.vpnhelper` LaunchDaemon. Because the XPC service itself does not validate an incoming connection, any application installed on the operating system can send it XPC messages. In the case of the "connect" message, an attacker could manipulate the `OpenVPNPath` to point at a malicious binary on the system. The `com.ipvanish.osx.vpnhelper` would receive the VPNHelperConnect command, and then execute the malicious binary as the root user.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-020.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-020.md
CVE: CVE-2018-8838
Published: 2018-04-17
Description: A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions R6.03.10 and earlier, CENTUM VP Small versions R6.03.10 and earlier, CENTUM VP Basic versions R6.03.10 and earlier, Exaopc versions R3.75.00 and earlier, B/M9000 CS all versions, and B/M9000 VP versions R8.01.01 and earlier may allow a local attacker to exploit the message management function of the system. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).
CVSS Score: 6.5 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-102-01; https://ics-cert.us-cert.gov/advisories/ICSA-18-102-01
CVE: CVE-2018-10193
Published: 2018-04-18
Description: LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTML document because the resource consumption of onloadwff.js grows with the number of INPUT elements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://forums.lastpass.com/viewtopic.php?f=12&t=286955; https://twitter.com/LastPassHelp/status/[PII_REDACTED]50071552; https://www.youtube.com/watch?v=wTcYWZwq3TE
CVE: CVE-2018-8733
Published: 2018-04-18
Description: Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://blog.redactedsec.net/exploits/2018/04/26/nagios.html; https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
CVE: CVE-2018-8734
Published: 2018-04-18
Description: SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://blog.redactedsec.net/exploits/2018/04/26/nagios.html; https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
CVE: CVE-2018-8735
Published: 2018-04-18
Description: Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://blog.redactedsec.net/exploits/2018/04/26/nagios.html; https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
CVE: CVE-2018-8736
Published: 2018-04-18
Description: A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.
CVSS Score: 8.8 (HIGH)
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://blog.redactedsec.net/exploits/2018/04/26/nagios.html; https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
CVE: CVE-2017-12196
Published: 2018-04-18
Description: undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-287, CWE-863
References: https://access.redhat.com/errata/RHSA-2018:0478; https://access.redhat.com/errata/RHSA-2018:0479; https://access.redhat.com/errata/RHSA-2018:0480
CVE: CVE-2018-5337
Published: 2018-04-18
Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html; https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/; https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html
CVE: CVE-2018-5338
Published: 2018-04-18
Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html; https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/; https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html
CVE: CVE-2018-5339
Published: 2018-04-18
Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.manageengine.com/products/desktop-central/query-restriction-bypass-vulnerability.html; https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/; https://www.manageengine.com/products/desktop-central/query-restriction-bypass-vulnerability.html
CVE: CVE-2018-5340
Published: 2018-04-18
Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account (specifically, an account with permission to write to the filesystem via SQL queries).
CVSS Score: 7.2 (HIGH)
References: https://www.manageengine.com/products/desktop-central/query-restriction-bypass-vulnerability.html; https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/; https://www.manageengine.com/products/desktop-central/query-restriction-bypass-vulnerability.html
CVE: CVE-2018-5341
Published: 2018-04-18
Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html; https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/; https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html
CVE: CVE-2018-5342
Published: 2018-04-18
Description: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services (Desktop Central and PostgreSQL) running with a superuser account.
CVSS Score: 7.2 (HIGH)
CWE: CWE-732
References: https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/; https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/
CVE: CVE-2018-8071
Published: 2018-04-18
Description: Mautic before v2.13.0 has stored XSS via a theme config file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mautic/mautic/releases/tag/2.13.0; https://github.com/mautic/mautic/releases/tag/2.13.0
CVE: CVE-2018-8092
Published: 2018-04-18
Description: Mautic before 2.13.0 allows CSV injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://github.com/mautic/mautic/releases/tag/2.13.0; https://github.com/mautic/mautic/releases/tag/2.13.0
CVE: CVE-2018-9986
Published: 2018-04-18
Description: In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.org/2018/04/12/zulip-1-7-2-released/; https://blog.zulip.org/2018/04/12/zulip-1-7-2-released/
CVE: CVE-2018-9987
Published: 2018-04-18
Description: In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.org/2018/04/12/zulip-1-7-2-released/; https://blog.zulip.org/2018/04/12/zulip-1-7-2-released/
CVE: CVE-2018-9990
Published: 2018-04-18
Description: In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.org/2018/04/12/zulip-1-7-2-released/; https://blog.zulip.org/2018/04/12/zulip-1-7-2-released/
CVE: CVE-2018-9999
Published: 2018-04-18
Description: In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.org/2018/04/12/zulip-1-7-2-released/; https://blog.zulip.org/2018/04/12/zulip-1-7-2-released/