rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-5304 
An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vulnerable to ClickJacking or UI Redressing: it is possible to access the web application in an iframe, and clicking on the iframe will redirect to a third-party application or perform other malicious actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z
CVE-2018-5306 
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T22:00:00.000Z
CVE-2018-5307 
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T22:00:00.000Z
CVE-2018-5308 
PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T05:00:00.000Z
CVE-2018-5309 
In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T05:00:00.000Z
CVE-2018-5310 
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T05:00:00.000Z
CVE-2018-5311 
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T05:00:00.000Z
CVE-2018-5312 
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T05:00:00.000Z
CVE-2018-5313 
A vulnerability allows local attackers to escalate privilege on Rapid Scada 5.5.0 because of weak C:\SCADA permissions. The specific flaw exists within the access control that is set and modified during the installation of the product. The product sets weak access control restrictions. An attacker can leverage this vulnerability to execute arbitrary code under the context of Administrator, the IUSR account, or SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T20:00:00.000Z
CVE-2018-5314 
Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; and the NetScaler Load Balancing instance distributed with NetScaler SD-WAN/CloudBridge 4000, 4100, 5000 and 5100 WAN Optimization Edition 9.3.0 allows remote attackers to execute a system command or read arbitrary files via an SSH login prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-01T17:00:00.000Z
CVE-2018-5315 
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T17:00:00.000Z
CVE-2018-5316 
The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T22:00:00.000Z
CVE-2018-5319 
RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T15:00:00.000Z
CVE-2018-5326 
Cheetah Mobile CM Browser 5.22.06.0012, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T02:00:00.000Z
CVE-2018-5327 
Cheetah Mobile Armorfly Browser & Downloader 1.1.05.0010, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T02:00:00.000Z
CVE-2018-5328 
ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse these functionalities to perform unauthorized actions, as demonstrated by Edit User Details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-15T21:00:00.000Z
CVE-2018-5329 
ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) on /CWEBNET/* authenticated pages. A successful CSRF attack can force the user to modify state: creating users, changing an email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-15T21:00:00.000Z
CVE-2018-5330 
ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (router unreachable/unresponsive) via a flood of fragmented UDP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2018-5331 
Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php, as demonstrated by a mod=space do=poll request to home.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T09:00:00.000Z
CVE-2018-5332 
In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T07:00:00.000Z
CVE-2018-5333 
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T07:00:00.000Z
CVE-2018-5334 
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timestamp bounds checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T21:00:00.000Z
CVE-2018-5335 
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T21:00:00.000Z
CVE-2018-5336 
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T21:00:00.000Z
CVE-2018-5337 
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T08:00:00.000Z
CVE-2018-5338 
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T08:00:00.000Z
CVE-2018-5339 
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T08:00:00.000Z
CVE-2018-5340 
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account (specifically, an account with permission to write to the filesystem via SQL queries).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T08:00:00.000Z
CVE-2018-5341 
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T08:00:00.000Z
CVE-2018-5342 
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services (Desktop Central and PostgreSQL) running with a superuser account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T08:00:00.000Z
CVE-2018-5344 
In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5345 
A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T00:00:00.000Z
CVE-2018-5347 
Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T01:00:00.000Z
CVE-2018-5349 
A vulnerability has been found in Heimdal PRO v2.2.190, but it is most likely also present in Heimdal FREE and Heimdal CORP. Faulty permissions on the directory "C:\ProgramData\Heimdal Security\Heimdal Agent" allow BUILTIN\Users to write new files to the directory. On startup, the process Heimdal.MonitorServices.exe running as SYSTEM will attempt to load version.dll from this directory. Placing a malicious version.dll in this directory will result in privilege escalation. NOTE: any affected Heimdal products are completely unrelated to the Heimdal vendor of a Kerberos 5 product on the h5l.org web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-22T16:00:00.000Z
CVE-2018-5353 
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T20:07:22.000Z
CVE-2018-5354 
The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-29T19:54:52.000Z
CVE-2018-5357 
ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5358 
ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5359 
The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-23T18:00:00.000Z
CVE-2018-5360 
LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-14T02:00:00.000Z
CVE-2018-5361 
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5362 
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5363 
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5364 
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5365 
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5366 
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5367 
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5368 
The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5369 
The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5370 
BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2018-5371 
diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5372 
The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5373 
The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5374 
The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5375 
Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_space.php appid parameter in a delete action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5376 
Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_upload.php op parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5377 
Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T09:00:00.000Z
CVE-2018-5378 
The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Quagga
product: bgpd
Published: 2018-02-19T13:00:00.000Z
CVE-2018-5379 
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-415
description: CWE-415: Double Free
Affected products: vendor: Quagga
product: bgpd
Published: 2018-02-19T13:00:00.000Z
CVE-2018-5380 
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Quagga
product: bgpd
Published: 2018-02-19T13:00:00.000Z
CVE-2018-5381 
The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.
Problem types: cwe_id: CWE-228
description: CWE-228: Improper Handling of Syntactically Invalid Structure
Affected products: vendor: Quagga
product: bgpd
Published: 2018-02-19T13:00:00.000Z
CVE-2018-5382 Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions
The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Legion of the Bouncy Castle
product: Bouncy Castle
Published: 2018-04-16T13:00:00.000Z
CVE-2018-5383 Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.
Problem types: cwe_id: CWE-325
description: CWE-325
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS
vendor: Android Open Source Project
product: Android
Credits: lang: en
value: Lior Neumann and Eli Biham of the Techion Israel Institute of Technology
Published: 2018-08-07T21:00:00.000Z
CVE-2018-5384 Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Navarino
product: Infinity
Published: 2018-07-24T15:00:00.000Z
CVE-2018-5385 Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks
Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations.
Problem types: cwe_id: CWE-384
description: CWE-384
Affected products: vendor: Navarino
product: Infinity
Published: 2018-07-24T15:00:00.000Z
CVE-2018-5386 Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak.
Problem types: cwe_id: CWE-288
description: CWE-288
Affected products: vendor: Navarino
product: Infinity
Published: 2018-07-24T15:00:00.000Z