rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-7312 
SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T19:00:00.000Z
CVE-2018-7313 
SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T14:00:00.000Z
CVE-2018-7314 
SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T19:00:00.000Z
CVE-2018-7315 
SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T19:00:00.000Z
CVE-2018-7316 
Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T19:00:00.000Z
CVE-2018-7317 
Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T19:00:00.000Z
CVE-2018-7318 
SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T19:00:00.000Z
CVE-2018-7319 
SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T19:00:00.000Z
CVE-2018-7320 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by validating operand offsets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7321 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thrift.c had a large loop that was addressed by not proceeding with dissection after encountering an unexpected type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7322 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-dcm.c had an infinite loop that was addressed by checking for integer wraparound.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7323 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-wccp.c had a large loop that was addressed by ensuring that a calculated length was monotonically increasing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7324 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-sccp.c had an infinite loop that was addressed by using a correct integer data type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7325 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpki-rtr.c had an infinite loop that was addressed by validating a length field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7326 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-lltd.c had an infinite loop that was addressed by using a correct integer data type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7327 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-openflow_v6.c had an infinite loop that was addressed by validating property lengths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7328 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-usb.c had an infinite loop that was addressed by rejecting short frame header lengths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7329 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-s7comm.c had an infinite loop that was addressed by correcting off-by-one errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7330 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thread.c had an infinite loop that was addressed by using a correct integer data type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7331 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-ber.c had an infinite loop that was addressed by validating a length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7332 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-reload.c had an infinite loop that was addressed by validating a length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7333 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpcrdma.c had an infinite loop that was addressed by validating a chunk size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7334 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the UMTS MAC dissector could crash. This was addressed in epan/dissectors/packet-umts_mac.c by rejecting a certain reserved value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7335 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the IEEE 802.11 dissector could crash. This was addressed in epan/crypt/airpdcap.c by rejecting lengths that are too small.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7336 
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the FCP protocol dissector could crash. This was addressed in epan/dissectors/packet-fcp.c by checking for a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7337 
In Wireshark 2.4.0 to 2.4.4, the DOCSIS protocol dissector could crash. This was addressed in plugins/docsis/packet-docsis.c by removing the recursive algorithm that had been used for concatenated PDUs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7339 
The MP4Atom class in mp4atom.cpp in MP4v2 through 2.0.0 mishandles Entry Number validation for the MP4 Table Property, which allows remote attackers to cause a denial of service (overflow, insufficient memory allocation, and segmentation fault) or possibly have unspecified other impact via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T14:00:00.000Z
CVE-2018-7340 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Duo Security
product: Duo Network Gateway
Credits: lang: en
value: Kelby Ludwig of Duo Security
Published: 2019-04-17T14:01:03.000Z
CVE-2018-7355 
All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation, an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection attacks on the devices.
Problem types: description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ZTE
product: MF65
vendor: ZTE
product: MF65M1
Published: 2018-09-26T16:00:00.000Z
CVE-2018-7356 
All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which can generate easily predictable ISN, and allows remote attackers to spoof connections.
Problem types: description: TCP Initial Sequence Number (ISN) Reuse
Affected products: vendor: ZTE
product: ZXR10 8905E
Published: 2018-11-01T14:00:00.000Z
CVE-2018-7357 
ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.
Problem types: description: Improper Authorization
Affected products: vendor: ZTE
product: ZXHN H168N
Published: 2018-11-14T15:00:00.000Z
CVE-2018-7358 
ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.
Problem types: description: Improper Authorization
Affected products: vendor: ZTE
product: ZXHN H168N
Published: 2018-11-14T15:00:00.000Z
CVE-2018-7359 
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by heap-based buffer overflow vulnerability, which may allow an attacker to execute arbitrary code.
Problem types: description: Heap-based Buffer Overflow
Affected products: vendor: ZTE
product: ZXHN F670
Published: 2018-11-16T15:00:00.000Z
CVE-2018-7360 
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get the GPON SN information via appviahttp service.
Problem types: description: Information Exposure
Affected products: vendor: ZTE
product: ZXHN F670
Published: 2018-11-16T15:00:00.000Z
CVE-2018-7361 
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attacker to cause a denial of service via appviahttp service.
Problem types: description: NULL Pointer Dereference
Affected products: vendor: ZTE
product: ZXHN F670
Published: 2018-11-16T15:00:00.000Z
CVE-2018-7362 
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthorized user to perform unauthorized operations on the router.
Problem types: description: Improper Access Control
Affected products: vendor: ZTE
product: ZXHN F670
Published: 2018-11-16T15:00:00.000Z
CVE-2018-7363 
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization delay, an attacker can be allowed to brute force account credentials.
Problem types: description: Improper Authorization
Affected products: vendor: ZTE
product: ZXHN F670
Published: 2018-11-16T15:00:00.000Z
CVE-2018-7364 
All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: ZTE
product: ZXIN10-European region
Published: 2018-12-07T00:00:00.000Z
CVE-2018-7365 
All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized user to perform unauthorized operations.
Problem types: cwe_id: CWE-426
description: CWE-426: Untrusted Search Path
Affected products: vendor: ZTE
product: uSmartView
Published: 2018-12-20T14:00:00.000Z
CVE-2018-7366 
ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentication bypass vulnerability, which may allows an unauthorized user to perform unauthorized operations.
Problem types: description: Improper Access Control
Affected products: vendor: ZTE
product: ZXV10 B860AV2.1_ChinaMobile
Published: 2018-12-28T16:00:00.000Z
CVE-2018-7405 
Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T19:00:00.000Z
CVE-2018-7406 
An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the u3d images inside of a pdf. The issue results from the lack of proper validation of user-supplied data, which can result in an array indexing issue. An attacker can leverage this to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T21:00:00.000Z
CVE-2018-7407 
An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists when rendering U3D images inside of pdf files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T21:00:00.000Z
CVE-2018-7408 
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T18:00:00.000Z
CVE-2018-7409 
In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T18:00:00.000Z
CVE-2018-7417 
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the IPMI dissector could crash. This was addressed in epan/dissectors/packet-ipmi-picmg.c by adding support for crafted packets that lack an IPMI header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7418 
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by correcting the extraction of the length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7419 
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the NBAP dissector could crash. This was addressed in epan/dissectors/asn1/nbap/nbap.cnf by ensuring DCH ID initialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7420 
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the pcapng file parser could crash. This was addressed in wiretap/pcapng.c by adding a block-size check for sysdig event blocks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7421 
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the DMP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dmp.c by correctly supporting a bounded number of Security Categories for a DMP Security Classification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7422 
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T14:00:00.000Z
CVE-2018-7427 
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-7429 
Splunkd in Splunk Enterprise 6.2.x before 6.2.14 6.3.x before 6.3.11, and 6.4.x before 6.4.8; and Splunk Light before 6.5.0 allow remote attackers to cause a denial of service via a malformed HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-7431 
Directory traversal vulnerability in the Splunk Django App in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allows remote authenticated users to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-7432 
Splunk Enterprise 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allow remote attackers to cause a denial of service via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-7433 
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-02T20:00:00.000Z
CVE-2018-7434 
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-24T03:00:00.000Z
CVE-2018-7435 
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroy_cell function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T21:00:00.000Z
CVE-2018-7436 
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a pointer dereference of the parse_SST function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T21:00:00.000Z
CVE-2018-7437 
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy call of the parse_SST function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T21:00:00.000Z
CVE-2018-7438 
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_unicode_string function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T21:00:00.000Z
CVE-2018-7439 
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the function read_mini_biff_next_record.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T21:00:00.000Z
CVE-2018-7440 
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T00:00:00.000Z
CVE-2018-7441 
Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junk_split_image.ps in prog/splitimage2pdf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T00:00:00.000Z
CVE-2018-7442 
An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T00:00:00.000Z
CVE-2018-7443 
The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the amount of image data in a file, which allows remote attackers to cause a denial of service (memory allocation failure in the AcquireMagickMemory function in MagickCore/memory.c).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T22:00:00.000Z
CVE-2018-7445 
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T21:00:00.000Z
CVE-2018-7447 
mojoPortal through 2.6.0.0 is prone to multiple persistent cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. The 'Title' and 'Subtitle' fields of the 'Blog' page are vulnerable. NOTE: The software maintainer disputes this as a vulnerability because the fields claimed to be vulnerable to XSS are only available to administrators who are supposed to have access to add scripts
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-24T02:00:00.000Z
CVE-2018-7448 
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T17:00:00.000Z
CVE-2018-7449 
SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or RETR command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-04T01:00:00.000Z