rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-16966 
There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-15T20:37:26.000Z
CVE-2018-16967 
There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-15T20:39:53.000Z
CVE-2018-16968 
Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T21:00:00.000Z
CVE-2018-16969 
Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T21:00:00.000Z
CVE-2018-16970 
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T20:00:00.000Z
CVE-2018-16971 
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-purchased course contents (quiz / test) via a modified id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T20:00:00.000Z
CVE-2018-16974 
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters (for bypassing the blacklist).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T21:00:00.000Z
CVE-2018-16975 
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input validation in apps/designer/handlers/csspreview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T21:00:00.000Z
CVE-2018-16976 
Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T22:00:00.000Z
CVE-2018-16977 
Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T23:00:00.000Z
CVE-2018-16978 
Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T23:00:00.000Z
CVE-2018-16979 
Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T23:00:00.000Z
CVE-2018-16980 
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T23:00:00.000Z
CVE-2018-16981 
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T23:00:00.000Z
CVE-2018-16982 
Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T02:00:00.000Z
CVE-2018-16983 
NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T04:00:00.000Z
CVE-2018-16984 
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-02T18:00:00.000Z
CVE-2018-16985 
In Lizard (formerly LZ5) 2.0, use of an invalid memory address was discovered in LZ5_compress_continue in lz5_compress.c, related to LZ5_compress_fastSmall and MEM_read32. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T14:00:00.000Z
CVE-2018-16986 
Texas Instruments BLE-STACK v2.2.1 for SimpleLink CC2640 and CC2650 devices allows remote attackers to execute arbitrary code via a malformed packet that triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-06T16:00:00.000Z
CVE-2018-16987 
Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T15:00:00.000Z
CVE-2018-16988 
An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a password-reset process (pass_reset.php, password_reset.php, XDUser.php) in the past few minutes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T19:38:07.000Z
CVE-2018-16994 
An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth S20-ETH-BK and Rexroth S20-PN-BK+ (the S20-PN-BK+/S20-ETH-BK fieldbus couplers sold by Bosch Rexroth contain technology from Phoenix Contact). Incorrect handling of a request with non-standard symbols allows remote attackers to initiate a complete lock up of the bus coupler. Authentication of the request is not required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-18T22:27:28.000Z
CVE-2018-16999 
Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to cause a denial of service via a crafted input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T16:00:00.000Z
CVE-2018-17000 
A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by the executable tiffcp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T16:00:00.000Z
CVE-2018-17001 
On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-17002 
On the RICOH MP 2001 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-17003 
In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-17004 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wlan_access name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17005 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for firewall dmz enable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17006 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for firewall lan_manage mac2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17007 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_wds_2g ssid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17008 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_host_2g power.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17009 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_host_2g isolate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17010 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for wireless wlan_host_2g bandwidth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17011 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for hosts_info para sun.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17012 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for hosts_info set_block_flag up_limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17013 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for protocol wan wan_rate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17014 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for ip_mac_bind name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17015 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for ddns phddns username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17016 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for reboot_timer name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17017 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for dhcpd udhcpd enable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17018 
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, DNS, and UPnP) via long JSON data for time_switch name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T18:00:00.000Z
CVE-2018-17019 
In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T19:00:00.000Z
CVE-2018-17020 
ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allow remote attackers to cause a denial of service via a single "GET / HTTP/1.1\r\n" line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T19:00:00.000Z
CVE-2018-17021 
Cross-site scripting (XSS) vulnerability on ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allows remote attackers to inject arbitrary web script or HTML via the appGet.cgi hook parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T19:00:00.000Z
CVE-2018-17022 
Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (device crash) or possibly have unspecified other impact by setting a long sh_path0 value and then sending an appGet.cgi?hook=select_list("Storage_x_SharedPath") request, because ej_select_list in router/httpd/web.c uses strcpy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T19:00:00.000Z
CVE-2018-17023 
Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T19:00:00.000Z
CVE-2018-17024 
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T20:00:00.000Z
CVE-2018-17025 
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T20:00:00.000Z
CVE-2018-17026 
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-13T20:00:00.000Z
CVE-2018-17030 
BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T02:00:00.000Z
CVE-2018-17031 
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T02:00:00.000Z
CVE-2018-17034 
UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17035 
UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17036 
An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17037 
user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17039 
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17042 
An issue has been found in dbf2txt through 2012-07-19. It is a infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17043 
An issue has been found in doc2txt through 2014-03-19. It is a heap-based buffer overflow in the function Storage::init in Storage.cpp, called from parse_doc in parse_doc.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17044 
In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17045 
An issue was discovered in CMS MaeloStore V.1.5.0. There is a CSRF vulnerability that can change the administrator password via admin/modul/users/aksi_users.php?act=update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17046 
translate man before 2018-08-21 has XSS via containers/outputBox/outputBox.vue and store/index.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17048 
admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-16T14:19:46.000Z
CVE-2018-17049 
CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17050 
The mintToken function of a smart contract implementation for PolyAi (AI), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-17051 
K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T07:00:00.000Z
CVE-2018-17053 
Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17054.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-03T18:00:00.000Z
CVE-2018-17054 
Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17053.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-03T18:00:00.000Z
CVE-2018-17055 
An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-17056 
Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-17057 
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T20:00:00.000Z
CVE-2018-17058 
An issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary file upload vulnerability in the picture-upload feature of ProductEdit.aspx. An authenticated attacker may bypass the frontend filename validation and upload an arbitrary file via FileUploader.aspx.cs in FileUploader.aspx by using empty w and h parameters. This file may contain arbitrary aspx code that may be executed by accessing /Jec/ProductImages/<number>/<filename>. Accessing the file once uploaded does not require authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T13:32:47.000Z
CVE-2018-17060 
Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory.  NOTE: this product has been obsolete since June 2013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-17061 
BullGuard Safe Browsing before 18.1.355.9 allows XSS on Google, Bing, and Yahoo! pages via domains indexed in search results.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-15T19:00:00.000Z
CVE-2018-17062 
An issue was discovered in SeaCMS 6.64. XSS exists in admin_video.php via the action, area, type, yuyan, jqtype, v_isunion, v_recycled, v_ismoney, or v_ispsd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-16T17:00:00.000Z