rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-11479 
The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pipe\WindscribeService named pipe endpoint that allows the Windscribe VPN process to connect and execute an OpenVPN process or other processes (like taskkill, etc.). There is no validation of the program name before constructing the lpCommandLine argument for a CreateProcess call. An attacker can run any malicious process with SYSTEM privileges through this named pipe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-25T19:00:00.000Z
CVE-2018-11481 
TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T21:00:00.000Z
CVE-2018-11482 
/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T21:00:00.000Z
CVE-2018-11485 
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the "referral_site" cookie to have an XSS payload, and placing an order.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T15:00:00.000Z
CVE-2018-11486 
An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T15:00:00.000Z
CVE-2018-11487 
PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T15:00:00.000Z
CVE-2018-11488 
A stack exhaustion vulnerability in the search function of dtSearch 7.90.8538.1 and prior allows remote attackers to cause a denial of service condition by sending a specially crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T07:00:00.000Z
CVE-2018-11489 
The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain CrntCode array index is not checked. This will lead to a denial of service or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T18:00:00.000Z
CVE-2018-11490 
The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T00:00:00.000Z
CVE-2018-11491 
ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-25T13:00:00.000Z
CVE-2018-11492 
ASUS HG100 devices allow denial of service via an IPv4 packet flood.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T16:00:00.000Z
CVE-2018-11493 
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T18:00:00.000Z
CVE-2018-11494 
The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to execute arbitrary code if the remove step is skipped, because the attacker can discover a secret temporary directory name (containing 10 random digits) via a directory traversal attack involving language_info['code'].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T20:00:00.000Z
CVE-2018-11495 
OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the download_id. For example, an attacker can download ../../config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T20:00:00.000Z
CVE-2018-11496 
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in lrzip.c lacks certain size validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T20:00:00.000Z
CVE-2018-11498 
In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size during a memcpy in the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted input file, as well as achieve remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T20:00:00.000Z
CVE-2018-11499 
A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T20:00:00.000Z
CVE-2018-11500 
An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T21:00:00.000Z
CVE-2018-11501 
PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T21:00:00.000Z
CVE-2018-11502 
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker can remotely delete all mod notes and mod note logs in the modCP and ACP via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-24T21:00:00.000Z
CVE-2018-11503 
The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T21:00:00.000Z
CVE-2018-11504 
The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T21:00:00.000Z
CVE-2018-11505 
The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T22:00:00.000Z
CVE-2018-11506 
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-28T04:00:00.000Z
CVE-2018-11507 
An issue was discovered in Free Lossless Image Format (FLIF) 0.3. An attacker can trigger a long loop in image_load_pnm in image/image-pnm.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-28T04:00:00.000Z
CVE-2018-11508 
The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-28T13:00:00.000Z
CVE-2018-11509 
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-16T20:00:00.000Z
CVE-2018-11510 
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-28T14:00:00.000Z
CVE-2018-11511 
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-16T20:00:00.000Z
CVE-2018-11512 
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-28T13:00:00.000Z
CVE-2018-11514 
PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_resume_det.php, as demonstrated by changing .docx to .php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-28T14:00:00.000Z
CVE-2018-11515 
The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-28T14:00:00.000Z
CVE-2018-11516 
The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted .swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-28T16:00:00.000Z
CVE-2018-11517 
mySCADA myPRO 7 allows remote attackers to discover all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 requests to TCP port 11010.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-28T16:00:00.000Z
CVE-2018-11518 
A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can record these frequencies and use them for service activations. This is a request-forgery issue when the required series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the caller). In this case, the IVR system accepts an activation request from a less-secure channel (any loudspeaker in the caller's physical environment) without verifying that the request was intended (it matches a nonce sent over a more-secure channel to the caller's earpiece).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T20:00:00.000Z
CVE-2018-11522 
Yosoro 1.0.4 has stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T21:00:00.000Z
CVE-2018-11523 
upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T07:00:00.000Z
CVE-2018-11525 
The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-19T19:00:00.000Z
CVE-2018-11526 
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-19T19:00:00.000Z
CVE-2018-11527 
An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpass_save.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T07:00:00.000Z
CVE-2018-11528 
WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T07:00:00.000Z
CVE-2018-11529 
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-11T16:00:00.000Z
CVE-2018-11531 
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T07:00:00.000Z
CVE-2018-11532 
An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T07:00:00.000Z
CVE-2018-11535 
An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T07:00:00.000Z
CVE-2018-11536 
md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T07:00:00.000Z
CVE-2018-11537 
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-19T19:00:00.000Z
CVE-2018-11538 
servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T19:00:00.000Z
CVE-2018-11541 
A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privileged content via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T12:00:00.000Z
CVE-2018-11542 
A Remote Command Execution (RCE) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the execution of arbitrary commands via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T12:00:00.000Z
CVE-2018-11543 
A Local File Inclusion (LFI) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the downloading of arbitrary files via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T12:00:00.000Z
CVE-2018-11544 
The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/data/com.theolivetree.ftpserver/shared_prefs/com.theolivetree.ftpserver_preferences.xml file as the prefUsername and prefUserpass strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T21:00:00.000Z
CVE-2018-11545 
md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link label composed solely of backslash escapes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T21:00:00.000Z
CVE-2018-11546 
md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T21:00:00.000Z
CVE-2018-11547 
md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandles loop termination.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T21:00:00.000Z
CVE-2018-11548 
An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connections from the same source IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T21:00:00.000Z
CVE-2018-11549 
An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member" via a QQ number, as demonstrated by a form[qq_10]= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T21:00:00.000Z
CVE-2018-11551 
AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T17:00:00.000Z
CVE-2018-11552 
There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T17:00:00.000Z
CVE-2018-11553 
SGIN.CN xiangyun platform V9.4.10 has XSS via the login_url parameter to /login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-06T03:00:00.000Z
CVE-2018-11554 
The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T11:00:00.000Z
CVE-2018-11555 
tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T04:00:00.000Z
CVE-2018-11556 
tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T04:00:00.000Z
CVE-2018-11557 
YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T04:00:00.000Z
CVE-2018-11558 
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T04:00:00.000Z
CVE-2018-11559 
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T04:00:00.000Z
CVE-2018-11560 
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-23T19:00:00.000Z
CVE-2018-11561 
An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER (EETHER), an Ethereum ERC20 token, will lead to an unauthorized increase of an attacker's digital assets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T17:00:00.000Z
CVE-2018-11562 
An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-30T20:00:00.000Z
CVE-2018-11563 
An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T12:23:59.000Z