rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-21219 
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.0.0.56, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T15:44:48.000Z
CVE-2018-21220 
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.0.0.56, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T15:46:27.000Z
CVE-2018-21221 
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, and R9000 before 1.0.2.52.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:23:33.000Z
CVE-2018-21222 
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:24:51.000Z
CVE-2018-21223 
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:26:40.000Z
CVE-2018-21224 
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:28:05.000Z
CVE-2018-21225 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7000 before 1.0.1.60, D7800 before 1.0.1.34, D8500 before 1.0.3.39, R6700 before 1.0.1.30, R6700v2 before 1.2.0.16, R6800 before 1.2.0.16, R6900 before 1.0.1.30, R6900P before 1.2.0.22, R6900v2 before 1.2.0.16, R7000 before 1.0.9.12, R7000P before 1.2.0.22, R7500v2 before 1.0.3.20, R7800 before 1.0.2.44, R8300 before 1.0.2.106, R8500 before 1.0.2.106, and R9000 before 1.0.2.52.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:37:58.000Z
CVE-2018-21226 
Certain NETGEAR devices are affected by authentication bypass. This affects JNR1010v2 before 1.1.0.48, JWNR2010v5 before 1.1.0.48, WNR1000v4 before 1.1.0.48, WNR2020 before 1.1.0.48, and WNR2050 before 1.1.0.48.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:39:55.000Z
CVE-2018-21227 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, R6400v2 before 1.0.2.34, R6700 before 1.0.1.30, R6900 before 1.0.1.30, R6900P before 1.0.0.62, R7000 before 1.0.9.12, R7000P before 1.0.0.62, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R9000 before 1.0.3.10, WNDR4300v2 before 1.0.0.50, and WNDR4500v3 before 1.0.0.50.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T14:29:40.000Z
CVE-2018-21228 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, EX6100v2 before 1.0.1.50, EX6150v2 before 1.0.1.50, EX6200v2 before 1.0.1.44, EX6400 before 1.0.1.60, EX7300 before 1.0.1.60, R6100 before 1.0.1.16, R7500 before 1.0.0.110, R7800 before 1.0.2.32, R9000 before 1.0.2.30, WN3000RPv3 before 1.0.2.50, WNDR4300v2 before 1.0.0.50, and WNDR4500v3 before 1.0.0.50.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T14:34:08.000Z
CVE-2018-21229 
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R7500v2 before 1.0.3.20, R7800 before 1.0.2.38, WN3000RPv3 before 1.0.2.50, WNDR4300v2 before 1.0.0.50, and WNDR4500v3 before 1.0.0.50.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T14:27:52.000Z
CVE-2018-21230 
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D1500 before 1.0.0.27, D500 before 1.0.0.27, D6100 before 1.0.0.57, D6220 before 1.0.0.40, D6400 before 1.0.0.74, D7000 before 1.0.1.60, D7800 before 1.0.1.34, D8500 before 1.0.3.39, DGN2200v4 before 1.0.0.94, DGN2200Bv4 before 1.0.0.94, EX2700 before 1.0.1.42, EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6000 before 1.0.0.24, EX6100 before 1.0.2.18, EX6120 before 1.0.0.32, EX6130 before 1.0.0.22, EX6150 before 1.0.0.34_1.0.70, EX6200 before 1.0.3.82_1.1.117, EX6400 before 1.0.1.78, EX7000 before 1.0.0.56, EX7300 before 1.0.1., JNR1010v2 before 1.1.0.42, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.42, PR2000 before 1.0.0.22, R6050 before 1.0.1.10, R6100 before 1.0.1.16, R6220 before 1.1.0.50, R6250 before 1.0.4.14, R6300v2 before 1.0.4.12, R6400v2 before 1.0.2.34, R6700 before 1.0.1.26, R6900 before 1.0.1.26, R6900P before 1.2.0.22, R7000 before 1.0.9.6, R7000P before 1.2.0.22, R7100LG before 1.0.0.40, R7300DST before 1.0.0.54, R7500 before 1.0.0.110, R7500v2 before 1.0.3.26, R7800 before 1.0.2.44, R7900 before 1.0.1.26, R8000 before 1.0.3.48, R8300 before 1.0.2.104, R8500 before 1.0.2.104, R9000 before 1.0.3.10, WN2000RPTv3 before 1.0.1.26, WN2500RPv2 before 1.0.1.46, WN3000RPv3 before 1.0.2.66, WN3100RPv2 before 1.0.0.56, WNDR3400v3 before 1.0.1.14, WNDR3700v4 before 1.0.2.96, WNDR3700v5 before 1.1.0.54, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, WNR1000v4 before 1.1.0.42, WNR2000v5 before 1.0.0.64, WNR2020 before 1.1.0.42, and WNR2050 before 1.1.0.42.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T14:26:58.000Z
CVE-2018-21231 
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D1500 before 1.0.0.27, D500 before 1.0.0.27, D6100 before 1.0.0.57, D6220 before 1.0.0.40, D6400 before 1.0.0.74, D7000 before 1.0.1.60, D7800 before 1.0.1.34, D8500 before 1.0.3.39, DGN2200v4 before 1.0.0.94, DGN2200Bv4 before 1.0.0.94, EX2700 before 1.0.1.42, EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6000 before 1.0.0.24, EX6100 before 1.0.2.18, EX6120 before 1.0.0.32, EX6130 before 1.0.0.22, EX6150 before 1.0.0.34_1.0.70, EX6200 before 1.0.3.82_1.1.117, EX6400 before 1.0.1.78, EX7000 before 1.0.0.56, EX7300 before 1.0.1.78, JNR1010v2 before 1.1.0.42, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.42, PR2000 before 1.0.0.22, R6050 before 1.0.1.10, R6100 before 1.0.1.16, R6220 before 1.1.0.50, R6250 before 1.0.4.14, R6300v2 before 1.0.4.12, R6400v2 before 1.0.2.34, R6700 before 1.0.1.26, R6900 before 1.0.1.26, R6900P before 1.2.0.22, R7000 before 1.0.9.6, R7000P before 1.2.0.22, R7100LG before 1.0.0.40, R7300DST before 1.0.0.54, R7500 before 1.0.0.110, R7500v2 before 1.0.3.26, R7800 before 1.0.2.44, R7900 before 1.0.1.26, R8000 before 1.0.3.48, R8300 before 1.0.2.104, R8500 before 1.0.2.104, R9000 before 1.0.3.10, WN2000RPTv3 before 1.0.1.26, WN2500RPv2 before 1.0.1.46, WN3000RPv3 before 1.0.2.66, WN3100RPv2 before 1.0.0.56, WNDR3400v3 before 1.0.1.14, WNDR3700v4 before 1.0.2.96, WNDR3700v5 before 1.1.0.54, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, WNR1000v4 before 1.1.0.42, WNR2000v5 before 1.0.0.64, WNR2020 before 1.1.0.42, and WNR2050 before 1.1.0.42.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T14:22:48.000Z
CVE-2018-21232 
re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:36:31.000Z
CVE-2018-21233 
TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-04T14:12:19.000Z
CVE-2018-21234 
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-21T22:15:31.000Z
CVE-2018-21235 
An issue was discovered in Foxit E-mail advertising system before September 2018. It allows authentication bypass and information disclosure, related to Interspire Email Marketer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:41:43.000Z
CVE-2018-21236 
An issue was discovered in Foxit Reader before 2.4.4. It has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:41:08.000Z
CVE-2018-21237 
An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:33:11.000Z
CVE-2018-21238 
An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows memory consumption via an ArrayBuffer(0xfffffffe) call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:32:09.000Z
CVE-2018-21239 
An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:31:05.000Z
CVE-2018-21240 
An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows memory consumption via an ArrayBuffer(0xfffffffe) call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:30:30.000Z
CVE-2018-21241 
An issue was discovered in Foxit PhantomPDF before 8.3.6. It has an untrusted search path that allows a DLL to execute remote code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:29:20.000Z
CVE-2018-21242 
An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:23:56.000Z
CVE-2018-21243 
An issue was discovered in Foxit PhantomPDF before 8.3.6. It has COM object mishandling when Microsoft Word is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:22:40.000Z
CVE-2018-21244 
An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows arbitrary application execution via an embedded executable file in a PDF portfolio, aka FG-VD-18-029.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:17:01.000Z
CVE-2018-21245 
Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:50:38.000Z
CVE-2018-21246 
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:50:25.000Z
CVE-2018-21247 
An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:10:51.000Z
CVE-2018-21248 
An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:47:04.000Z
CVE-2018-21249 
An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:47:49.000Z
CVE-2018-21250 
An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:51:17.000Z
CVE-2018-21251 
An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:49:18.000Z
CVE-2018-21252 
An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T17:44:09.000Z
CVE-2018-21253 
An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:45:02.000Z
CVE-2018-21254 
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:49:54.000Z
CVE-2018-21255 
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:49:55.000Z
CVE-2018-21256 
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channel creation) via the Group message slash command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T17:44:07.000Z
CVE-2018-21257 
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Channel header slash command API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:51:47.000Z
CVE-2018-21258 
An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:45:05.000Z
CVE-2018-21259 
An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malformed link in a channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:47:10.000Z
CVE-2018-21260 
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:49:45.000Z
CVE-2018-21261 
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:51:44.000Z
CVE-2018-21262 
An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:51:43.000Z
CVE-2018-21263 
An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:45:07.000Z
CVE-2018-21264 
An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T17:44:05.000Z
CVE-2018-21265 
An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and notifications).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:51:42.000Z
CVE-2018-21268 
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2020-06-25T16:56:53.000Z
CVE-2018-21269 
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-27T03:42:32.000Z
CVE-2018-21270 
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-03T21:00:45.000Z
CVE-2018-25001 
An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T08:33:31.000Z
CVE-2018-25002 
uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covered by Drupal's security advisory policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T23:27:52.000Z
CVE-2018-25004 Invariant failure when explaining a find with a UUID
A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
privilegesRequired: HIGH
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.8
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2021-03-01T16:15:14.484Z
CVE-2018-25007 Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Vaadin
product: Vaadin
vendor: Vaadin
product: flow-server
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2021-04-23T16:05:40.338Z
CVE-2018-25008 
In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safety issues through race conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T06:10:04.000Z
CVE-2018-25009 
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: libwebp
Published: 2021-05-21T16:22:38.000Z
CVE-2018-25010 
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: libwebp
Published: 2021-05-21T16:24:23.000Z
CVE-2018-25011 
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: libwebp
Published: 2021-05-21T16:25:40.000Z
CVE-2018-25012 
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: libwebp
Published: 2021-05-21T16:26:31.000Z
CVE-2018-25013 
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: libwebp
Published: 2021-05-21T16:27:13.000Z
CVE-2018-25014 
A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().
Problem types: cwe_id: CWE-908
description: CWE-908
Affected products: vendor: n/a
product: libwebp
Published: 2021-05-21T16:27:57.000Z
CVE-2018-25015 
An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-07T19:20:39.000Z
CVE-2018-25016 
Greenbone Security Assistant (GSA) before 7.0.3 and Greenbone OS (GOS) before 5.0.0 allow Host Header Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-21T14:08:21.000Z