rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-20782 
The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-17T18:00:00.000Z
CVE-2018-20783 
In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-21T19:00:00.000Z
CVE-2018-20784 
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T15:00:00.000Z
CVE-2018-20785 
Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, this does not completely reset the chip: memory contents are still in place. Also, it restarts into a boot menu that enables XMODEM upload and execution of an unsigned QNX IFS system image, thereby completing the bypass of secure boot. Moreover, the attacker can craft custom IFS data and write it to unused memory to extract all memory contents that had previously been present. This includes the original firmware and sensitive information such as Wi-Fi credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-23T14:00:00.000Z
CVE-2018-20786 
libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a denial of service (application crash), related to screen.c, state.c, and vterm.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-24T14:00:00.000Z
CVE-2018-20787 
The ft5x46 touchscreen driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS because of missing checks of the size argument in tpdbg_write in drivers/input/touchscreen/ft5x46/ft5x46_ts.c. This is exploitable for a device crash via a syscall by a crafted application on a rooted device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T04:00:00.000Z
CVE-2018-20788 
drivers/leds/leds-aw2023.c in the led driver for custom Linux kernels on the Xiaomi Redmi 6pro daisy-o-oss phone has several integer overflows because of a left-shifting operation when the right-hand operand can be equal to or greater than the integer length. This can be exploited by a crafted application for denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T04:00:00.000Z
CVE-2018-20789 
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass through the delete_folder action in execute.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T06:00:00.000Z
CVE-2018-20790 
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass through the delete_file action in execute.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T06:00:00.000Z
CVE-2018-20791 
tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T06:00:00.000Z
CVE-2018-20792 
tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the get_file action in ajax_calls.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T06:00:00.000Z
CVE-2018-20793 
tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass, through the create_file action in execute.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T06:00:00.000Z
CVE-2018-20794 
tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the path parameter, through the save_img action in ajax_calls.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T06:00:00.000Z
CVE-2018-20795 
tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary files via path traversal with the path parameter, through the copy_cut action in ajax_calls.php and the paste_clipboard action in execute.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-25T06:00:00.000Z
CVE-2018-20796 
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T02:00:00.000Z
CVE-2018-20797 
An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-27T17:00:00.000Z
CVE-2018-20798 
The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durations implemented by sshguard, which might make it easier for attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-01T15:00:00.000Z
CVE-2018-20799 
In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH authentication (the behavior does not match the sshguard documentation), which might make it easier for attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-01T15:00:00.000Z
CVE-2018-20800 
An issue was discovered in Open Ticket Request System (OTRS) 5.0.31 and 6.0.13. Users updating to 6.0.13 (also patchlevel updates) or 5.0.31 (only major updates) will experience data loss in their agent preferences table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-13T22:00:00.000Z
CVE-2018-20801 
In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-14T16:00:00.000Z
CVE-2018-20802 Post-auth queries on compound index may crash mongod
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.
Problem types: cwe_id: CWE-394
description: CWE-394 Unexpected Status Code or Return Value
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-11-23T15:15:18.509Z
CVE-2018-20803 Infinite loop in aggregation expression
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.
Problem types: cwe_id: CWE-835
description: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-11-23T17:30:14.042Z
CVE-2018-20804 Invariant failure in applyOps
A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-11-23T15:15:14.421Z
CVE-2018-20805 Invariant with $elemMatch
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.
Problem types: cwe_id: CWE-834
description: CWE-834 Excessive Iteration
Affected products: vendor: MongoDB Inc.
product: MongoDB Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-11-23T15:20:13.690Z
CVE-2018-20806 
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T23:00:00.000Z
CVE-2018-20807 
An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T03:00:00.000Z
CVE-2018-20808 
An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to 8.1RX.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T03:00:00.000Z
CVE-2018-20809 
A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5. This is not applicable to PCS 8.1RX.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T03:00:00.000Z
CVE-2018-20810 
Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T03:00:00.000Z
CVE-2018-20811 
A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T03:00:00.000Z
CVE-2018-20812 
An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack (IPv4/IPv6) endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T03:00:00.000Z
CVE-2018-20813 
An input validation issue has been found with login_meeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T03:00:00.000Z
CVE-2018-20814 
An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T03:00:00.000Z
CVE-2018-20815 
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T21:40:01.000Z
CVE-2018-20816 
An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-05T13:05:07.000Z
CVE-2018-20817 
SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-19T22:08:01.000Z
CVE-2018-20818 
A buffer overflow vulnerability was discovered in the OpenPLC controller, in the OpenPLC_v2 and OpenPLC_v3 versions. It occurs in the modbus.cpp mapUnusedIO() function, which can cause a runtime crash of the PLC or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-21T19:50:39.000Z
CVE-2018-20819 
io/ZlibCompression.cc in the decompression component in Dropbox Lepton 1.2.1 allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact by crafting a jpg image file. The root cause is a missing check of header payloads that may be (incorrectly) larger than the maximum file size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T13:53:36.000Z
CVE-2018-20820 
read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows attackers to cause a denial-of-service (application runtime crash because of an integer overflow) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T13:53:49.000Z
CVE-2018-20821 
The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T13:54:07.000Z
CVE-2018-20822 
LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T13:54:19.000Z
CVE-2018-20823 
The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service (resonance and false data) via a 20.4 kHz audio signal, aka a MEMS ultrasound attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T13:47:55.000Z
CVE-2018-20824 
The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-05-03T19:26:27.846Z
CVE-2018-20826 
The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization (CWE-863)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-09T19:31:09.865Z
CVE-2018-20827 
The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-09T19:31:05.597Z
CVE-2018-20834 
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T18:01:58.000Z
CVE-2018-20835 
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T18:02:13.000Z
CVE-2018-20836 
An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T13:04:44.000Z
CVE-2018-20837 
include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-09T21:25:23.000Z
CVE-2018-20838 
ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T04:04:18.000Z
CVE-2018-20839 
systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T03:39:01.000Z
CVE-2018-20840 
An unhandled exception vulnerability exists during Google Sign-In with Google API C++ Client before 2019-04-10. It potentially causes an outage of third-party services that were not designed to recover from exceptions. On the client, ID token handling can cause an unhandled exception because of misinterpretation of an integer as a string, resulting in denial-of-service and then other users can no longer login/sign-in to the affected third-party service. Once this third-party service uses Google Sign-In with google-api-cpp-client, a malicious user can trigger this client/auth/oauth2_authorization.cc vulnerability by requesting the client to receive the ID token from a Google authentication server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-30T15:58:10.000Z
CVE-2018-20841 
HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacters in the mac parameter of a protocol.csp?function=set&fname=security&opt=mac_table request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:45:17.000Z
CVE-2018-20843 
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T16:06:38.000Z
CVE-2018-20845 
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:07:27.000Z
CVE-2018-20846 
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:07:35.000Z
CVE-2018-20847 
An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:07:43.000Z
CVE-2018-20848 
Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] parameter to the latter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-30T18:15:23.000Z
CVE-2018-20849 
Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-30T18:15:43.000Z
CVE-2018-20850 
Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-04T13:16:32.000Z
CVE-2018-20851 
Helpy before 2.2.0 allows agents to edit admins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T13:38:04.000Z