rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-16271 
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T13:03:26.000Z
CVE-2018-16272 
The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T13:04:37.000Z
CVE-2018-16275 
OPSWAT MetaDefender before v4.11.2 allows CSV injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-31T13:00:00.000Z
CVE-2018-16276 
An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-31T16:00:00.000Z
CVE-2018-16277 
The Image Import function in XWiki through 10.7 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-28T00:00:00.000Z
CVE-2018-16278 
phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajax_save_draft function with the dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-31T16:00:00.000Z
CVE-2018-16281 
The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T16:00:00.000Z
CVE-2018-16282 
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-20T20:00:00.000Z
CVE-2018-16283 
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T22:00:00.000Z
CVE-2018-16285 
The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T23:00:00.000Z
CVE-2018-16286 
LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T21:00:00.000Z
CVE-2018-16287 
LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T21:00:00.000Z
CVE-2018-16288 
LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T21:00:00.000Z
CVE-2018-16291 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-16292 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-16293 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-16294 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-16295 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-16296 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-16297 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16296. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T16:00:00.000Z
CVE-2018-16298 
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-31T23:00:00.000Z
CVE-2018-16299 
The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-24T22:00:00.000Z
CVE-2018-16300 
The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T15:52:39.000Z
CVE-2018-16301 
The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.
Problem types: cwe_id: CWE-190
description: CWE-190 integer overflow or wraparound
cwe_id: CWE-787
description: CWE-787 out-of-bounds write
Affected products: vendor: The Tcpdump Group
product: tcpdump
Credits: lang: en
value: Include Security and Mozilla Secure Open Source program
Published: 2019-10-03T15:55:20.000Z
CVE-2018-16302 
MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T14:00:00.000Z
CVE-2018-16303 
PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T14:00:00.000Z
CVE-2018-16307 
An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name (containing a random string) is used in the HTTP Host header, the application performs an HTTP request to the specified domain. The response from that request is then included in the application's own response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-16308 
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T18:00:00.000Z
CVE-2018-16310 
Technicolor TG588V V2 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by macof. NOTE: this might overlap CVE-2018-15852 and CVE-2018-15907. NOTE: Technicolor denies that the described behavior is a vulnerability and states that Wi-Fi traffic is slowed or stopped only while the devices are exposed to a MAC flooding attack. This has been confirmed through testing against official up-to-date versions
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T23:00:00.000Z
CVE-2018-16313 
Bludit 2.3.4 allows XSS via a user name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T18:00:00.000Z
CVE-2018-16314 
An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T18:00:00.000Z
CVE-2018-16315 
In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T18:00:00.000Z
CVE-2018-16316 
A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T18:00:00.000Z
CVE-2018-16320 
idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T18:00:00.000Z
CVE-2018-16323 
ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T18:00:00.000Z
CVE-2018-16324 
In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T18:00:00.000Z
CVE-2018-16325 
There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T22:00:00.000Z
CVE-2018-16326 
PHP Scripts Mall Olx Clone 3.4.2 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-04T21:00:00.000Z
CVE-2018-16327 
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T22:00:00.000Z
CVE-2018-16328 
In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T22:00:00.000Z
CVE-2018-16329 
In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T22:00:00.000Z
CVE-2018-16330 
Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T03:00:00.000Z
CVE-2018-16331 
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T03:00:00.000Z
CVE-2018-16332 
An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T03:00:00.000Z
CVE-2018-16333 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server. While processing the ssid parameter for a POST request, the value is directly used in a sprintf call to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T03:00:00.000Z
CVE-2018-16334 
An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T03:00:00.000Z
CVE-2018-16335 
newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T03:00:00.000Z
CVE-2018-16336 
Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T03:00:00.000Z
CVE-2018-16337 
An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16338 
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16339 
An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16342 
ShowDoc v1.8.0 has XSS via a new page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16343 
SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16344 
An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16345 
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16346 
ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16347 
An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16348 
SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16349 
WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16350 
WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T18:00:00.000Z
CVE-2018-16352 
There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T22:00:00.000Z
CVE-2018-16353 
An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T22:00:00.000Z
CVE-2018-16354 
An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T22:00:00.000Z
CVE-2018-16356 
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T19:24:40.000Z
CVE-2018-16357 
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T19:28:02.000Z
CVE-2018-16358 
A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T22:00:00.000Z
CVE-2018-16359 
Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows attackers to rename files on the host OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T22:00:00.000Z
CVE-2018-16361 
An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-16362 
An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of arbitrary code (if CSP settings permit it) via repo_manage_page.php or list.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T22:00:00.000Z
CVE-2018-16363 
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2018-16364 
A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T21:00:00.000Z
CVE-2018-16365 
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-02T22:00:00.000Z