rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-20671 
load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-04T16:00:00.000Z
CVE-2018-20673 
The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-04T17:00:00.000Z
CVE-2018-20674 
D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow authenticated remote command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T00:00:00.000Z
CVE-2018-20675 
D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* before v1.20B02Beta devices allow authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T00:00:00.000Z
CVE-2018-20676 
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T05:00:00.000Z
CVE-2018-20677 
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T05:00:00.000Z
CVE-2018-20678 
LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-28T15:21:28.000Z
CVE-2018-20679 
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T16:00:00.000Z
CVE-2018-20680 
Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T17:00:00.000Z
CVE-2018-20681 
mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By unplugging and re-plugging or power-cycling external output devices (such as additionally attached graphical outputs via HDMI, VGA, DVI, etc.) the content of a screensaver-locked session can be revealed. In some scenarios, the attacker can execute applications, such as by clicking with a mouse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-20682 
Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-20683 
commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-10T01:00:00.000Z
CVE-2018-20684 
In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-10T21:00:00.000Z
CVE-2018-20685 
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-10T00:00:00.000Z
CVE-2018-20687 
An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T18:12:12.000Z
CVE-2018-20698 
The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T17:06:00.000Z
CVE-2018-20699 
Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-12T02:00:00.000Z
CVE-2018-20703 
CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-13T15:00:00.000Z
CVE-2018-20712 
A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-15T00:00:00.000Z
CVE-2018-20713 
Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-15T16:00:00.000Z
CVE-2018-20714 
The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-15T16:00:00.000Z
CVE-2018-20715 
The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-15T16:00:00.000Z
CVE-2018-20716 
CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-15T16:00:00.000Z
CVE-2018-20717 
In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to gain Remote Code Execution. This occurs because protection against serialized objects looks for a 0: followed by an integer, but does not consider 0:+ followed by an integer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-15T16:00:00.000Z
CVE-2018-20718 
In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. An attacker either needs a "public link" of a file, or access to any unprivileged user account for creation of such a link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-15T16:00:00.000Z
CVE-2018-20719 
In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-15T16:00:00.000Z
CVE-2018-20720 
ABB Relion 630 devices 1.1 before 1.1.0.C0, 1.2 before 1.2.0.B3, and 1.3 before 1.3.0.A6 allow remote attackers to cause a denial of service (reboot) via a reboot command in an SPA message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T03:00:00.000Z
CVE-2018-20721 
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T14:00:00.000Z
CVE-2018-20723 
A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2018-20724 
A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2018-20725 
A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2018-20726 
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T16:00:00.000Z
CVE-2018-20727 
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T02:00:00.000Z
CVE-2018-20728 
A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T02:00:00.000Z
CVE-2018-20729 
A reflected cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T02:00:00.000Z
CVE-2018-20730 
A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T02:00:00.000Z
CVE-2018-20731 
A stored cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T02:00:00.000Z
CVE-2018-20732 
SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T01:00:00.000Z
CVE-2018-20733 
BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T01:00:00.000Z
CVE-2018-20735 
An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. NOTE: the vendor disputes this because they believe it is adequate to prevent this escalation by means of a custom, non-default configuration
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-17T20:00:00.000Z
CVE-2018-20736 
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T20:21:44.000Z
CVE-2018-20737 
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T20:16:49.000Z
CVE-2018-20742 
An issue was discovered in UC Berkeley RISE Opaque before 2018-12-01. There is no boundary check on ocall_malloc. The return value could be a pointer to enclave memory. It could cause an arbitrary enclave memory write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-24T05:00:00.000Z
CVE-2018-20743 
murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-25T16:00:00.000Z
CVE-2018-20744 
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T08:00:00.000Z
CVE-2018-20745 
Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T08:00:00.000Z
CVE-2018-20748 
LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-30T18:00:00.000Z
CVE-2018-20749 
LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-30T18:00:00.000Z
CVE-2018-20750 
LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-30T18:00:00.000Z
CVE-2018-20751 
An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be problematic due to the function GetObject() being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T19:00:00.000Z
CVE-2018-20752 
An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically, when a Twitter user possesses an Excel macro for a username, it will not be properly sanitized when exported to a CSV file. This can result in remote code execution for the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2018-20753 
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T05:00:00.000Z
CVE-2018-20755 
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T17:00:00.000Z
CVE-2018-20756 
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T17:00:00.000Z
CVE-2018-20757 
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T17:00:00.000Z
CVE-2018-20758 
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T17:00:00.000Z
CVE-2018-20760 
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T23:00:00.000Z
CVE-2018-20761 
GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c in libgpac_static.a.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T23:00:00.000Z
CVE-2018-20762 
GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T23:00:00.000Z
CVE-2018-20763 
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T23:00:00.000Z
CVE-2018-20764 
A buffer overflow exists in HelpSystems tcpcrypt on Linux, used for BoKS encrypted telnet through BoKS version 6.7.1. Since tcpcrypt is setuid, exploitation leads to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-08T17:00:00.000Z
CVE-2018-20767 
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is authenticated remote command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T17:00:00.000Z
CVE-2018-20768 
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T17:00:00.000Z
CVE-2018-20769 
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is a Local File Inclusion vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T17:00:00.000Z
CVE-2018-20770 
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is Blind SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T17:00:00.000Z
CVE-2018-20771 
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is unauthenticated Remote Command Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T17:00:00.000Z
CVE-2018-20772 
Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20773 
Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20774 
Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20775 
admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20776 
Frog CMS 0.9.5 provides a directory listing for a /public request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20777 
Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20778 
admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20779 
Traq 3.7.1 allows SQL Injection via a tickets?search= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20780 
Traq 3.7.1 allows admin/users/new CSRF to create an admin account (aka group_id=1).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T02:00:00.000Z
CVE-2018-20781 
In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T17:00:00.000Z