rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-15185 
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page update outage) via crafted PHP and JavaScript code in the "Current Position" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T15:00:00.000Z
CVE-2018-15186 
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T15:00:00.000Z
CVE-2018-15187 
PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T15:00:00.000Z
CVE-2018-15188 
PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in the Name field of a profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T15:00:00.000Z
CVE-2018-15189 
PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T15:00:00.000Z
CVE-2018-15190 
PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T17:00:00.000Z
CVE-2018-15191 
PHP Scripts Mall hotel-booking-script 2.0.4 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, or Address field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T17:00:00.000Z
CVE-2018-15192 
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T02:00:00.000Z
CVE-2018-15193 
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T02:00:00.000Z
CVE-2018-15197 
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T03:00:00.000Z
CVE-2018-15198 
An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T03:00:00.000Z
CVE-2018-15199 
AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T03:00:00.000Z
CVE-2018-15202 
An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/template/includes/crudTreatment.php that can add new users and add products.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T04:00:00.000Z
CVE-2018-15203 
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/add_page allows a CSRF attack to add pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T04:00:00.000Z
CVE-2018-15206 
BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T18:42:41.000Z
CVE-2018-15207 
BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pages/finadmin/currconvrate/currconvrate.jsf functionality that should be only accessible to an admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T18:45:23.000Z
CVE-2018-15208 
BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T18:47:44.000Z
CVE-2018-15209 
ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-08T04:00:00.000Z
CVE-2018-15310 
A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages.
Problem types: description: Information disclosure
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM
Published: 2018-09-13T14:00:00.000Z
CVE-2018-15311 
When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (LRO) feature enabled, TMM may crash, leading to a failover event. This vulnerability is not exposed unless LRO is enabled, so most affected customers will be on 13.1.x. LRO has been available since 11.4.0 but is not enabled by default until 13.1.0.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-10-10T14:00:00.000Z
CVE-2018-15312 
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an authenticated user to execute JavaScript for the currently logged-in user.
Problem types: description: XSS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-10-19T13:00:00.000Z
CVE-2018-15313 
On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page.
Problem types: description: XSS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP AFM
Published: 2018-10-19T13:00:00.000Z
CVE-2018-15314 
On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page.
Problem types: description: XSS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP AFM
Published: 2018-10-19T13:00:00.000Z
CVE-2018-15315 
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page.
Problem types: description: XSS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-10-19T13:00:00.000Z
CVE-2018-15316 
In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policy library with user permission and bypassing the endpoint checks.
Problem types: description: Privilege escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM)
vendor: F5 Networks, Inc.
product: BIG-IP APM Clients
vendor: F5 Networks, Inc.
product: BIG-IP Edge Client
Published: 2018-10-19T13:00:00.000Z
CVE-2018-15317 
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker sending specially crafted SSL records to a SSL Virtual Server will cause corruption in the SSL data structures leading to intermittent decrypt BAD_RECORD_MAC errors. Clients will be unable to access the application load balanced by a virtual server with an SSL profile until tmm is restarted.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15318 
In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produce a core file as a result of this condition.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15319 
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15320 
On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. The configuration which exposes this condition is the BIG-IP self IP address which is part of a VLAN group and has the Port Lockdown setting configured with anything other than "allow-all".
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15321 
When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.1.0-2.3.0, or Enterprise Manager 3.1.1 is licensed for Appliance Mode, Admin and Resource administrator roles can by-pass BIG-IP Appliance Mode restrictions to overwrite critical system files. Attackers of high privilege level are able to overwrite critical system files which bypasses security controls in place to limit TMSH commands. This is possible with an administrator or resource administrator roles when granted TMSH. Resource administrator roles must have TMSH access in order to perform this attack.
Problem types: description: Privilege escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), BIG-IQ Centralized Management, BIG-IQ Cloud and Orchestration, iWorkflow, Enterprise Manager
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15322 
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.0.1-2.3.0, or Enterprise Manager 3.1.1 a BIG-IP user granted with tmsh access may cause the BIG-IP system to experience denial-of-service (DoS) when the BIG-IP user uses the tmsh utility to run the edit cli preference command and proceeds to save the changes to another filename repeatedly. This action utilises storage space on the /var partition and when performed repeatedly causes the /var partition to be full.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe), BIG-IQ Centralized Management, BIG-IQ Cloud and Orchestration, iWorkflow, Enterprise Manager
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15323 
On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM,AFM, Analytics, APM ASM, Edge Gateway, FPS, PSM, Websafe)
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15324 
On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM)
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15325 
In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executing commands
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15326 
In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List.
Problem types: description: Unauthorized access
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM)
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15327 
In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
Problem types: description: Privilege escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager
Published: 2018-10-31T14:00:00.000Z
CVE-2018-15328 
On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files.
Problem types: description: Information disclosure
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager, BIG-IQ Centralized Management, F5 iWorkflow
Published: 2018-12-12T14:00:00.000Z
CVE-2018-15329 
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
Problem types: description: Privilege Escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager
Published: 2018-12-20T20:00:00.000Z
CVE-2018-15330 
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb as a payload, the BIG-IP system will experience a fatal error and may cause the Traffic Management Microkernel (TMM) to produce a core file.
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-12-20T20:00:00.000Z
CVE-2018-15331 
On BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb_convert utility used by BIG-IP AAM fails to drop group permissions when executing helper scripts, which could be used to leverage attacks against the BIG-IP system.
Problem types: description: Privilege Escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (AAM)
Published: 2018-12-20T20:00:00.000Z
CVE-2018-15332 
The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host in a race condition.
Problem types: description: Privilege Escalation
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM), BIG-IP APM Clients, BIG-IP Edge Client
Published: 2018-12-06T14:00:00.000Z
CVE-2018-15333 
On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously generated and available snapshot files on the BIG-IP configuration utility such as QKView and TCPDumps.
Problem types: description: Information Leakage
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2018-12-28T15:00:00.000Z
CVE-2018-15334 
A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication.
Problem types: description: CSRF
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM)
Published: 2018-12-28T15:00:00.000Z
CVE-2018-15335 
When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. In certain cases when communication between the BIG-IP APM and the OAuth authorization server is lost, APM may not display the intended message in the failure response
Problem types: description: DoS
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP (APM)
Published: 2018-12-28T15:00:00.000Z
CVE-2018-15350 
Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the router.
Problem types: description: Router Default Credentials
Affected products: vendor: Kaspersky Lab
product: Kraftway
Published: 2018-08-17T14:00:00.000Z
CVE-2018-15351 
Denial of service via crafting malicious link and sending it to a privileged user can cause Denial of Service in Kraftway 24F2XG Router firmware version 3.5.30.1118.
Problem types: description: Denial of service via crafting malicious link and sending it to a privileged user
Affected products: vendor: Kaspersky Lab
product: Kraftway
Published: 2018-08-17T14:00:00.000Z
CVE-2018-15352 
An attacker with low privileges can cause denial of service in Kraftway 24F2XG Router firmware version 3.5.30.1118.
Problem types: description: Denial of service by an attacker with low privileges
Affected products: vendor: Kaspersky Lab
product: Kraftway
Published: 2018-08-17T14:00:00.000Z
CVE-2018-15353 
A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG Router firmware 3.5.30.1118.
Problem types: description: A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution
Affected products: vendor: Kaspersky Lab
product: Kraftway
Published: 2018-08-17T14:00:00.000Z
CVE-2018-15354 
A Buffer Overflow exploited through web interface by remote attacker can cause denial of service in Kraftway 24F2XG Router firmware 3.5.30.1118.
Problem types: description: A Buffer Overflow exploited through web interface by remote attacker cause denial of service
Affected products: vendor: Kaspersky Lab
product: Kraftway
Published: 2018-08-17T14:00:00.000Z
CVE-2018-15355 
Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118.
Problem types: description: Usage of SSLv2 and SSLv3 leads to transmitted data decryption
Affected products: vendor: Kaspersky Lab
product: Kraftway
Published: 2018-08-17T14:00:00.000Z
CVE-2018-15356 
An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0.
Problem types: description: An authenticated attacker can execute arbitrary code using command ejection
Affected products: vendor: Kaspersky Lab
product: Eltex ESP-200
Published: 2018-08-17T15:00:00.000Z
CVE-2018-15357 
An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firmware version 1.2.0.
Problem types: description: An authenticated attacker with low privileges can extract password hash information for all users
Affected products: vendor: Kaspersky Lab
product: Eltex ESP-200
Published: 2018-08-17T15:00:00.000Z
CVE-2018-15358 
An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmware version 1.2.0.
Problem types: description: An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface
Affected products: vendor: Kaspersky Lab
product: Eltex ESP-200
Published: 2018-08-17T15:00:00.000Z
CVE-2018-15359 
An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-200 firmware version 1.2.0.
Problem types: description: An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface
Affected products: vendor: Kaspersky Lab
product: Eltex ESP-200
Published: 2018-08-17T15:00:00.000Z
CVE-2018-15360 
An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0.
Problem types: description: An attacker without authentication can login with default credentials for privileged users
Affected products: vendor: Kaspersky Lab
product: Eltex ESP-200
Published: 2018-08-17T15:00:00.000Z
CVE-2018-15361 
UltraVNC revision 1198 has a buffer underflow vulnerability in VNC client code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1199.
Problem types: cwe_id: CWE-124
description: CWE-124: Buffer Underwrite
Affected products: vendor: UltraVNC
product: UltraVNC
Published: 2019-03-05T15:00:00.000Z
CVE-2018-15362 
XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0
Problem types: description: XXE
Affected products: vendor: n/a
product: GE Proficy Cimplicity GDS
Published: 2018-12-07T16:00:00.000Z
CVE-2018-15363 
An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.
Problem types: description: Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2018-08-30T19:00:00.000Z
CVE-2018-15364 
A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.
Problem types: description: Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2018-08-30T19:00:00.000Z
CVE-2018-15365 
A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.
Problem types: description: Reflected XSS
Affected products: vendor: Trend Micro
product: Trend Micro Deep Discovery Inspector
Published: 2018-09-28T17:00:00.000Z