rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-8842 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The Philips e-Alert communication channel is not encrypted which could therefore lead to disclosure of personal contact information and application login credentials from within the same subnet.
Problem types: cwe_id: CWE-319
description: CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-8843 
Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software files that may cause the software application to crash, potentially losing any unsaved data..
Problem types: cwe_id: CWE-416
description: Use after free CWE-416
Affected products: vendor: ICS-CERT
product: Rockwell Automation Arena
Published: 2018-05-14T18:00:00.000Z
CVE-2018-8844 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Problem types: cwe_id: CWE-352
description: CROSS-SITE REQUEST FORGERY (CSRF) CWE-352
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-8845 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a heap-based buffer overflow vulnerability has been identified, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-8846 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is then served to other users.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-8847 
Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: Eaton 9000X Drive
Published: 2018-07-13T19:00:00.000Z
CVE-2018-8848 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.
Problem types: cwe_id: CWE-276
description: INCORRECT DEFAULT PERMISSIONS CWE-276
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-8849 Medtronic N'Vision Clinician Programmer Missing Encryption of Sensitive Data
Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.
Problem types: cwe_id: CWE-311
description: MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
Affected products: vendor: Medtronic
product: N'Vision Clinician Programmer
default_status: unaffected
vendor: Medtronic
product: 8870 N’Vision removable Application Card
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Billy Rios and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.
Published: 2018-05-18T13:00:00.000Z
CVE-2018-8850 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowing an attacker to craft the input in a form that is not expected by the rest of the application. This would lead to parts of the unit receiving unintended input, which may result in altered control flow, arbitrary control of a resource, or arbitrary code execution.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-8851 
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store passwords in plaintext, which may allow an attacker with access to the configuration file to log into the SmartServer web user interface.
Problem types: cwe_id: CWE-256
description: UNPROTECTED STORAGE OF CREDENTIALS CWE-256
Affected products: vendor: Echelon
product: SmartServer 1
vendor: Echelon
product: SmartServer 2
vendor: Echelon
product: i.LON 100
vendor: Echelon
product: i.LON 600
Published: 2018-07-24T17:00:00.000Z
CVE-2018-8852 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives an attacker the opportunity to steal authenticated sessions without invalidating any existing session identifier.
Problem types: cwe_id: CWE-384
description: SESSION FIXATION CWE-384
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-8853 
Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system. Windows boots by default with elevated Windows privileges, enabling a kiosk application, user, or an attacker to potentially attain unauthorized elevated privileges in Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior. Also, attackers may gain access to unauthorized resources from the underlying Windows operating system.
Problem types: cwe_id: CWE-250
description: EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
Affected products: vendor: Philips
product: Brilliance CT Scanners
Published: 2018-05-04T17:00:00.000Z
CVE-2018-8854 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources requested or influenced by an actor, which can be used to consume more resources than intended.
Problem types: cwe_id: CWE-400
description: UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-400
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-8855 
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web connections by default, and devices can receive configuration and firmware updates by unsecure FTP.
Problem types: cwe_id: CWE-319
description: CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
Affected products: vendor: Echelon
product: SmartServer 1
vendor: Echelon
product: SmartServer 2
vendor: Echelon
product: i.LON 100
vendor: Echelon
product: i.LON 600
Published: 2018-07-24T17:00:00.000Z
CVE-2018-8856 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software contains hard-coded cryptographic key, which it uses for encryption of internal data.
Problem types: description: USE OF HARD-CODED CREDENTIALS CWE- 798
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-8857 
Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior) contains fixed credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. An attacker could compromise these credentials and gain access to the system.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: Philips
product: Brilliance CT Scanners
Published: 2018-05-04T17:00:00.000Z
CVE-2018-8858 
If an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) they may be able to extract credentials.
Problem types: cwe_id: CWE-522
description: INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522
Affected products: vendor: n/a
product: VGo Robot
Published: 2018-10-30T21:00:00.000Z
CVE-2018-8859 
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product.
Problem types: cwe_id: CWE-288
description: AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
Affected products: vendor: Echelon
product: SmartServer 1
vendor: Echelon
product: SmartServer 2
vendor: Echelon
product: i.LON 100
vendor: Echelon
product: i.LON 600
Published: 2018-07-24T17:00:00.000Z
CVE-2018-8860 
In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker may be able to capture firmware updates through the adjacent network.
Problem types: description: Cleartext Transmission of Sensitive Information
Affected products: vendor: ICS-CERT
product: VGo Robot
Published: 2018-05-09T21:00:00.000Z
CVE-2018-8861 
Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and Brilliance CT Big Bore 2.3.5 and prior) could enable a limited-access kiosk user or an unauthorized attacker to break-out from the containment of the kiosk environment, attain elevated privileges from the underlying Windows OS, and access unauthorized resources from the operating system.
Problem types: cwe_id: CWE-668
description: EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668
Affected products: vendor: Philips
product: Brilliance CT Scanners
Published: 2018-05-04T17:00:00.000Z
CVE-2018-8862 
In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287
Affected products: vendor: Acoustic Technology, Inc. (ATI Systems)
product: Emergency Mass Notification Systems
Published: 2018-05-25T16:00:00.000Z
CVE-2018-8863 Philips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized Actor
The HTTP header in Philips EncoreAnywhere contains data an attacker may be able to use to gain sensitive information.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Philips
product: EncoreAnywhere 
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Philips reported this vulnerability
Published: 2023-11-09T22:46:29.821Z
CVE-2018-8864 
In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms.
Problem types: cwe_id: CWE-311
description: MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
Affected products: vendor: Acoustic Technology, Inc. (ATI Systems)
product: ATI Emergency Mass Notification Systems
Published: 2018-05-25T16:00:00.000Z
CVE-2018-8865 
In Lantech IDS 2102 2.0 and prior, a stack-based buffer overflow vulnerability has been identified which may allow remote code execution. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Lantech
product: IDS 2102
Published: 2018-05-04T17:00:00.000Z
CVE-2018-8866 
In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker on an adjacent network could perform command injection.
Problem types: description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: ICS-CERT
product: VGo Robot
Published: 2018-05-09T19:00:00.000Z
CVE-2018-8867 
In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: ICS-CERT
product: GE PACSystems RX3i CPE305/310 version 9.20 and prior RX3i CPE330 version 9.21 and prior RX3i CPE 400 version 9.30 and prior PACSystems RSTi-EP CPE 100 all versionsPACSystems CPU320/CRU320 RXi all versions
Published: 2018-05-18T20:00:00.000Z
CVE-2018-8868 Medtronic MyCareLink Patient Monitor Exposed Dangerous Method or Function
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.
Problem types: cwe_id: CWE-749
description: CWE-749
Affected products: vendor: Medtronic
product: 24950 MyCareLink Monitor
default_status: unaffected
vendor: Medtronic
product: 24952 MyCareLink Monitor
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Peter Morgan of Clever Security reported this vulnerability
Published: 2018-07-02T18:00:00.000Z
CVE-2018-8869 
In Lantech IDS 2102 2.0 and prior, nearly all input fields allow for arbitrary input on the device. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: Lantech
product: IDS 2102
Published: 2018-05-04T17:00:00.000Z
CVE-2018-8870 Medtronic MyCareLink Patient Monitor Use of Hard-coded Password
Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to the operating system.
Problem types: cwe_id: CWE-259
description: CWE-259
Affected products: vendor: Medtronic
product: 24950 MyCareLink Monitor
default_status: unaffected
vendor: Medtronic
product: 24952 MyCareLink Monitor
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Peter Morgan of Clever Security reported this vulnerability
Published: 2018-07-02T18:00:00.000Z
CVE-2018-8871 
In Delta Electronics Automation TPEditor version 1.89 or prior, parsing a malformed program file may cause heap-based buffer overflow vulnerability, which may allow remote code execution.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Delta Electronics
product: Automation TPEditor
Published: 2018-05-25T16:00:00.000Z
CVE-2018-8872 
In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow attacker data to be copied anywhere within memory.
Problem types: cwe_id: CWE-119
description: Improper Restriction Of Operations Within The Bounds Of A Memory Buffer CWE-119
Affected products: vendor: Schneider Electric
product: Triconex Tricon
Published: 2018-05-04T17:00:00.000Z
CVE-2018-8873 
In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222040.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T22:00:00.000Z
CVE-2018-8874 
In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222054.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T22:00:00.000Z
CVE-2018-8875 
In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x0022209c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T22:00:00.000Z
CVE-2018-8876 
In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222098.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T22:00:00.000Z
CVE-2018-8877 
Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the new_lan_ip variable on the error_page.htm page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T21:11:29.000Z
CVE-2018-8878 
Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network devices' hostnames and MAC addresses by reading the custom_id variable on the blocking.asp page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T21:12:40.000Z
CVE-2018-8879 
Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters are flag, mac, and cat_id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T15:26:03.000Z
CVE-2018-8880 
Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-23T18:00:00.000Z
CVE-2018-8881 
Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T23:00:00.000Z
CVE-2018-8882 
Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T23:00:00.000Z
CVE-2018-8883 
Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled access to nasm_reg_flags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T23:00:00.000Z
CVE-2018-8885 
screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API, which allows local users to bypass intended access restrictions by leveraging a race condition via a setuid or pkexec process that is mishandled in a PolicyKitService._check_permission call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T20:00:00.000Z
CVE-2018-8888 
A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator.
Problem types: description: Stored Cross-Site Scripting
Affected products: vendor: BlackBerry
product: BlackBerry UEM
Published: 2018-12-20T20:00:00.000Z
CVE-2018-8889 
A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.29 and earlier could allow an attacker to retrieve arbitrary files in the context of a BEMS administrator account.
Problem types: description: Directory traversal
Affected products: vendor: BlackBerry
product: BlackBerry Enterprise Mobility Server (BEMS)
Published: 2018-09-19T21:00:00.000Z
CVE-2018-8890 
An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session and perform administrative actions in the context of the user.
Problem types: description: Information disclosure
Affected products: vendor: BlackBerry
product: UEM
Published: 2018-10-12T13:00:00.000Z
CVE-2018-8891 
Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator.
Problem types: description: Stored Cross-Site Scripting
Affected products: vendor: BlackBerry
product: BlackBerry UEM
Published: 2018-12-20T20:00:00.000Z
CVE-2018-8892 
A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrator.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: BlackBerry
product: BlackBerry UEM
Published: 2018-12-20T20:00:00.000Z