rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-18690 
In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-26T18:00:00.000Z
CVE-2018-18692 
A reflected Cross-Site scripting (XSS) vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-23T11:00:00.000Z
CVE-2018-18694 
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-26T20:00:00.000Z
CVE-2018-18695 
M2SOFT Report Designer Viewer 5.0 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via a crafted MRD file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-18696 
main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0?language=en_US) and disagrees that this issue is a vulnerability. They also claim that MicroStrategy was never properly informed of this issue via normal support channels or their vulnerability reporting page on their website, so they were unable to evaluate the report or explain how this is something their customers view as a feature and not a security vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T17:00:00.000Z
CVE-2018-18698 
An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleartext Wi-Fi passwords in logcat during the process of setting up the phone as a hotspot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-24T17:00:00.000Z
CVE-2018-18699 
An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T16:00:00.000Z
CVE-2018-18700 
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T16:00:00.000Z
CVE-2018-18701 
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T16:00:00.000Z
CVE-2018-18702 
spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, and used for database insertion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T19:00:00.000Z
CVE-2018-18703 
PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal, bypassing the login page, as demonstrated by the Mailserver_filesystem/home.php coninb, consent, contrsh, condrft, or conspam parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T19:00:00.000Z
CVE-2018-18704 
PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T19:00:00.000Z
CVE-2018-18705 
PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T19:00:00.000Z
CVE-2018-18706 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function "fromDhcpListClient" for a request, it is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T22:00:00.000Z
CVE-2018-18707 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "ssid" parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T22:00:00.000Z
CVE-2018-18708 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function "fromAddressNat" for a post request, the value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T22:00:00.000Z
CVE-2018-18709 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "firewallEn" parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T22:00:00.000Z
CVE-2018-18710 
An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T22:00:00.000Z
CVE-2018-18711 
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T22:00:00.000Z
CVE-2018-18712 
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T22:00:00.000Z
CVE-2018-18713 
The function down_sql_action() in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=down_sql&name=../ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-27T22:00:00.000Z
CVE-2018-18714 
RegFilter.sys in IOBit Malware Fighter 6.2 and earlier is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0x8006E010. This can lead to denial of service (DoS) or code execution with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-18715 
Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18716 
Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18717 
An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=[XSS] URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18718 
An issue was discovered in gThumb through 3.6.2. There is a double-free vulnerability in the add_themes_from_dir method in dlg-contact-sheet.c because of two successive calls of g_free, each of which frees the same buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18720 
An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18721 
An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18722 
An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18723 
An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18724 
An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18725 
An XSS issue was discovered in admin/banner/editbanner?id=20 in YUNUCMS 1.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18726 
An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18727 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceList' parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18728 
An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. They allow remote code execution via shell metacharacters in the usbName field to the __fastcall function with a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18729 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a heap-based buffer overflow vulnerability in the router's web server -- httpd. While processing the 'mac' parameter for a post request, the value is directly used in a strcpy to a variable placed on the heap, which can leak sensitive information or even hijack program control flow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18730 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request, each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18731 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceMac' parameter for a post request, the value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18732 
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'ntpServer' parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T00:00:00.000Z
CVE-2018-18733 
An XSS issue was discovered in Catfish CMS 4.8.30, related to "write source code," a similar issue to CVE-2018-13999.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18734 
A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18735 
A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18736 
An XSS issue was discovered in catfish blog 2.0.33, related to "write source code."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18737 
An XXE issue was discovered in Douchat 4.0.4 because Data\notify.php calls simplexml_load_string. This can also be used for SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18738 
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Categories.php?pid=1&lgid=1 category_key parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18739 
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18740 
An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18741 
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Download.php?lgid=1 during editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18742 
A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18743 
An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18744 
An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS_Main.php URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18745 
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18748 
Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE: the vendor disputes this issue because the observed behavior is consistent with the product's intended functionality
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18749 
data-tools through 2017-07-26 has an Integer Overflow leading to an incorrect end value for the write_wchars function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2018-18751 
An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T17:00:00.000Z
CVE-2018-18752 
Webiness Inventory 2.3 suffers from an Arbitrary File upload vulnerability via PHP code in the protected/library/ajax/WsSaveToModel.php logo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T17:00:00.000Z
CVE-2018-18753 
Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T17:00:00.000Z
CVE-2018-18754 
ZyXEL VMG3312-B10B 1.00(AAPP.7) devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/default.cfg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T17:00:00.000Z
CVE-2018-18755 
K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/update user_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18756 
Local Server 1.0.9 has a Buffer Overflow via crafted data on Port 4008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18757 
Open Faculty Evaluation System 5.6 for PHP 5.6 allows submit_feedback.php SQL Injection, a different vulnerability than CVE-2018-18758.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T15:40:24.000Z
CVE-2018-18758 
Open Faculty Evaluation System 7 for PHP 7 allows submit_feedback.php SQL Injection, a different vulnerability than CVE-2018-18757.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T15:30:23.000Z
CVE-2018-18759 
Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18760 
RhinOS 3.0 build 1190 allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18761 
SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18762 
SaltOS 3.1 r8126 contains a database download vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:17:52.000Z
CVE-2018-18763 
SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18764 
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T19:00:00.000Z
CVE-2018-18765 
An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T19:00:00.000Z
CVE-2018-18766 
An elevation of privilege vulnerability exists in the Call Dispatcher in Provisio SiteKiosk before 9.7.4905.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T20:19:07.000Z
CVE-2018-18767 
An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-18771 
An issue was discovered in LuLu CMS through 2015-05-14. backend\modules\filemanager\controllers\DefaultController.php allows arbitrary file upload by entering a filename, directory name, and PHP code into the three text input fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T02:00:00.000Z
CVE-2018-18772 
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z