rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-6461 
March Hare WINCVS before 2.8.01 build 6610, and CVS Suite before 2009R2 build 6610, contains an Insecure Library Loading vulnerability in the wincvs2.exe or wincvs.exe file, which may allow local users to gain privileges via a Trojan horse Python or TCL DLL file in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T07:00:00.000Z
CVE-2018-6462 
Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 bpc instead of 8 bpc, which might allow remote attackers to execute arbitrary code via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T18:00:00.000Z
CVE-2018-6464 
Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T18:00:00.000Z
CVE-2018-6465 
The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T18:00:00.000Z
CVE-2018-6466 
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_set parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T14:00:00.000Z
CVE-2018-6467 
The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T14:00:00.000Z
CVE-2018-6468 
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_id parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T14:00:00.000Z
CVE-2018-6469 
A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_tags parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T14:00:00.000Z
CVE-2018-6470 
Nibbleblog 4.0.5 on macOS defaults to having .DS_Store in each directory, causing DS_Store information to leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T13:00:00.000Z
CVE-2018-6471 
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402078.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T19:00:00.000Z
CVE-2018-6472 
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40204c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T19:00:00.000Z
CVE-2018-6473 
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402080.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T19:00:00.000Z
CVE-2018-6474 
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402148.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T19:00:00.000Z
CVE-2018-6475 
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T19:00:00.000Z
CVE-2018-6476 
In SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYSTEM because of not validating input values from IOCtl 0x9C402114 or 0x9C402124 or 0x9C40207c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T19:00:00.000Z
CVE-2018-6479 
An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T20:00:00.000Z
CVE-2018-6480 
A type confusion issue was discovered in CCN-lite 2, leading to a memory access violation and a failure of the nonce feature (which, for example, helped with loop prevention). ccnl_fwd_handleInterest assumes that the union member s is of type ccnl_pktdetail_ndntlv_s. However, if the type is in fact struct ccnl_pktdetail_ccntlv_s or struct ccnl_pktdetail_iottlv_s, the memory at that point is either uninitialised or points to data that is not a nonce, which renders the code using the local variable nonce pointless. A later nonce check is insufficient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T20:00:00.000Z
CVE-2018-6481 
A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to TCP port 9124.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T19:00:00.000Z
CVE-2018-6484 
In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T05:00:00.000Z
CVE-2018-6485 
An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T14:00:00.000Z
CVE-2018-6486 MFSBGN03797 rev.1 - Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), XML External Entity Injection
XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16.20, 17.10. This vulnerability could be exploited to allow a XML External Entity (XXE) injection.
Problem types: description: XML External Entity (XXE)
Affected products: vendor: Micro Focus
product: Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC)
Credits: lang: en
value: Micro Focus would like to thank Jakub Palaczynski for reporting this issue to security-alert@hpe.com
Published: 2018-02-02T14:00:00.000Z
CVE-2018-6487 MFSBGN03799 rev.1 - Micro Focus UCMDB, Remote Disclosure of Information
Remote Disclosure of Information in Micro Focus Universal CMDB Foundation Software, version numbers 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 4.10, 4.11. This vulnerability could be remotely exploited to allow disclosure of information.
Problem types: description: Remote Disclosure of Information
Affected products: vendor: Micro Focus
product: Universal CMDB Foundation Software
Published: 2018-02-20T21:00:00.000Z
CVE-2018-6488 MFSBGN03798 rev.1 - Micro Focus Universal CMDB, Apache Struts Instance
Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB, version 4.10, 4.11, 4.12. This vulnerability could be remotely exploited to allow Arbitrary Code Execution.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Micro Focus
product: Micro Focus Universal CMDB
Credits: lang: en
value: Micro Focus would like to thank Chethan K and Sharp Rodney for reporting this issue to cyber-psrt@microfocus.com
Published: 2018-02-22T22:00:00.000Z
CVE-2018-6489 
XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML External Entity (XXE)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-22T22:00:00.000Z
CVE-2018-6490 MFSBGN03801 rev.1 - Micro Focus Operations Orchestration, Remote Denial of Service (DoS)
Denial of Service vulnerability in Micro Focus Operations Orchestration Software, version 10.x. This vulnerability could be remotely exploited to allow Denial of Service.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: Micro Focus
product: Operations Orchestration Software
Credits: lang: en
value: Micro Focus would like to thank Jacob Baines of Tenable for reporting this issue to security-alert@hpe.com
Published: 2018-03-02T01:00:00.000Z
CVE-2018-6491 MFSBGN03803 rev.1 - UCMDB, Installation File Access Control Privilege Escalation Vulnerability
Local Escalation of Privilege vulnerability to Micro Focus Universal CMDB, versions 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.00. The vulnerability could be remotely exploited to Local Escalation of Privilege.
Problem types: description: Local Escalation of Privilege
Affected products: vendor: Micro Focus
product: Universal CMDB
Credits: lang: en
value: Micro Focus would like to thank TrendyTofu of Trend Micro's Zero Day Initiative for reporting this issue to cyber-psrt@microfocus.com.
Published: 2018-04-23T21:00:00.000Z
CVE-2018-6492 MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple Vulnerabilities
Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow persistent cross-site scripting, and non-persistent HTML Injection.
Problem types: description: Remote Cross-Site Scripting (XSS)
description: non-persistent HTML Injection
Affected products: vendor: Micro Focus
product: Network Operations Management Ultimate
vendor: Micro Focus
product: Network Automation
Credits: lang: en
value: Micro Focus would like to thank Tilman Bender, Dennis Herrmann and Bastian Kanbach of Context Information Security GmbH for reporting this issue to cyber-psrt@microfocus.com.
Published: 2018-05-22T19:00:00.000Z
CVE-2018-6493 MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple Vulnerabilities
SQL Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow Remote SQL Injection.
Problem types: description: SQL Injection
Affected products: vendor: Micro Focus
product: Network Operations Management Ultimate
vendor: Micro Focus
product: Network Automation
Credits: lang: en
value: Micro Focus would like to thank Tilman Bender, Dennis Herrmann and Bastian Kanbach of Context Information Security GmbH for reporting this issue to cyber-psrt@microfocus.com.
Published: 2018-05-22T19:00:00.000Z
CVE-2018-6494 MFSBGN03807 rev.1 - HP Service Manager Software, Multiple Vulnerabilities
Remote SQL Injection against the HP Service Manager Software Web Tier, version 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, may lead to unauthorized disclosure of data.
Problem types: description: Remote SQL Injection
Affected products: vendor: Micro Focus
product: HP Service Manager Software
Published: 2018-05-22T18:00:00.000Z
CVE-2018-6495 MFSBGN03808 rev.1 - Micro Focus UCMDB, Cross-Site Scripting
Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS).
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: Micro Focus
product: UCMDB
vendor: Micro Focus
product: CMS Server 2018.05
vendor: Micro Focus
product: UCMDB Browser
Credits: lang: en
value: Micro Focus would like to thank Bharath Kumar Pyaneni for reporting this issue to cyber-psrt@microfocus.com.
Published: 2018-05-23T18:00:00.000Z
CVE-2018-6496 MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF
Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).
Problem types: description: cross-site request forgery (CSRF)
Affected products: vendor: Micro Focus
product: UCMDB Browser
Credits: lang: en
value: Micro Focus would like to thank Mateusz Garncarek for reporting this issue to cyber-psrt@microfocus.com.
Published: 2018-06-15T21:00:00.000Z
CVE-2018-6497 MFSBGN03810 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF
Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31, 10.32, 10.33, 10.33 CUP2, 11.0 and CMS Server version 2018.05 BACKGROUND which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).
Problem types: description: cross-site request forgery (CSRF)
Affected products: vendor: Micro Focus
product: Universal CMDB Server
vendor: Micro Focus
product: CMS Server
Credits: lang: en
value: Micro Focus would like to thank Mateusz Garncarek for reporting this issue to cyber-psrt@microfocus.com.
Published: 2018-06-15T21:00:00.000Z
CVE-2018-6498 Micro Focus Container Deployment Foundation (CDF), Remote Code Execution
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
Problem types: description: Remote Code Execution
Affected products: vendor: Micro Focus
product: Network Operations Management (NOM) Suite CDF
vendor: Micro Focus
product: Service Management Automation Suite
vendor: Micro Focus
product: Data Center Automation Containerized Suite
vendor: Micro Focus
product: Operations Bridge Containerized Suite
vendor: Micro Focus
product: Hybrid Cloud Management Containerized Suite
Published: 2018-08-30T21:00:00.000Z
CVE-2018-6499 
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
Problem types: description: Remote Code Execution
Affected products: vendor: Micro Focus
product: Network Operations Management (NOM) Suite CDF
vendor: Micro Focus
product: Service Management Automation Suite
vendor: Micro Focus
product: Data Center Automation Containerized Suite
vendor: Micro Focus
product: Operations Bridge Containerized Suite
vendor: Micro Focus
product: Hybrid Cloud Management Containerized Suite
vendor: Micro Focus
product: Network Virtualization (NV) with floating licenses
vendor: Micro Focus
product: Unified Functional Testing (UFT) with floating licenses
vendor: Micro Focus
product: Service Virtualization (SV) with floating licenses
Published: 2018-08-30T21:00:00.000Z
CVE-2018-6500 MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability
A potential Directory Traversal Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be remotely exploited to allow Directory Traversal.
Problem types: description: Directory Traversal
Affected products: vendor: Micro Focus
product: ArcSight Management Center
Credits: lang: en
value: Micro Focus would like to thank Vahagn Vardanyan for reporting the Directory Traversal Vulnerability to cyber-psrt@microfocus.com.
Published: 2018-09-20T16:00:00.000Z
CVE-2018-6501 
Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center (ArcMC) for versions prior to 2.81. This vulnerability could be exploited to allow for insufficient access controls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-20T16:00:00.000Z
CVE-2018-6502 MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability
A potential Reflected Cross-Site Scripting (XSS) Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Reflected Cross-site Scripting (XSS).
Problem types: description: Reflected Cross-Site Scripting (XSS)
Affected products: vendor: Micro Focus
product: ArcSight Management Center
Credits: lang: en
value: Micro Focus would like to thank Andy Tan for reporting the Insufficient Access Control, Access Control Vulnerability, Reflected Cross Site Scripting, Cross-Site Request Forgery (CSRF), and Unauthenticated File Download vulnerabilities to cyber-psrt@microfocus.com.
Published: 2018-09-20T19:00:00.000Z
CVE-2018-6503 MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability
A potential Access Control vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for vulnerable Access Controls.
Problem types: description: Access Control Vulnerability
Affected products: vendor: Micro Focus
product: ArcSight Management Center
Credits: lang: en
value: Micro Focus would like to thank Andy Tan for reporting the Insufficient Access Control, Access Control Vulnerability, Reflected Cross Site Scripting, Cross-Site Request Forgery (CSRF), and Unauthenticated File Download vulnerabilities to cyber-psrt@microfocus.com.
Published: 2018-09-20T19:00:00.000Z
CVE-2018-6504 MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability
A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF).
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Micro Focus
product: ArcSight Management Center
Credits: lang: en
value: Micro Focus would like to thank Andy Tan for reporting the Insufficient Access Control, Access Control Vulnerability, Reflected Cross Site Scripting, Cross-Site Request Forgery (CSRF), and Unauthenticated File Download vulnerabilities to cyber-psrt@microfocus.com.
Published: 2018-09-20T19:00:00.000Z
CVE-2018-6505 MFSBGN03824 rev.1 - ArcSight Management Center, Insufficient Access Control, Reflected Cross Site Scripting, Access Control vulnerability, Cross-Site Request Forgery (CSRF), Unauthenticated File Download, Directory Traversal Vulnerability
A potential Unauthenticated File Download vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Unauthenticated File Downloads.
Problem types: description: Unauthenticated File Download
Affected products: vendor: Micro Focus
product: ArcSight Management Center
Credits: lang: en
value: Micro Focus would like to thank Andy Tan for reporting the Insufficient Access Control, Access Control Vulnerability, Reflected Cross Site Scripting, Cross-Site Request Forgery (CSRF), and Unauthenticated File Download vulnerabilities to cyber-psrt@microfocus.com.
Published: 2018-09-20T19:00:00.000Z
CVE-2018-6506 
Cross-Site Scripting (XSS) exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use of an onload attribute of an SVG element in the supertitle field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T04:00:00.000Z
CVE-2018-6508 
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.
Problem types: description: Remote Code Execution
Affected products: vendor: Puppet
product: Puppet Enterprise
vendor: Puppet
product: puppetlabs/facter_task
vendor: Puppet
product: puppetlabs/puppet_conf
vendor: Puppet
product: puppetlabs/apt
vendor: Puppet
product: puppetlabs/mysql
vendor: Puppet
product: puppetlabs/apache
Published: 2018-02-09T20:00:00.000Z
CVE-2018-6510 XSS Vulnerability in Puppet Enterprise Console
A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Orchestrator. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6.
Problem types: description: Cross-site scripting
Affected products: vendor: Puppet
product: Puppet Enterprise
Published: 2018-05-08T18:00:00.000Z
CVE-2018-6511 XSS Vulnerability in Puppet Enterprise Console
A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6.
Problem types: description: Cross-site scripting
Affected products: vendor: Puppet
product: Puppet Enterprise
Published: 2018-05-08T18:00:00.000Z
CVE-2018-6512 
The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions prior to 2018.1.1 and razor-server and pe-razor-server prior to 1.9.0.0.
Problem types: description: Insecure Temporary File
Affected products: vendor: Puppet
product: Puppet Enterprise 2018.1.x prior to 2018.1.1, razor-server and pe-razor-server prior to 1.9.0.0
Published: 2018-06-11T20:00:00.000Z