rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-9111 
Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-10T03:00:00.000Z
CVE-2018-9112 
A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges by modifying cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-10T03:00:00.000Z
CVE-2018-9113 
Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial '><script type="text/javascript" src=' line. Fix released on 2018-03-29.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T06:00:00.000Z
CVE-2018-9115 
Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG interface. An attacker can freeze the Situational Layer, which means that the Situational Picture is no longer updated. Unfortunately, the user cannot notice until he tries to work with that layer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T19:00:00.000Z
CVE-2018-9116 
An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T07:00:00.000Z
CVE-2018-9117 
WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a specially crafted XML request, aka Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T07:00:00.000Z
CVE-2018-9118 
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T15:00:00.000Z
CVE-2018-9119 
An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T00:00:00.000Z
CVE-2018-9120 
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T05:00:00.000Z
CVE-2018-9121 
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T05:00:00.000Z
CVE-2018-9122 
In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T05:00:00.000Z
CVE-2018-9123 
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T05:00:00.000Z
CVE-2018-9126 
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T19:00:00.000Z
CVE-2018-9127 
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-02T17:00:00.000Z
CVE-2018-9128 
DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-01T07:00:00.000Z
CVE-2018-9129 
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-15T18:00:00.000Z
CVE-2018-9130 
IBOS 4.4.3 has XSS via a company full name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9132 
libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9133 
ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9134 
file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T16:00:00.000Z
CVE-2018-9135 
In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9136 
windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file, a different vulnerability than CVE-2018-8821.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9137 
Open-AudIT before 2.2 has CSV Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-19T08:00:00.000Z
CVE-2018-9138 
An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_nested_args, demangle_args, do_arg, and do_type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9139 
On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privileged process via a large frame size, aka SVE-2017-11165.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9140 
On Samsung mobile devices with M(6.0) software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE-2017-10747.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9141 
On Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software, Gallery allows remote attackers to execute arbitrary code via a BMP file with a crafted resolution, aka SVE-2017-11105.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9142 
On Samsung mobile devices with N(7.x) software, attackers can install an arbitrary APK in the Secure Folder SD Card area because of faulty validation of a package signature and package name, aka SVE-2017-10932.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9143 
On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code execution in a privileged process, aka SVE-2017-10991.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9144 
In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9145 
In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the 4-DataBuf-abort-1 PoC file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T08:00:00.000Z
CVE-2018-9147 
Cross-site scripting (XSS) vulnerabilities in version 7.5.7 of Gespage software allow remote attackers to inject arbitrary web script or HTML via the email, passwd, and repasswd parameters to webapp/users/user_reg.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T16:00:00.000Z
CVE-2018-9148 
Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a product that uses My Cloud.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T19:00:00.000Z
CVE-2018-9149 
The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-01T18:00:00.000Z
CVE-2018-9151 
A NULL pointer dereference bug in the function ObReferenceObjectByHandle in the Kingsoft Internet Security 9+ kernel driver KWatch3.sys allows local non-privileged users to crash the system via IOCTL 0x80030030.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-30T19:00:00.000Z
CVE-2018-9153 
The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directly by an administrator, or through CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-15T14:00:00.000Z
CVE-2018-9154 
There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value, a different vulnerability than CVE-2017-13745.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-04T21:00:00.000Z
CVE-2018-9155 
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (via the "Name (display)" field to the attributes/create URI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T15:00:00.000Z
CVE-2018-9156 
An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-01T18:00:00.000Z
CVE-2018-9157 
An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-01T18:00:00.000Z
CVE-2018-9158 
An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. They don't employ a suitable mechanism to prevent a DoS attack, which leads to a response time delay. An attacker can use the hping3 tool to perform an IPv4 flood attack, and the services are interrupted from attack start to end.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-01T18:00:00.000Z
CVE-2018-9159 
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-31T21:00:00.000Z
CVE-2018-9160 
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-31T21:00:00.000Z
CVE-2018-9161 
Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account by reading user/scripts/login_par.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-31T22:00:00.000Z
CVE-2018-9162 
Contec Smart Home 4.15 devices do not require authentication for new_user.php, edit_user.php, delete_user.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-31T22:00:00.000Z
CVE-2018-9163 
A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-02T12:00:00.000Z
CVE-2018-9165 
The pushdup function in util/decompile.c in libming through 0.4.8 does not recognize the need for ActionPushDuplicate to perform a deep copy when a String is at the top of the stack, making the library vulnerable to a util/decompile.c getName NULL pointer dereference, which may allow attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-01T18:00:00.000Z
CVE-2018-9169 
Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an administrator, or through CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-15T14:00:00.000Z
CVE-2018-9172 
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-01T23:00:00.000Z
CVE-2018-9173 
Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as demonstrated by the movieName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-02T03:00:00.000Z
CVE-2018-9174 
sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker's control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-02T03:00:00.000Z
CVE-2018-9175 
DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database is accessible to uploads/dede/sys_cache_up.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-02T03:00:00.000Z
CVE-2018-9177 
Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-08T01:00:00.000Z
CVE-2018-9182 
Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-08T01:00:00.000Z
CVE-2018-9183 
The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-02T15:00:00.000Z
CVE-2018-9185 
An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to client-side when pages bookmarked in web portal use the Single Sign-On feature.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: Fortinet FortiOS
Published: 2018-07-05T13:00:00.000Z
CVE-2018-9186 
A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: FortiAuthenticator
Published: 2018-05-31T22:00:00.000Z
CVE-2018-9190 
A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport driver.
Problem types: description: Denial of service
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiClientWindows
Published: 2019-02-08T19:00:00.000Z
CVE-2018-9191 
A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attackers to execute unauthorized code or commands via the named pipe responsible for Forticlient updates.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiClient for Windows
Published: 2019-05-30T16:27:18.000Z
CVE-2018-9192 
A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet, Inc.
product: FortiOS
Published: 2018-09-05T13:00:00.000Z
CVE-2018-9193 
A researcher has disclosed several vulnerabilities against FortiClient for Windows version 6.0.5 and below, version 5.6.6, the combination of these vulnerabilities can turn into an exploit chain, which allows a user to gain system privileges on Microsoft Windows.
Affected products: vendor: Fortinet
product: FortiClientWindows
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:X
Published: 2019-05-30T16:27:54.000Z
CVE-2018-9194 
A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet, Inc.
product: FortiOS
Published: 2018-09-05T13:00:00.000Z
CVE-2018-9195 
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: FortiClient for Windows
vendor: Fortinet
product: FortiOS
vendor: Fortinet
product: FortiClient for Mac OS
Published: 2019-11-21T14:59:52.000Z
CVE-2018-9205 
Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.
Problem types: description: Arbitrary file download vulnerability in Drupal module avatar_uploader v7.x-1.0-beta8
Affected products: vendor: Robbin Zhao
product: avatar_uploader
Published: 2018-04-04T15:00:00.000Z
CVE-2018-9206 
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
Problem types: description: jQuery-File-Upload <= v9.22.0 unauthenticated arbitrary file upload vulnerability
Affected products: vendor: Blueimp
product: Blueimp jQuery-File-Upload
default_status: unaffected
Credits: lang: en
value: Larry W. Cashdollar
Published: 2018-10-11T15:00:00.000Z
CVE-2018-9207 
Arbitrary file upload in jQuery Upload File <= 4.0.2
Problem types: description: Arbitrary file upload vulnerability in jQuery Upload File v4.0.2
Affected products: vendor: hayageek
product: jQuery Upload File
Published: 2018-11-19T17:00:00.000Z
CVE-2018-9208 
Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta
Problem types: description: jQuery Picture Cut <= v1.1Beta unauthenticated arbitrary file upload vulnerability
Affected products: vendor: Tuyoshi Vinicius
product: jQuery Picture Cut
Published: 2018-11-05T14:00:00.000Z