rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-9209 
Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2
Problem types: description: FineUploader php-traditional-server <= v1.2.2 unauthenticated arbitrary file upload vulnerability
Affected products: vendor: FineUploader
product: FineUploader php-traditional-server
Published: 2018-11-19T18:00:00.000Z
CVE-2018-9230 
In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall (ngx_lua_waf or X-WAF) products. NOTE: the vendor has reported that 100 parameters is an intentional default setting, but is adjustable within the API. The vendor's position is that a security-relevant misuse of the API by a WAF product is a vulnerability in the WAF product, not a vulnerability in OpenResty
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-02T18:00:00.000Z
CVE-2018-9232 
Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmware and use it as an update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T18:00:00.000Z
CVE-2018-9233 
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-05T17:00:00.000Z
CVE-2018-9234 
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T00:00:00.000Z
CVE-2018-9235 
iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9236 
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9237 
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9238 
proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9240 
ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message, a crash and denial of service could occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T22:00:00.000Z
CVE-2018-9242 
The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-9243 
GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads to cross site scripting (specifically, filenames in changes tabs of merge requests). This is fixed in 10.6.3, 10.5.7, and 10.4.7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-05T14:00:00.000Z
CVE-2018-9244 
GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3, 10.5.7, and 10.4.7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-05T14:00:00.000Z
CVE-2018-9245 
The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypass the login page and execute remote code on the operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-22T13:00:00.000Z
CVE-2018-9246 
The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-08T01:00:00.000Z
CVE-2018-9247 
The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql parameter. Consequently, an attacker can execute arbitrary PHP code by placing it after a <?php substring, and then using INTO OUTFILE with a .php filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T00:00:00.000Z
CVE-2018-9248 
FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T15:00:00.000Z
CVE-2018-9249 
FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the response to an unauthenticated request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T15:00:00.000Z
CVE-2018-9250 
interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-18T14:00:00.000Z
CVE-2018-9251 
The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T02:00:00.000Z
CVE-2018-9252 
JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T02:00:00.000Z
CVE-2018-9256 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. This was addressed in epan/dissectors/packet-lwapp.c by limiting the encapsulation levels to restrict the recursion depth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9257 
In Wireshark 2.4.0 to 2.4.5, the CQL dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-cql.c by checking for a nonzero number of columns.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9258 
In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9259 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dissector could crash. This was addressed in epan/dissectors/file-mp4.c by restricting the box recursion depth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9260 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was addressed in epan/dissectors/packet-ieee802154.c by ensuring that an allocation step occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9261 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-nbap.c by prohibiting the self-linking of DCH-IDs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9262 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash. This was addressed in epan/dissectors/packet-vlan.c by limiting VLAN tag nesting to restrict the recursion depth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9263 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash. This was addressed in epan/dissectors/packet-kerberos.c by ensuring a nonzero key length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9264 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the ADB dissector could crash with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-adb.c by checking for a length inconsistency.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9265 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-tn3270.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9266 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-isup.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9267 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-lapd.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9268 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-smb2.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9269 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-giop.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9270 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9271 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9272 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-h223.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9273 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9274 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure_message.c has a memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T07:00:00.000Z
CVE-2018-9275 
In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or DoS (reaching the maximum number of file descriptors).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T18:00:00.000Z
CVE-2018-9276 
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T16:00:00.000Z
CVE-2018-9279 
An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be retrieved by browsing the source code of the webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T21:00:00.000Z
CVE-2018-9280 
An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance contains the password in cleartext. Passwords of the read and write users could be retrieved by browsing the source code of the webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T21:00:00.000Z
CVE-2018-9281 
An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable to Reflected Cross-Site Scripting vulnerabilities. This flaw could be triggered by driving an administrator logged into the Eaton application to a specially crafted web page. This attack could be done silently.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T21:00:00.000Z
CVE-2018-9282 
An XSS issue was discovered in Subsonic Media Server 6.1.1. The podcast subscription form is affected by a stored XSS vulnerability in the add parameter to podcastReceiverAdmin.view; no administrator access is required. By injecting a JavaScript payload, this flaw could be used to manipulate a user's session, or elevate privileges by targeting an administrative user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T16:00:00.000Z
CVE-2018-9283 
An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters in the contact creation and modification page. The payload is stored within the application database and allows the execution of JavaScript code each time a client visit an infected page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2018-9284 
authentication.cgi on D-Link DIR-868L devices with Singapore StarHub firmware before v1.21SHCb03 allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T19:00:00.000Z
CVE-2018-9285 
Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; RT-N18U devices before 3.0.0.4.382.39935; RT-AC87U and RT-AC3200 devices before 3.0.0.4.382.50010; and RT-AC5300 devices before 3.0.0.4.384.20287 allows OS command injection via the pingCNT and destIP fields of the SystemCmd variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T19:00:00.000Z
CVE-2018-9302 
SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about version 0.13.0, which (surprisingly) is an earlier version than 0.4.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T15:00:00.000Z
CVE-2018-9303 
In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T21:00:00.000Z
CVE-2018-9304 
In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp could result in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T21:00:00.000Z
CVE-2018-9305 
In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T21:00:00.000Z
CVE-2018-9307 
dsmall v20180320 allows XSS via the pdr_sn parameter to public/index.php/home/predeposit/index.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T21:00:00.000Z
CVE-2018-9309 
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dl_sendsms.php request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-05T01:00:00.000Z
CVE-2018-9310 
An issue was discovered in MagniComp SysInfo before 10-H82 if setuid root (the default). This vulnerability allows any local user on a Linux/UNIX system to run SysInfo and obtain a root shell, which can be used to compromise the local system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T17:00:00.000Z
CVE-2018-9311 
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T12:00:00.000Z
CVE-2018-9312 
The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows a local attack when a USB device is plugged in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T12:00:00.000Z
CVE-2018-9313 
The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows a remote attack via Bluetooth when in pairing mode, leading to a Head Unit reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T12:00:00.000Z
CVE-2018-9314 
The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows an attack by an attacker who has direct physical access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T12:00:00.000Z
CVE-2018-9318 
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T12:00:00.000Z
CVE-2018-9320 
The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows a local attack when a USB device is plugged in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T12:00:00.000Z
CVE-2018-9322 
The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows local attacks involving the USB or OBD-II interface. An attacker can bypass the code-signing protection mechanism for firmware updates, and consequently obtain a root shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T12:00:00.000Z
CVE-2018-9325 
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T21:00:00.000Z
CVE-2018-9326 
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T21:00:00.000Z
CVE-2018-9327 
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T21:00:00.000Z
CVE-2018-9328 
PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-05T19:00:00.000Z
CVE-2018-9330 
register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerability than CVE-2015-6942.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T17:00:00.000Z
CVE-2018-9331 
An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T02:00:00.000Z
CVE-2018-9332 
K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T15:31:38.000Z
CVE-2018-9333 
K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-11T15:33:44.000Z
CVE-2018-9334 
The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 may allow an attacker to access the GlobalProtect password hashes of local users via manipulation of the HTML markup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-9335 
The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z