rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-6513 
Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Puppet
product: Puppet Enterprise and Puppet Agent
Published: 2018-06-11T20:00:00.000Z
CVE-2018-6514 
In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Puppet
product: Puppet Agent
Published: 2018-06-11T20:00:00.000Z
CVE-2018-6515 
Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Puppet
product: Puppet Agent
Published: 2018-06-11T20:00:00.000Z
CVE-2018-6516 
On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Puppet
product: pe-client-tools
Published: 2018-06-14T21:00:00.000Z
CVE-2018-6517 
Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.
Problem types: description: Improper handling of known_hosts file
Affected products: vendor: Puppet
product: Chloride
Published: 2019-03-17T19:14:43.000Z
CVE-2018-6518 
Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T14:00:00.000Z
CVE-2018-6519 
The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T01:00:00.000Z
CVE-2018-6520 
SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T01:00:00.000Z
CVE-2018-6521 
The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T01:00:00.000Z
CVE-2018-6522 
In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKRgFtXp.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T01:00:00.000Z
CVE-2018-6523 
In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x22045c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T01:00:00.000Z
CVE-2018-6524 
In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220c20.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T01:00:00.000Z
CVE-2018-6525 
In nProtect AVS V4.0 before 4.0.0.39, the driver file (TKFsAv.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220458.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T01:00:00.000Z
CVE-2018-6526 
view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filter_ensure_valid_filter call in current_user_api.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6527 
XSS vulnerability in htdocs/webinc/js/adv_parent_ctrl_map.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted deviceid parameter to soap.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6528 
XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted receiver parameter to soap.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6529 
XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted Treturn parameter to soap.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6530 
OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6532 
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T19:00:00.000Z
CVE-2018-6533 
An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run arbitrary code as root. This was fixed by no longer using init.conf to determine account information for any root-executed code (a larger issue than CVE-2017-16933).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T19:00:00.000Z
CVE-2018-6534 
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause the product to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T19:00:00.000Z
CVE-2018-6535 
An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T19:00:00.000Z
CVE-2018-6536 
An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for icinga2.pid modification before a root script executes a "kill `cat /pathname/icinga2.pid`" command, as demonstrated by icinga2.init.d.cmake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6537 
A buffer overflow vulnerability in the control protocol of Flexense SyncBreeze Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to TCP port 9121.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6540 
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6541 
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6542 
In ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek value) caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6543 
In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6544 
pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6545 
Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6546 
plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, executes code at a user-defined (local or SMB) path as SYSTEM when the execute_installer parameter is used in an HTTP message. This occurs without properly authenticating the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T16:00:00.000Z
CVE-2018-6547 
plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, contains an HTTP message parsing function that takes a user-defined path and writes non-user controlled data as SYSTEM to the file when the extract_files parameter is used. This occurs without properly authenticating the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-13T16:00:00.000Z
CVE-2018-6548 
A use-after-free issue was discovered in libwebm through 2018-02-02. If a Vp9HeaderParser was initialized once before, its property frame_ would not be changed because of code in vp9parser::Vp9HeaderParser::SetFrame. Its frame_ could be freed while the corresponding pointer would not be updated, leading to a dangling pointer. This is related to the function OutputCluster in webm_info.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6550 
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T09:00:00.000Z
CVE-2018-6551 
The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T14:00:00.000Z
CVE-2018-6552 Apport treats the container PID as the global PID when /proc/<global_pid>/  is missing
Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers. The is_same_ns() function returns True when /proc/<global pid>/ does not exist in order to indicate that the crash should be handled in the global namespace rather than inside of a container. However, the portion of the data/apport code that decides whether or not to forward a crash to a container does not always replace sys.argv[1] with the value stored in the host_pid variable when /proc/<global pid>/ does not exist which results in the container pid being used in the global namespace. This flaw affects versions 2.20.8-0ubuntu4 through 2.20.9-0ubuntu7, 2.20.7-0ubuntu3.7, 2.20.7-0ubuntu3.8, 2.20.1-0ubuntu2.15 through 2.20.1-0ubuntu2.17, and 2.14.1-0ubuntu3.28.
Problem types: description: Denial of service via resource exhaustion, privilege escalation, and escape from containers
Affected products: vendor: n/a
product: Apport
vendor: n/a
product: Apport
vendor: n/a
product: Apport
vendor: n/a
product: Apport
Credits: lang: en
value: Sander Bos
Published: 2018-05-31T22:00:00.000Z
CVE-2018-6553 AppArmor cupsd Sandbox Bypass Due to Use of Hard Links
The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS.
Problem types: description: Escape from sandbox confinement
Affected products: vendor: n/a
product: cups
vendor: n/a
product: cups
vendor: n/a
product: cups
vendor: n/a
product: cups
Credits: lang: en
value: Dan Bastone
Published: 2018-08-10T15:00:00.000Z
CVE-2018-6554 
Memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
Affected products: vendor: Linux Kernel
product: Linux Kernel
Published: 2018-09-04T18:00:00.000Z
CVE-2018-6555 
The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Linux Kernel
product: Linux Kernel
Published: 2018-09-04T18:00:00.000Z
CVE-2018-6556 The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files
lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above and including 2.0.9; 3.0 versions above and including 3.0.0, prior to 3.0.2.
Problem types: description: Incorrect access control
Affected products: vendor: n/a
product: LXC
Credits: lang: en
value: Matthias Gerstner from SUSE
Published: 2018-08-10T15:00:00.000Z
CVE-2018-6557 Insecure temporary file use in base-files
The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1ubuntu2.2, and Ubuntu 18.10 before 10.1ubuntu6 incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled.
Problem types: description: Insecure Temporary File
Affected products: vendor: Ubuntu
product: base-files
Credits: lang: en
value: Sander Bos
Published: 2018-08-21T16:00:00.000Z
CVE-2018-6558 
The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).
Problem types: description: n/a
Affected products: vendor: The fscrypt Project
product: fscrypt
Published: 2018-08-23T20:00:00.000Z
CVE-2018-6559 
The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: Canonical Ltd.
product: Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10
Credits: lang: en
value: Philipp Wendler
Published: 2018-10-26T17:00:00.000Z
CVE-2018-6560 
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T14:00:00.000Z
CVE-2018-6561 
dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T15:00:00.000Z
CVE-2018-6562 
totemomail Encryption Gateway before 6.0_b567 allows remote attackers to obtain sensitive information about user sessions and encryption key material via a JSONP hijacking attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-18T20:00:00.000Z
CVE-2018-6563 
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-20T14:00:00.000Z
CVE-2018-6569 
West Wind Web Server 6.x does not require authentication for /ADMIN.ASP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T00:00:00.000Z
CVE-2018-6574 
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T21:00:00.000Z
CVE-2018-6575 
SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T17:00:00.000Z
CVE-2018-6576 
SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T17:00:00.000Z
CVE-2018-6577 
SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T17:00:00.000Z
CVE-2018-6578 
SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T17:00:00.000Z
CVE-2018-6579 
SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T17:00:00.000Z
CVE-2018-6580 
Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=true&tmpl=component request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T17:00:00.000Z
CVE-2018-6581 
SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T17:00:00.000Z
CVE-2018-6582 
SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T21:00:00.000Z
CVE-2018-6583 
SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6584 
SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6585 
SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or filter_events_cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6586 
CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processing.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: CA Technologies
product: CA API Developer Portal
Published: 2018-03-29T13:00:00.000Z