rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-20571 
DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\Config\config.ini.php to read the global configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T16:00:00.000Z
CVE-2018-20572 
WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T16:00:00.000Z
CVE-2018-20573 
The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T16:00:00.000Z
CVE-2018-20574 
The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T16:00:00.000Z
CVE-2018-20575 
Orange Livebox 00.96.320S devices have an undocumented /system_firmwarel.stm URI for manual firmware update. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T17:00:00.000Z
CVE-2018-20576 
Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phone_test.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T17:00:00.000Z
CVE-2018-20577 
Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewall_SPI.exe, cgi-bin/setup_remote_mgmt.exe, cgi-bin/setup_pass.exe, and cgi-bin/upgradep.exe CSRF. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T17:00:00.000Z
CVE-2018-20578 
An issue was discovered in NuttX before 7.27. The function netlib_parsehttpurl() in apps/netutils/netlib/netlib_parsehttpurl.c mishandles URLs longer than hostlen bytes (in the webclient, this is set by default to 40), leading to an Infinite Loop. The attack vector is the Location header of an HTTP 3xx response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T18:00:00.000Z
CVE-2018-20579 
Contiki-NG before 4.2 has a stack-based buffer overflow in the push function in os/lib/json/jsonparse.c that allows an out-of-bounds write of an '{' or '[' character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-28T18:00:00.000Z
CVE-2018-20580 
The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-03T19:57:55.000Z
CVE-2018-20582 
The GREE+ (aka com.gree.greeplus) application 1.4.0.8 for Android suffers from Cross Site Request Forgery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T19:20:48.000Z
CVE-2018-20583 
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T05:00:00.000Z
CVE-2018-20584 
JasPer 2.0.14 allows remote attackers to cause a denial of service (application hang) via an attempted conversion to the jp2 format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T05:00:00.000Z
CVE-2018-20586 
bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T20:34:08.000Z
CVE-2018-20587 
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T12:00:00.000Z
CVE-2018-20588 
lib/support/unicodeconv/unicodeconv.c in libotfcc.a in otfcc v0.10.3-alpha has a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T14:00:00.000Z
CVE-2018-20589 
Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/add_pictures.php article ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T18:00:00.000Z
CVE-2018-20590 
Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/users.php user ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T18:00:00.000Z
CVE-2018-20591 
A heap-based buffer over-read was discovered in decompileJUMP function in util/decompile.c of libming v0.4.8. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by swftocxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T18:00:00.000Z
CVE-2018-20592 
In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted xml file, as demonstrated by mxmldoc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T18:00:00.000Z
CVE-2018-20593 
In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan_file function in mxmldoc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T18:00:00.000Z
CVE-2018-20594 
An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T18:00:00.000Z
CVE-2018-20595 
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T18:00:00.000Z
CVE-2018-20596 
Jspxcms v9.0.0 allows SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T18:00:00.000Z
CVE-2018-20597 
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20598 
UCMS 1.4.7 has ?do=user_addpost CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20599 
UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20600 
sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20601 
UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20602 
Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20603 
Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20604 
Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/*web*..*..*..*..*1.txt.html URI to read the 1.txt file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20605 
imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20606 
imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20607 
imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20608 
imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20609 
imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20610 
imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20611 
imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20612 
UWA 2.3.11 allows index.php?g=admin&c=admin&a=add_admin_do CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20613 
TEMMOKU T1.09 Beta allows admin/user/add CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20614 
public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install/#/step3 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-30T21:00:00.000Z
CVE-2018-20615 
An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T16:11:36.000Z
CVE-2018-20616 
ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_wav_decode_ms_adpcm_data function in ok_wav.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T13:00:00.000Z
CVE-2018-20617 
ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_csv_decode2 function in ok_csv.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T14:00:00.000Z
CVE-2018-20618 
ok-file-formats through 2018-10-16 has a heap-based buffer over-read in the ok_mo_decode2 function in ok_mo.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T15:00:00.000Z
CVE-2018-20621 
An issue was discovered in Microvirt MEmu 6.0.6. The MemuService.exe service binary is vulnerable to local privilege escalation through binary planting due to insecure permissions set at install time. This allows code to be run as NT AUTHORITY/SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-13T06:00:00.000Z
CVE-2018-20622 
JasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "--output-format jp2" is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T19:00:00.000Z
CVE-2018-20623 
In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archive function in readelf.c via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T19:00:00.000Z
CVE-2018-20626 
PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T15:55:54.000Z
CVE-2018-20627 
PHP Scripts Mall Consumer Reviews Script 4.0.3 has HTML injection via the search box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T16:25:53.000Z
CVE-2018-20628 
PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T16:31:33.000Z
CVE-2018-20629 
PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T16:35:05.000Z
CVE-2018-20630 
PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T16:38:02.000Z
CVE-2018-20631 
PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:11:01.000Z
CVE-2018-20632 
PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:15:18.000Z
CVE-2018-20633 
PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:20:51.000Z
CVE-2018-20634 
PHP Scripts Mall Advance B2B Script 2.1.4 allows remote attackers to cause a denial of service (changed Page structure) via JavaScript code in the First Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:35:55.000Z
CVE-2018-20635 
PHP Scripts Mall Advance B2B Script 2.1.4 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:40:15.000Z
CVE-2018-20636 
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:43:18.000Z
CVE-2018-20637 
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 allows remote attackers to cause a denial of service (unrecoverable blank profile) via crafted JavaScript code in the First Name and Last Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:46:28.000Z
CVE-2018-20638 
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:49:14.000Z
CVE-2018-20639 
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has HTML injection via the Search Bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:54:54.000Z
CVE-2018-20640 
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T18:58:02.000Z
CVE-2018-20641 
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:00:45.000Z
CVE-2018-20642 
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 allows remote attackers to cause a denial of service (outage of profile editing) via crafted JavaScript code in the KeySkills field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:03:25.000Z
CVE-2018-20643 
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:07:12.000Z
CVE-2018-20644 
PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:09:36.000Z
CVE-2018-20645 
PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:12:45.000Z
CVE-2018-20646 
PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:21:07.000Z
CVE-2018-20647 
PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:23:48.000Z
CVE-2018-20648 
PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:26:04.000Z
CVE-2018-20650 
A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-01T16:00:00.000Z
CVE-2018-20651 
A NULL pointer dereference was discovered in elf_link_add_object_symbols in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.1. This occurs for a crafted ET_DYN with no program headers. A specially crafted ELF file allows remote attackers to cause a denial of service, as demonstrated by ld.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-01T16:00:00.000Z
CVE-2018-20652 
An attempted excessive memory allocation was discovered in the function tinyexr::AllocateImage in tinyexr.h in tinyexr v0.9.5. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted input, which leads to an out-of-memory exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-01T16:00:00.000Z
CVE-2018-20655 
When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for iOS prior to v2.18.90.24 and WhatsApp Business for iOS prior to v2.18.90.24.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow (CWE-121)
Affected products: vendor: Facebook
product: WhatsApp for iOS
vendor: Facebook
product: WhatsApp Business for iOS
Published: 2019-06-14T17:02:57.000Z
CVE-2018-20657 
The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T14:00:00.000Z
CVE-2018-20658 
The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon crash) via a crafted XRMD command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T15:00:00.000Z
CVE-2018-20659 
An issue was discovered in Bento4 1.5.1-627. The AP4_StcoAtom class in Core/Ap4StcoAtom.cpp has an attempted excessive memory allocation when called from AP4_AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp, as demonstrated by mp42hls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T17:00:00.000Z
CVE-2018-20662 
In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T13:00:00.000Z
CVE-2018-20663 
The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T18:00:00.000Z
CVE-2018-20664 
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T18:00:00.000Z
CVE-2018-20669 
An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T16:33:59.000Z