rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-18773 
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18774 
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18775 
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter.  NOTE: this is a deprecated product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-18776 
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the admin/admin.asp ShowAll parameter.  NOTE: this is a deprecated product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-18777 
Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application.  NOTE: this is a deprecated product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-18778 
ACME mini_httpd before 1.30 lets remote users read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T02:00:00.000Z
CVE-2018-18781 
DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18782 
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18783 
XSS was discovered in SEMCMS V3.4 via the semcms_remail.php?type=ok umail parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18784 
An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. (This needs an admin user login.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18785 
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/subzs.php with a zzcmscpid cookie to zs/search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18786 
An issue was discovered in zzcms 8.3. SQL Injection exists in ajax/zs.php via a pxzs cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18787 
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs.php via a pxzs cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18788 
An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. (This needs an admin user login.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18789 
An issue was discovered in zzcms 8.3. SQL Injection exists in zt/top.php via a Host HTTP header to zt/news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18790 
An issue was discovered in zzcms 8.3. SQL Injection exists in admin/special_add.php via a zxbigclassid cookie. (This needs an admin user login.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18791 
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18792 
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs_list.php via a pxzs cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T05:00:00.000Z
CVE-2018-18793 
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18794 
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18795 
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18796 
Library Management System 1.0 has SQL Injection via the "Search for Books" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18797 
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18798 
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:33:58.000Z
CVE-2018-18799 
School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18800 
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-14T14:13:25.000Z
CVE-2018-18801 
The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=[SQL] or index.php?q=single-item&id=[SQL].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18802 
The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod_users/controller.php?action=edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T15:20:05.000Z
CVE-2018-18803 
Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18804 
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18805 
Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18806 
School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T18:00:00.000Z
CVE-2018-18807 TIBCO Statistica Server Vulnerable to Cross Site Scripting
The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and including 13.4.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an authenticated user could escalate privileges to gain administrative access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Statistica Server
Published: 2018-11-26T20:00:00.000Z
CVE-2018-18808 TIBCO JasperReports Server Privilege Escalation Via Race Condition
The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility of gaining system admin access to the JasperReports Server process.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Reporting and Analytics for AWS
Published: 2019-03-07T22:00:00.000Z
CVE-2018-18809 TIBCO JasperReports Library Directory Traversal Vulnerability
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a web server using the provided DefaultWebResourceHandler could expose details of the host system. The disclosed data could include credentials to access other systems.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Reporting and Analytics for AWS
Credits: lang: en
value: TIBCO would like to extend its appreciation to Elar Lang of Clarified Security and Sathish Kumar Balakrishnan from Cyber Security Works Pvt Ltd for discovery of this vulnerability.
Published: 2019-03-07T22:00:00.000Z
CVE-2018-18810 TIBCO Managed File Transfer Credentials Disclosure
The Administrator Service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, and TIBCO Managed File Transfer Internet Server contains vulnerabilities where an authenticated user with specific privileges can gain access to credentials to other systems. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions up to and including 7.3.2; 8.0.0; 8.0.1; 8.0.2; 8.1.0, and TIBCO Managed File Transfer Internet Server: versions up to and including 7.3.2; 8.0.0; 8.0.1; 8.0.2; 8.1.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an authenticated user with specific kinds of privileges could view credentials used to access other services, when they should not be able to do so.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Command Center
vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Internet Server
Published: 2018-12-11T20:00:00.000Z
CVE-2018-18812 TIBCO Spotfire Fails To Prevent Write Access to Spotfire Library
The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when the Spotfire Library is configured to use external storage. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace versions up to and including 10.0.0, and TIBCO Spotfire Server versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0; 10.0.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a user with read-only access to the Spotfire Library can modify files stored in the Library. With that capability, among other possibilities, an attack could undermine the integrity of analysis results.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server versions
Published: 2019-01-16T22:00:00.000Z
CVE-2018-18813 TIBCO Spotfire Reflected and Persistent Cross-Site Scripting Vulnerabilities
The Spotfire web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains multiple vulnerabilities that may allow persistent and reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.0.0, and TIBCO Spotfire Server: versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0; 10.0.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an unauthenticated attacker could perform administrative functions provided by the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
Published: 2019-01-16T22:00:00.000Z
CVE-2018-18814 TIBCO Spotfire Authentication Vulnerability
The TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability in the handling of the authentication that theoretically may allow an attacker to gain full access to a target account, independent of configured authentication mechanisms. Affected releases are TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.0.0, and TIBCO Spotfire Server: versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an unauthenticated attacker could gain administrative access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
Published: 2019-01-16T22:00:00.000Z
CVE-2018-18815 TIBCO JasperReports Server User Information Disclosure
The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility of unauthenticated read access to the contents of the host system, when combined with the vulnerability identified by CVE-2018-18809.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Reporting and Analytics for AWS
Credits: lang: en
value: TIBCO would like to extend its appreciation to Steven Seeley (mr_me) of Source Incite working with Trend Micro Zero Day Initiative for discovery of this vulnerability.
Published: 2019-03-07T22:00:00.000Z
CVE-2018-18816 TIBCO JasperReports Persistent Cross Site Scripting Vulnerability
The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS contains a persistent cross site scripting vulnerability. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi- Tenancy versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a malicious actor could gain full access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
product: TIBCO Jaspersoft Reporting and Analytics for AWS
Published: 2019-03-07T22:00:00.000Z
CVE-2018-18817 
The Leostream Agent before Build 7.0.1.0 when used with Leostream Connection Broker 8.2.72 or earlier allows remote attackers to modify registry keys via the Leostream Agent API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-30T01:00:00.000Z
CVE-2018-18819 
A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creation of unauthorized chat sessions, due to insufficient access controls. A successful exploit could allow execution of arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T13:51:36.000Z
CVE-2018-18820 
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T19:00:00.000Z
CVE-2018-18822 
Grapixel New Media v2.0 allows SQL Injection via the pages.aspx pageref parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-30T06:00:00.000Z
CVE-2018-18823 
WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T19:45:48.000Z
CVE-2018-18824 
WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T19:50:27.000Z
CVE-2018-18825 
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-30T06:00:00.000Z
CVE-2018-18826 
There exists a heap-based buffer overflow in vc1_decode_p_mb_intfi in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-of-service via a crafted aac file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-30T06:00:00.000Z
CVE-2018-18827 
There exists a heap-based buffer over-read in ff_vc1_pred_dc in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-of-service via a crafted aac file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-30T06:00:00.000Z
CVE-2018-18828 
There exists a heap-based buffer overflow in vc1_decode_i_block_adv in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-of-service via a crafted aac file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-30T06:00:00.000Z
CVE-2018-18829 
There exists a NULL pointer dereference in ff_vc1_parse_frame_header_adv in vc1.c in Libav 12.3, which allows attackers to cause a denial-of-service through a crafted aac file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-30T06:00:00.000Z