rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-25081 
Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations (e.g., an apple.com IFRAME element on the icloud.com website) and that "Auto-fill on page load" is not enabled by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-08T00:00:00.000Z
CVE-2018-25082 zwczou WeChat SDK Python to_xml xml external entity reference
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
Problem types: cwe_id: CWE-611
description: CWE-611 XML External Entity Reference
Affected products: vendor: zwczou
product: WeChat SDK Python
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-03-21T18:00:05.224Z
CVE-2018-25083 
The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-27T00:00:00.000Z
CVE-2018-25084 Ping Identity Self-Service Account Manager SSAMController.java cross site scripting
A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Ping Identity
product: Self-Service Account Manager
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-04-10T18:00:05.570Z
CVE-2018-25085 Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit cross site scripting
A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsive_menus_admin_form_submit of the file responsive_menus.module of the component Configuration Setting Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 7.x-1.7 is able to address this issue. The patch is named 3c554b31d32a367188f44d44857b061eac949fb8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227755.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: Responsive Menus
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2023-05-01T05:00:03.819Z
CVE-2018-25086 sea75300 FanPress CM Template Preview templatepreview.php getArticlesPreview cross site scripting
A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.6.4 is able to address this issue. The patch is named c380d343c2107fcee55ab00eb8d189ce5e03369b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230235.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: sea75300
product: FanPress CM
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-06-01T07:00:03.743Z
CVE-2018-25087 Arborator Server project.cgi start denial of service
A vulnerability classified as problematic was found in Arborator Server. This vulnerability affects the function start of the file project.cgi. The manipulation of the argument project leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as cdbdbcbd491db65e9d697ab4365605fdfab1a604. It is recommended to apply a patch to fix this issue. VDB-230662 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-404
description: CWE-404 Denial of Service
Affected products: vendor: Arborator
product: Server
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-06-06T03:00:04.431Z
CVE-2018-25088 Blue Yonder postgraas_server PostgreSQL Backend postgres_cluster_driver.py create_postgres_db sql injection
A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function _create_pg_connection/create_postgres_db of the file postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py of the component PostgreSQL Backend Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 7cd8d016edc74a78af0d81c948bfafbcc93c937c. It is recommended to upgrade the affected component. VDB-234246 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Blue Yonder
product: postgraas_server
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-07-18T13:00:05.652Z
CVE-2018-25089 glb Meetup Tag Extension Link Attribute reverse tabnabbing
A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 850c726d6bbfe0bf270801fbb92a30babea4155c. It is recommended to upgrade the affected component. The identifier VDB-238157 was assigned to this vulnerability.
Problem types: cwe_id: CWE-1022
description: CWE-1022 Use of Web Link to Untrusted Target with window.opener Access
Affected products: vendor: glb
product: Meetup Tag Extension
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-08-28T12:31:04.889Z
CVE-2018-25090 Wago: Improper Neutralization of Input During Web Page Generation in multiple devices
An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: WAGO
product: Controller BACnet/IP
default_status: unaffected
vendor: WAGO
product: Controller BACnet MS/TP
default_status: unaffected
vendor: WAGO
product: Ethernet Controller 3rd Generation
default_status: unaffected
vendor: WAGO
product: Ethernet Controller 3rd Generation
default_status: unaffected
vendor: WAGO
product: Fieldbus Coupler Ethernet 3rd Generation
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-03-13T08:32:17.180Z
CVE-2018-25091 
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-15T00:00:00.000Z
CVE-2018-25092 Vaerys-Dawn DiscordSailv2 Command Mention access control
A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The patch is named cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244483.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Controls
Affected products: vendor: Vaerys-Dawn
product: DiscordSailv2
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-11-05T21:00:04.701Z
CVE-2018-25093 Vaerys-Dawn DiscordSailv2 Tag access control
A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The name of the patch is cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244484.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Controls
Affected products: vendor: Vaerys-Dawn
product: DiscordSailv2
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-11-06T01:00:05.912Z
CVE-2018-25094 ระบบบัญชีออนไลน์ Online Accounting System image.php path traversal
A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 9d9618422b980335bb30be612ea90f4f56cb992c. It is recommended to upgrade the affected component. The identifier VDB-246641 was assigned to this vulnerability.
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: ระบบบัญชีออนไลน์
product: Online Accounting System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-12-03T10:31:03.118Z
CVE-2018-25095 Duplicator < 1.3.0 - Unauthenticated RCE
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
Problem types: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Duplicator
default_status: unaffected
Credits: lang: en
value: Jeremy Lim
lang: en
value: WPScan
Published: 2024-01-08T19:00:33.155Z
CVE-2018-25096 MdAlAmin-aol Own Health Record logout.php cross-site request forgery
A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery
Affected products: vendor: MdAlAmin-aol
product: Own Health Record
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-12-30T09:31:03.613Z
CVE-2018-25097 Acumos Design Studio cross site scripting
A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of the patch is 0df8a5e8722188744973168648e4c74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Acumos
product: Design Studio
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2024-01-02T15:31:03.846Z
CVE-2018-25098 blockmason credit-protocol UCAC CreditProtocol.sol executeUcacTx denial of service
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in blockmason credit-protocol. It has been declared as problematic. Affected by this vulnerability is the function executeUcacTx of the file contracts/CreditProtocol.sol of the component UCAC Handler. The manipulation leads to denial of service. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 082e01f18707ef995e80ebe97fcedb229a55efc5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252799. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-404
description: CWE-404 Denial of Service
Affected products: vendor: blockmason
product: credit-protocol
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2024-02-04T16:31:03.073Z
CVE-2018-25099 
In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-18T00:00:00.000Z
CVE-2018-25100 
The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. This affects Mojo::UserAgent::CookieJar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-24T00:00:00.000Z
CVE-2018-25101 l2c2technologies Koha opac-MARCdetail.pl cross site scripting
A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknown processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the argument biblionumber with the input 2"><TEST> leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 950fc8e101886821879066b33e389a47fb0a9782. It is recommended to upgrade the affected component. The identifier VDB-261677 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: l2c2technologies
product: Koha
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2024-04-22T01:31:03.752Z
CVE-2018-25103 Use-after-free vulnerabilities in lighttpd <= 1.4.50
There exists use-after-free vulnerabilities in lighttpd <= 1.4.50 request parsing which might read from invalid pointers to memory used in the same request, not from other requests.
Problem types: description: CWE-416: Use After Free
Affected products: vendor: lighttpd
product: lighttpd
Credits: lang: en
value: Thanks to VDOO Embedded Security part of JFROG for reporting the vulnerability in the If-Modified-Since header with line folding, and thanks to Marcus Wengelin for reporting the vulnerability in the Range header with a specially crafted pair of Range headers.
Published: 2024-06-17T18:02:57.162Z
CVE-2018-25104 CoinGate Plugin Payment callback.php postProcess logic error
A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. The manipulation leads to business logic errors. The attack may be launched remotely. Upgrading to version 1.2.8 is able to address this issue. The patch is identified as 0a3097db0aec7c5d66686c142c6abaa1e126ca16. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-840
description: Business Logic Errors
Affected products: vendor: n/a
product: CoinGate Plugin
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2024-10-17T15:31:04.848Z
CVE-2018-25105 File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download
The  File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: mndpsingh287
product: File Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2024-10-16T06:43:38.894Z
CVE-2018-25106 webuidesigning NebulaX Theme Legacy.php nebula_send_to_hubspot sql injection
A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebula_send_to_hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patch is named 41230a81db0f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: webuidesigning
product: NebulaX Theme
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2024-12-23T23:00:16.772Z
CVE-2018-25107 
The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits.
Problem types: cwe_id: CWE-338
description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected products: vendor: n/a
product: n/a
Published: 2024-12-29T00:00:00.000Z
CVE-2018-25108 WAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumption
An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: WAGO
product: 750-8100 (Controller PFC100)
default_status: unaffected
vendor: WAGO
product: 750-831 (Controller BACnet/IP)
default_status: unaffected
vendor: WAGO
product: 750-880 (Controller ETH)
default_status: unaffected
vendor: WAGO
product: 750-889 (Controller KNX IP)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Matthias Niedermaier (Hochschule Augsburg)
lang: en
value: Jan-Ole Malchow (Freie Universität Berlin)
lang: en
value: Florian Fischer (Hochschule Augsburg)
Published: 2025-01-16T10:17:21.149Z
CVE-2018-25109 Nintendo Animal Crossing Letter Trigram ac-exploit-gc memory corruption
A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified as critical. Affected by this vulnerability is an unknown functionality of the component Letter Trigram Handler. The manipulation leads to memory corruption. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Nintendo
product: Animal Crossing
vendor: Nintendo
product: Doubutsu no Mori+
vendor: Nintendo
product: Doubutsu no Mori e+
CVSS v3.1: version: 3.1
baseScore: 6.4
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
baseSeverity: MEDIUM
Published: 2025-03-23T22:31:04.649Z
CVE-2018-25110 Regular Expression Denial of Service (ReDoS) in markedjs/marked
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: default_status: unaffected
Credits: lang: en
value: Josh Bruce
Published: 2025-05-23T14:53:43.335Z
CVE-2018-25111 
django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.
Problem types: cwe_id: CWE-277
description: CWE-277 Insecure Inherited Permissions
Affected products: vendor: django-helpdesk Project
product: django-helpdesk
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: 2025-05-31T00:00:00.000Z