rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-6789 
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T23:00:00.000Z
CVE-2018-6790 
An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T02:00:00.000Z
CVE-2018-6791 
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T02:00:00.000Z
CVE-2018-6792 
Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.3.1 allow an authenticated user to execute arbitrary SQL commands via multiple parameters to the /cvms-hub/privado/seccionesmib/secciones.xhtml resource. The POST parameters are j_idt118, j_idt120, j_idt122, j_idt124, j_idt126, j_idt128, and j_idt130 under formularioGestionarSecciones:tablaSeccionesMib:*:filter. The GET parameter is nombreAgente.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T02:00:00.000Z
CVE-2018-6794 
Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T05:00:00.000Z
CVE-2018-6795 
PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T21:00:00.000Z
CVE-2018-6796 
PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T21:00:00.000Z
CVE-2018-6797 
An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-17T20:00:00.000Z
CVE-2018-6798 
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-17T20:00:00.000Z
CVE-2018-6799 
The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T05:00:00.000Z
CVE-2018-6806 
Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL. The value of the text parameter can include arbitrary JavaScript code, e.g., making XMLHttpRequest calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T05:00:00.000Z
CVE-2018-6808 
NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to download arbitrary files on the target system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6809 
NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to gain privilege on a target system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6810 
Directory traversal vulnerability in NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allows remote attackers to traverse the directory on the target system via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6811 
Multiple cross-site scripting (XSS) vulnerabilities in Citrix NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to inject arbitrary web script or HTML via the Citrix NetScaler interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6822 
In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to execute system commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T15:00:00.000Z
CVE-2018-6823 
In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service that can be abused to execute scripts as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T16:00:00.000Z
CVE-2018-6824 
Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy URI, as demonstrated by an XMLHttpRequest call with an 'email:"attacker@example.com"' request, which can be followed by a password reset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T17:00:00.000Z
CVE-2018-6825 
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T15:00:00.000Z
CVE-2018-6826 
An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, and therefore man-in-the-middle attackers can execute arbitrary code by watching for a local user to launch the Breakout Easter Egg feature, and then sending a crafted HTTP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T15:00:00.000Z
CVE-2018-6827 
VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information, and consequently execute arbitrary code, via a crafted certificate, as demonstrated by leveraging a hardcoded --no-check-certificate Wget option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T15:00:00.000Z
CVE-2018-6829 
cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T23:00:00.000Z
CVE-2018-6830 
Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and C1 Lite V2 2.52.2.47 and earlier, FI9800P, FI9800P V2, FI9803P V2, FI9803P V3, and FI9851P V2 2.54.2.47 and earlier, FI9815P, FI9815P V2, FI9816P, and FI9816P V2, 2.51.2.47 and earlier, R2 and R4 2.71.1.59 and earlier, C2 and FI9961EP 2.72.1.59 and earlier, FI9900EP, FI9900P, and FI9901EP 2.74.1.59 and earlier, FI9928P 2.74.1.58 and earlier, FI9803EP and FI9853EP 2.22.2.31 and earlier, FI9803P and FI9851P 2.24.2.31 and earlier, FI9821P V2, FI9826P V2, FI9831P V2, and FI9821EP 2.21.2.31 and earlier, FI9821W V2, FI9831W, FI9826W, FI9821P, FI9831P, and FI9826P 2.11.1.120 and earlier, FI9818W V2 2.13.2.120 and earlier, FI9805W, FI9804W, FI9804P, FI9805E, and FI9805P 2.14.1.120 and earlier, FI9828P, and FI9828W 2.13.1.120 and earlier, and FI9828P V2 2.11.1.133 and earlier allows remote attackers to delete arbitrary files via a .. (dot dot) in the URI path component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T17:00:00.000Z
CVE-2018-6831 
The setSystemTime function in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and C1 Lite V2 2.52.2.47 and earlier, FI9800P, FI9800P V2, FI9803P V2, FI9803P V3, and FI9851P V2 2.54.2.47 and earlier, FI9815P, FI9815P V2, FI9816P, and FI9816P V2, 2.51.2.47 and earlier, R2 and R4 2.71.1.59 and earlier, C2 and FI9961EP 2.72.1.59 and earlier, FI9900EP, FI9900P, and FI9901EP 2.74.1.59 and earlier, FI9928P 2.74.1.58 and earlier, FI9803EP and FI9853EP 2.22.2.31 and earlier, FI9803P and FI9851P 2.24.2.31 and earlier, FI9821P V2, FI9826P V2, FI9831P V2, and FI9821EP 2.21.2.31 and earlier, FI9821W V2, FI9831W, FI9826W, FI9821P, FI9831P, and FI9826P 2.11.1.120 and earlier, FI9818W V2 2.13.2.120 and earlier, FI9805W, FI9804W, FI9804P, FI9805E, and FI9805P 2.14.1.120 and earlier, FI9828P, and FI9828W 2.13.1.120 and earlier, and FI9828P V2 2.11.1.133 and earlier allows remote authenticated users to execute arbitrary commands via a ';' in the ntpServer argument.  NOTE: this issue exists because of an incomplete fix for CVE-2017-2849.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T17:00:00.000Z
CVE-2018-6832 
Stack-based buffer overflow in the getSWFlag function in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and C1 Lite V2 2.52.2.47 and earlier, FI9800P, FI9800P V2, FI9803P V2, FI9803P V3, and FI9851P V2 2.54.2.47 and earlier, FI9815P, FI9815P V2, FI9816P, and FI9816P V2, 2.51.2.47 and earlier, R2 and R4 2.71.1.59 and earlier, C2 and FI9961EP 2.72.1.59 and earlier, FI9900EP, FI9900P, and FI9901EP 2.74.1.59 and earlier, FI9928P 2.74.1.58 and earlier, FI9803EP and FI9853EP 2.22.2.31 and earlier, FI9803P and FI9851P 2.24.2.31 and earlier, FI9821P V2, FI9826P V2, FI9831P V2, and FI9821EP 2.21.2.31 and earlier, FI9821W V2, FI9831W, FI9826W, FI9821P, FI9831P, and FI9826P 2.11.1.120 and earlier, FI9818W V2 2.13.2.120 and earlier, FI9805W, FI9804W, FI9804P, FI9805E, and FI9805P 2.14.1.120 and earlier, FI9828P, and FI9828W 2.13.1.120 and earlier, and FI9828P V2 2.11.1.133 and earlier allows remote attackers to cause a denial of service (crash and reboot), via the callbackJson parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T17:00:00.000Z
CVE-2018-6834 
static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T07:00:00.000Z
CVE-2018-6835 
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T07:00:00.000Z
CVE-2018-6836 
The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory address, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T07:00:00.000Z
CVE-2018-6842 
Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T14:00:00.000Z
CVE-2018-6843 
Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T14:00:00.000Z
CVE-2018-6844 
MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T07:00:00.000Z
CVE-2018-6845 
PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T03:00:00.000Z
CVE-2018-6846 
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T16:00:00.000Z
CVE-2018-6849 
In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-01T18:00:00.000Z
CVE-2018-6851 
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80206040. By crafting an input buffer we can control the execution path to the point where the constant DWORD 0 will be written to a user-controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-6852 
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80202298. By crafting an input buffer we can control the execution path to the point where the nt!memset function is called to zero out contents of a user-controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-6853 
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80206024. By crafting an input buffer we can control the execution path to the point where a global variable will be written to a user controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-6854 
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via multiple IOCTLs, e.g., 0x8810200B, 0x8810200F, 0x8810201B, 0x8810201F, 0x8810202B, 0x8810202F, 0x8810203F, 0x8810204B, 0x88102003, 0x88102007, 0x88102013, 0x88102017, 0x88102027, 0x88102033, 0x88102037, 0x88102043, and 0x88102047. When some conditions in the user-controlled input buffer are not met, the driver writes an error code (0x2000001A) to a user-controlled address. Also, note that all the aforementioned IOCTLs use transfer type METHOD_NEITHER, which means that the I/O manager does not validate any of the supplied pointers and buffer sizes. So, even though the driver checks for input/output buffer sizes, it doesn't validate if the pointers to those buffers are actually valid. So, we can supply a pointer for the output buffer to a kernel address space address, and the error code will be written there. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-6855 
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80202014. By crafting an input buffer we can control the execution path to the point where the constant 0xFFFFFFF will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-6856 
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x8020601C. By crafting an input buffer we can control the execution path to the point where a global variable will be written to a user controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-6857 
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x802022E0. By crafting an input buffer we can control the execution path to the point where the constant 0x12 will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T18:00:00.000Z
CVE-2018-6858 
Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T03:00:00.000Z
CVE-2018-6859 
SQL Injection exists in PHP Scripts Mall Schools Alert Management Script 2.0.2 via the Login Parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T18:00:00.000Z
CVE-2018-6860 
Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T03:00:00.000Z
CVE-2018-6861 
Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T03:00:00.000Z
CVE-2018-6862 
Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T03:00:00.000Z
CVE-2018-6863 
SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T03:00:00.000Z
CVE-2018-6864 
Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T03:00:00.000Z
CVE-2018-6866 
Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T13:00:00.000Z
CVE-2018-6867 
Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T13:00:00.000Z
CVE-2018-6868 
Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-23T13:00:00.000Z
CVE-2018-6869 
In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T06:00:00.000Z
CVE-2018-6870 
Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T22:00:00.000Z
CVE-2018-6871 
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T06:00:00.000Z
CVE-2018-6872 
The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T06:00:00.000Z
CVE-2018-6873 
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T17:00:00.000Z