rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-15483 
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2018-15484 
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface by modifying autoexec.bat, aka KONE-01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2018-15485 
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require authentication or authorization, aka KONE-03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2018-15486 
An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka KONE-02.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2018-15490 
An issue was discovered in ExpressVPN on Windows. The Xvpnd.exe process (which runs as a service with SYSTEM privileges) listens on TCP port 2015, which is used as an RPC interface for communication with the client side of the ExpressVPN application. A JSON-RPC protocol over HTTP is used for communication. The JSON-RPC XVPN.GetPreference and XVPN.SetPreference methods are vulnerable to path traversal, and allow reading and writing files on the file system on behalf of the service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-15491 
A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9.3.602) allows an attacker to take control of the whitelisting feature (MyRules2.ini under %LOCALAPPDATA%\Zemana\ZALSDK) to permit execution of unauthorized applications (such as ones that record keystrokes).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-18T02:00:00.000Z
CVE-2018-15492 
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-18T02:00:00.000Z
CVE-2018-15493 
vBulletin 5.4.3 has an Open Redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T14:00:00.000Z
CVE-2018-15494 
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-18T02:00:00.000Z
CVE-2018-15495 
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-18T02:00:00.000Z
CVE-2018-15497 
The Mitel MiVoice 5330e VoIP device is affected by memory corruption flaws in the SIP/SDP packet handling functionality. An attacker can exploit this issue remotely, by sending a particular pattern of SIP/SDP packets, to cause a denial of service state in the affected devices and probably remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-15498 
YSoft SafeQ Server 6 allows a replay attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-19T22:30:17.000Z
CVE-2018-15499 
GEAR Software products that include GEARAspiWDM.sys, 2.2.5.0, allow local users to cause a denial of service (Race Condition and BSoD on Windows) by not checking that user-mode memory is available right before writing to it. A check is only performed at the beginning of a long subroutine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-24T19:00:00.000Z
CVE-2018-15501 
In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-18T02:00:00.000Z
CVE-2018-15502 
Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T16:00:00.000Z
CVE-2018-15503 
The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-18T02:00:00.000Z
CVE-2018-15504 
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-18T00:00:00.000Z
CVE-2018-15505 
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-18T00:00:00.000Z
CVE-2018-15506 
In BubbleUPnP 0.9 update 30, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running BubbleUPnP, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack the cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T16:13:41.000Z
CVE-2018-15508 
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service via opening a connection on port 8083 to a device running the Five9 SoftPhone(issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T22:00:00.000Z
CVE-2018-15509 
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T22:00:00.000Z
CVE-2018-15510 
Cross-site scripting (XSS) vulnerability in the 'Certificate' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T21:28:32.000Z
CVE-2018-15511 
Cross-site scripting (XSS) vulnerability in the 'Notification template' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T21:31:48.000Z
CVE-2018-15512 
Cross-site scripting (XSS) vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T21:17:51.000Z
CVE-2018-15513 
Log viewer in totemomail 6.0.0 build 570 allows access to sessionIDs of high privileged users by leveraging access to a read-only auditor role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T21:21:51.000Z
CVE-2018-15514 
HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-01T01:00:00.000Z
CVE-2018-15515 
The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the CaptivelPortal.exe subdirectory under the D-Link directory, which allows unprivileged local users to gain SYSTEM privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-31T19:00:00.000Z
CVE-2018-15516 
The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-31T19:00:00.000Z
CVE-2018-15517 
The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-31T19:00:00.000Z
CVE-2018-15518 
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-26T20:00:00.000Z
CVE-2018-15519 
Various Lexmark devices have a Buffer Overflow (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-28T16:12:24.000Z
CVE-2018-15520 
Various Lexmark devices have a Buffer Overflow (issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-28T15:25:12.000Z
CVE-2018-15528 
Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "select_sso()" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?[XSS] link and then clicks the "Login" button.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T16:00:00.000Z
CVE-2018-15529 
A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authenticated users, with access to the admin interface, to inject arbitrary commands within the filename of a system upgrade upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T17:00:00.000Z
CVE-2018-15530 
Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:46:10.000Z
CVE-2018-15531 
JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T22:00:00.000Z
CVE-2018-15532 
SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T21:23:10.000Z
CVE-2018-15533 
A reflected cross-site scripting vulnerability exists in Geutebrueck re_porter 16 before 7.8.974.20 by appending a query string to /modifychannel/exec or /images/*.png on TCP port 12005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T16:00:00.000Z
CVE-2018-15534 
Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct request for /statistics/gscsetup.xml on TCP port 12003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T16:00:00.000Z
CVE-2018-15535 
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-24T19:00:00.000Z
CVE-2018-15536 
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-24T19:00:00.000Z
CVE-2018-15537 
Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-29T21:00:00.000Z
CVE-2018-15538 
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T19:00:00.000Z
CVE-2018-15539 
Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T19:00:00.000Z
CVE-2018-15540 
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T19:00:00.000Z
CVE-2018-15542 
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode.  NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-09T15:00:00.000Z
CVE-2018-15543 
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in conjunction with the Android keyGenerator class is not implemented. In other words, an attacker could authenticate with an arbitrary fingerprint.  NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-09T15:00:00.000Z
CVE-2018-15546 
Accusoft PrizmDoc version 13.3 and earlier contains a Stored Cross-Site Scripting issue through a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T21:00:00.000Z
CVE-2018-15552 
The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2018-15553 
fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters in the smbdUserid or smbdPasswd field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T00:00:00.000Z
CVE-2018-15555 
On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by using the enabled onboard UART headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-28T14:34:51.000Z
CVE-2018-15556 
The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "root" and an empty password by using the enabled onboard UART headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-27T16:55:25.000Z
CVE-2018-15557 
An issue was discovered in the Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 devices. An attacker can statically set his/her IP to anything on the 169.254.1.0/24 subnet, and obtain root access by connecting to 169.254.1.2 port 23 with telnet/netcat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-27T16:52:48.000Z
CVE-2018-15559 
The editor in Xiuno BBS 4.0.4 allows stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T00:00:00.000Z
CVE-2018-15560 
PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T00:00:00.000Z
CVE-2018-15562 
CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T19:00:00.000Z
CVE-2018-15563 
_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-02T18:00:00.000Z
CVE-2018-15564 
An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T01:00:00.000Z
CVE-2018-15565 
An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T01:00:00.000Z
CVE-2018-15566 
tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T01:00:00.000Z
CVE-2018-15567 
CMSUno before 1.5.3 has XSS via the title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T01:00:00.000Z
CVE-2018-15568 
tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T01:00:00.000Z
CVE-2018-15569 
my little forum 2.4.12 allows CSRF for deletion of users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T01:00:00.000Z
CVE-2018-15570 
In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T01:00:00.000Z
CVE-2018-15571 
The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T17:00:00.000Z
CVE-2018-15572 
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T02:00:00.000Z
CVE-2018-15573 
An issue was discovered in Reprise License Manager (RLM) through 12.2BL2. Attackers can use the web interface to read and write data to any file on disk (as long as rlm.exe has access to it) via /goform/edit_lf_process with file content in the lfdata parameter and a pathname in the lf parameter. By default, the web interface is on port 5054, and does not require authentication. NOTE: the vendor has stated "We do not consider this a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T02:00:00.000Z
CVE-2018-15574 
An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/edit_lf_get_data lf parameter via GET or POST. NOTE: the vendor has stated "We do not consider this a vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T02:00:00.000Z
CVE-2018-15576 
An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploited for remote code execution in the decrypt function, if the attacker knows the key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-24T21:00:00.000Z
CVE-2018-15580 
Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-26T19:10:05.000Z
CVE-2018-15581 
Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-26T19:01:03.000Z
CVE-2018-15582 
Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-26T19:13:56.000Z
CVE-2018-15583 
Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-25T20:19:33.000Z
CVE-2018-15584 
Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-26T19:06:56.000Z