rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-17300 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:04:58.000Z
CVE-2019-17301 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:04:50.000Z
CVE-2019-17302 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:04:42.000Z
CVE-2019-17303 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:04:34.000Z
CVE-2019-17304 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:04:24.000Z
CVE-2019-17305 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:04:14.000Z
CVE-2019-17306 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:04:06.000Z
CVE-2019-17307 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:03:58.000Z
CVE-2019-17308 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:03:50.000Z
CVE-2019-17309 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:03:41.000Z
CVE-2019-17310 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:03:30.000Z
CVE-2019-17311 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:03:20.000Z
CVE-2019-17312 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:03:12.000Z
CVE-2019-17313 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:03:00.000Z
CVE-2019-17314 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:01:07.000Z
CVE-2019-17315 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:00:58.000Z
CVE-2019-17316 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:00:44.000Z
CVE-2019-17317 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:00:14.000Z
CVE-2019-17318 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:56:00.000Z
CVE-2019-17319 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:55:50.000Z
CVE-2019-17320 
NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying file name from an attacker controlled FTP server. That leads attacker to execute arbitrary code by sending a crafted filename.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: NetSarang
product: XFTP
Published: 2019-10-10T14:45:24.000Z
CVE-2019-17321 
ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated with session, could leak username via session file path of HTTP response data. No authentication is required.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: ClipSoft
product: REXPERT
Published: 2019-10-30T20:42:57.000Z
CVE-2019-17322 
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Problem types: cwe_id: CWE-264
description: Permissions, Privileges, and Access Controls (CWE-264)
Affected products: vendor: ClipSoft
product: REXPERT
Published: 2019-10-30T20:46:38.000Z
CVE-2019-17323 
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer with modified XML document. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Problem types: cwe_id: CWE-91
description: CWE-91: XML Injection (aka Blind XPath Injection)
Affected products: vendor: ClipSoft
product: REXPERT
Published: 2019-10-30T20:49:41.000Z
CVE-2019-17324 
ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This could lead to create malicious HTML file, because they can inject a content with crafted template. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: ClipSoft
product: REXPERT
Published: 2019-10-30T20:52:34.000Z
CVE-2019-17325 
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: ClipSoft
product: REXPERT
Published: 2019-10-30T20:55:11.000Z
CVE-2019-17326 
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted parameter. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Problem types: cwe_id: CWE-264
description: Permissions, Privileges, and Access Controls (CWE-264)
Affected products: vendor: ClipSoft
product: REXPERT
Published: 2019-10-30T20:57:30.000Z
CVE-2019-17327 
JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file.
Problem types: description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: TmaxSoft
product: JEUS
Published: 2019-11-08T17:54:05.000Z
CVE-2019-17330 TIBCO EBX Exposes Multiple Cross-Site Scripting Vulnerabilities
The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow authenticated users to perform stored cross-site scripting (XSS) attacks, and unauthenticated users to perform reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions up to and including 5.8.1.fixR, versions 5.9.3, 5.9.4, 5.9.5, and 5.9.6.
Problem types: description: The impact of these vulnerabilities includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO EBX
Published: 2019-11-12T19:15:56.379Z
CVE-2019-17331 TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities
The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, version 4.1.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO EBX Add-ons
Published: 2019-11-12T19:15:56.812Z
CVE-2019-17332 TIBCO EBX Add-on For Digital Asset Manager Cross-Site Scripting Vulnerabilities
The Digital Asset Manager Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, versions 4.1.0, 4.2.0, 4.2.1, and 4.2.2.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO EBX Add-ons
Published: 2019-11-12T19:15:57.352Z
CVE-2019-17333 TIBCO EBX Exposes Cross-Site Scripting Vulnerability
The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below, versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7.
Problem types: description: The impact of these vulnerabilities includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO EBX
Published: 2020-02-19T18:20:19.016Z
CVE-2019-17334 TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared Files
The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contains a vulnerability that theoretically allows an attacker with permission to write DXP files to the Spotfire library to remotely execute code of their choice on the user account of other users who access the affected system. This attack is a risk only when the attacker has write access to a network file system shared with the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0, TIBCO Spotfire Deployment Kit: versions 7.11.1 and below, TIBCO Spotfire Desktop: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, and TIBCO Spotfire Desktop Language Packs: versions 7.11.1 and below.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that the attacker gains full control of the user account that accesses affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analyst
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Deployment Kit
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Desktop
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Desktop Language Packs
Published: 2019-12-17T20:55:17.037Z
CVE-2019-17335 TIBCO Spotfire Server Exposes User-Specific Cached Data To Others Users
The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacker should not have access to. The attacker would need privileges to save a Spotfire file to the library. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that the attacker could gain unauthorized access to data that other users have recently viewed.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
Published: 2019-12-17T20:55:17.568Z
CVE-2019-17336 TIBCO Spotfire Web Player Potentially Exposes Credentials For Shared Data Sources
The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to information that can lead to obtaining credentials used to access Spotfire data sources. The attacker would need privileges to save a Spotfire file to the library, and only applies in a situation where NTLM credentials, or a credentials profile is in use. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an attacker recovers credentials used to access Spotfire data sources.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
Published: 2019-12-17T20:55:18.061Z
CVE-2019-17337 TIBCO Spotfire Server Library Vulnerable to Reflected Cross-Site Scripting
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker to perform a reflected cross-site scripting (XSS) attack. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
Problem types: description: The impact of the vulnerability includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
Published: 2019-12-17T20:55:18.595Z
CVE-2019-17338 TIBCO Patterns - Search Exposes Cross Site Scripting Vulnerabilities
The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that theoretically allow authenticated users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Patterns - Search: versions 5.4.0 and below.
Problem types: description: The impact of these vulnerabilities includes the theoretical possibility that an attacker could gain all privileges available via the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Patterns - Search
Published: 2020-01-28T18:00:20.291Z
CVE-2019-17339 TIBCO Silver Fabric XSS vulerability
The VirtualRouter component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that theoretically allows an attacker to inject scripts via URLs. The attacker could theoretically social engineer an authenticated user into submitting the URL, thus executing the script on the affected system with the privileges of the user. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions 6.0.0 and below.
Problem types: description: The impact of this vulnerability includes the possibility that an attacker could steal session tokens of the authenticated user which would allow the attacker to hijack the session and perform whatever tasks the user has permission to execute.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2020-08-11T19:30:14.315Z
CVE-2019-17340 
An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:03:29.000Z
CVE-2019-17341 
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:03:17.000Z
CVE-2019-17342 
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:03:03.000Z
CVE-2019-17343 
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:02:51.000Z
CVE-2019-17344 
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:02:40.000Z
CVE-2019-17345 
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:02:29.000Z
CVE-2019-17346 
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:02:15.000Z
CVE-2019-17347 
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:02:04.000Z
CVE-2019-17348 
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:01:46.000Z
CVE-2019-17349 
An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:00:58.000Z
CVE-2019-17350 
An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:00:47.000Z
CVE-2019-17351 
An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T00:00:30.000Z
CVE-2019-17352 
In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:13:36.000Z
CVE-2019-17353 
An issue discovered on D-Link DIR-615 devices with firmware version 20.05 and 20.07. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-09T11:55:38.000Z
CVE-2019-17354 
wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify data fields of the page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-09T11:57:13.000Z