rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-7350 
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T19:00:00.000Z
CVE-2019-7351 
Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T19:00:00.000Z
CVE-2019-7352 
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the value supplied to the 'New State' (aka newState) field, allowing an attacker to execute HTML or JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T19:00:00.000Z
CVE-2019-7353 
An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T16:04:12.000Z
CVE-2019-7356 
Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-04T19:25:52.000Z
CVE-2019-7357 
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-10T19:46:24.000Z
CVE-2019-7358 
An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file may cause a heap overflow, resulting in code execution.
Problem types: description: Heap Overflow
Affected products: vendor: Autodesk
product: Autodesk AutoCAD LT
vendor: Autodesk
product: Autodesk Civil 3D
vendor: Autodesk
product: Autodesk Advance Steel
vendor: Autodesk
product: Autodesk AutoCAD
vendor: Autodesk
product: Autodesk AutoCAD Architecture
vendor: Autodesk
product: Autodesk AutoCAD Electrical
vendor: Autodesk
product: Autodesk AutoCAD Map 3D
vendor: Autodesk
product: Autodesk AutoCAD Mechanical
vendor: Autodesk
product: Autodesk AutoCAD MEP
vendor: Autodesk
product: Autodesk AutoCAD P&ID
vendor: Autodesk
product: Autodesk AutoCAD Plant 3D
Published: 2019-04-09T19:22:39.000Z
CVE-2019-7359 
An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file with too many cell margins populating an AcCellMargin object may cause a heap overflow, resulting in code execution.
Problem types: description: Use After Free
Affected products: vendor: Autodesk
product: Autodesk Advance Steel
vendor: Autodesk
product: Autodesk AutoCAD
vendor: Autodesk
product: Autodesk AutoCAD Architecture
vendor: Autodesk
product: Autodesk AutoCAD Electrical
vendor: Autodesk
product: Autodesk AutoCAD Map 3D
vendor: Autodesk
product: Autodesk AutoCAD Mechanical
vendor: Autodesk
product: Autodesk AutoCAD MEP
vendor: Autodesk
product: Autodesk AutoCAD P&ID
vendor: Autodesk
product: Autodesk AutoCAD Plant 3D
vendor: Autodesk
product: Autodesk AutoCAD LT
vendor: Autodesk
product: Autodesk Civil 3D
Published: 2019-04-09T19:22:56.000Z
CVE-2019-7360 
An exploitable use-after-free vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file may trigger a use-after-free, resulting in code execution.
Problem types: description: Heap Overflow
Affected products: vendor: Autodesk
product: Autodesk Civil 3D
vendor: Autodesk
product: Autodesk Advance Steel
vendor: Autodesk
product: Autodesk AutoCAD
vendor: Autodesk
product: Autodesk AutoCAD Architecture
vendor: Autodesk
product: Autodesk AutoCAD Electrical
vendor: Autodesk
product: Autodesk AutoCAD Map 3D
vendor: Autodesk
product: Autodesk AutoCAD Mechanical
vendor: Autodesk
product: Autodesk AutoCAD MEP
vendor: Autodesk
product: Autodesk AutoCAD P&ID
vendor: Autodesk
product: Autodesk AutoCAD Plant 3D
vendor: Autodesk
product: Autodesk AutoCAD LT
Published: 2019-04-09T19:21:46.000Z
CVE-2019-7361 
An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code execution in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018.
Problem types: description: Deserialization of Untrusted Data
Affected products: vendor: Autodesk
product: Autodesk Civil 3D
vendor: Autodesk
product: Autodesk Advance Steel
vendor: Autodesk
product: Autodesk AutoCAD
vendor: Autodesk
product: Autodesk AutoCAD Architecture
vendor: Autodesk
product: Autodesk AutoCAD Electrical
vendor: Autodesk
product: Autodesk AutoCAD Map 3D
vendor: Autodesk
product: Autodesk AutoCAD Mechanical
vendor: Autodesk
product: Autodesk AutoCAD MEP
vendor: Autodesk
product: Autodesk AutoCAD P&ID
vendor: Autodesk
product: Autodesk AutoCAD Plant 3D
vendor: Autodesk
product: Autodesk AutoCAD LT
Published: 2019-04-09T19:22:15.000Z
CVE-2019-7362 
DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a DLL preloading vulnerability, which may result in code execution.
Problem types: description: DLL preloading vulnerability
Affected products: vendor: n/a
product: Autodesk Design Review
Published: 2019-08-23T19:35:31.000Z
CVE-2019-7363 
Use-after-free vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a use-after-free vulnerability, which may result in code execution.
Problem types: description: Use-after-free vulnerability
Affected products: vendor: n/a
product: Autodesk Design Review
Published: 2019-08-23T19:35:52.000Z
CVE-2019-7364 
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution.
Problem types: description: DLL preloading vulnerability
Affected products: vendor: n/a
product: Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, AutoCAD P&ID
Published: 2019-08-23T19:36:17.000Z
CVE-2019-7365 
DLL preloading vulnerability in Autodesk Desktop Application versions 7.0.16.29 and earlier. An attacker may trick a user into downloading a malicious DLL file into the working directory, which may then leverage a DLL preloading vulnerability and execute code on the system.
Problem types: description: DLL preloading vulnerability
Affected products: vendor: n/a
product: Autodesk Desktop Application
Published: 2019-12-03T17:01:27.000Z
CVE-2019-7366 
Buffer overflow vulnerability in Autodesk FBX Software Development Kit version 2019.5. A user may be tricked into opening a malicious FBX file which may exploit a buffer overflow vulnerability causing it to run arbitrary code on the system.
Problem types: description: Buffer overflow vulnerability
Affected products: vendor: n/a
product: Autodesk FBX Software Development Kit
Published: 2019-12-03T17:09:14.000Z
CVE-2019-7383 
An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/isp_update_edit.php does not properly validate user input, which leads to shell command injection via the des parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:04:54.000Z
CVE-2019-7384 
An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below. The value of the fmgpon_loid parameter is used in a system call inside the boa binary. Because there is no user input validation, this leads to authenticated code execution on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:07:36.000Z
CVE-2019-7385 
An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation, this leads to authenticated code execution on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:13:51.000Z
CVE-2019-7386 
A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is visited with the internal browser, the Gecko process crashes with a segfault. Successful exploitation could lead to the remote code execution on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:22:25.000Z
CVE-2019-7387 
A local file inclusion vulnerability exists in the web interface of Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. When the export function is called from system/maintenance/export.php, it accepts the path provided by the user, leading to path traversal via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T22:00:00.000Z
CVE-2019-7388 
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get sensitive information (such as MAC address) about all clients in the WLAN via the GetClientInfo HNAP API. Consequently, an attacker can achieve information disclosure without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T00:00:00.000Z
CVE-2019-7389 
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to reset the router without authentication via the SetFactoryDefault HNAP API. Consequently, an attacker can achieve a denial-of-service attack without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T00:00:00.000Z
CVE-2019-7390 
An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T00:00:00.000Z
CVE-2019-7391 
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:33:52.000Z
CVE-2019-7392 
An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T18:00:00.000Z
CVE-2019-7393 
A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases.
Problem types: cwe_id: CWE-1021
description: CWE-1021: Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: CA Technologies, A Broadcom Company
product: CA Strong Authentication
vendor: CA Technologies, A Broadcom Company
product: CA Risk Authentication
Published: 2019-05-28T18:28:30.990Z
CVE-2019-7394 
A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: CA Technologies, A Broadcom Company
product: CA Strong Authentication
vendor: CA Technologies, A Broadcom Company
product: CA Risk Authentication
Published: 2019-05-28T18:25:49.842Z
CVE-2019-7395 
In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T00:00:00.000Z
CVE-2019-7396 
In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T00:00:00.000Z
CVE-2019-7397 
In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T00:00:00.000Z
CVE-2019-7398 
In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T00:00:00.000Z
CVE-2019-7399 
Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-17T04:00:00.000Z
CVE-2019-7400 
Rukovoditel before 2.4.1 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T05:00:00.000Z
CVE-2019-7401 
NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request. This may result in a denial of service (router process crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-08T03:00:00.000Z
CVE-2019-7402 
An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg&#95;qqcode parameter. This can be exploited via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T16:00:00.000Z
CVE-2019-7403 
An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=import&dopost=deldir&tbname=../ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T16:00:00.000Z
CVE-2019-7404 
An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full pathname, such as http://192.168.0.1/var/gapm7100_${today's_date}.log for reading a filename such as gapm7100_190101.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:44:19.000Z
CVE-2019-7409 
Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page, (2) gbs, (3) side, (4) id, (5) imgid, (6) cat, or (7) orderby parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:52:12.000Z
CVE-2019-7410 
There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE Field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-14T13:35:14.000Z
CVE-2019-7411 
Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:48:19.000Z
CVE-2019-7412 
The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T18:00:00.000Z
CVE-2019-7413 
In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. ("parallax" has a spelling change within the PHP filename.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T18:00:00.000Z
CVE-2019-7416 
XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in "/webtop/help/en/default.htm" is vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:36:54.000Z
CVE-2019-7417 
XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:41:15.000Z
CVE-2019-7418 
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/swsAlert.sws" in multiple parameters: flag, frame, func, and Nfunc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:43:06.000Z
CVE-2019-7419 
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/leftmenu.sws" in multiple parameters: ruiFw_id, ruiFw_pid, ruiFw_title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:53:18.000Z
CVE-2019-7420 
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.application/information/networkinformationView.sws" in the tabName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:57:26.000Z
CVE-2019-7421 
XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple parameters: contextpath and basedURL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:59:07.000Z
CVE-2019-7422 
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T20:00:59.000Z
CVE-2019-7423 
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T20:02:54.000Z
CVE-2019-7424 
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is related to CVE-2009-3903.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T20:06:07.000Z
CVE-2019-7425 
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T20:10:05.000Z
CVE-2019-7426 
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T18:27:38.000Z
CVE-2019-7427 
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefTime or graphTypes parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T18:31:25.000Z
CVE-2019-7429 
PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2016/08 directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:29:10.000Z
CVE-2019-7430 
PHP Scripts Mall Image Sharing Script 1.3.4 has HTML injection via the Search Bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:35:23.000Z
CVE-2019-7431 
PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:39:31.000Z
CVE-2019-7432 
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:42:17.000Z
CVE-2019-7433 
PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:45:22.000Z