saikiranpennam/new_cves_pps huggingface dataset:
Explain the vulnerability: CVE-2018-20371
Description:PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.html__passwd1" and "GET /login.html__passwd2" and so on.
Explain the vulnerability: CVE-2018-20664
Description:Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.
Explain the vulnerability: CVE-2018-20234
Description:There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.
Explain the vulnerability: CVE-2018-20058
Description:In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634.
Explain the vulnerability: CVE-2018-20408
Description:An issue was discovered in Bento4 1.5.1-627. There is a memory leak in AP4_StdcFileByteStream::Create in System/StdC/Ap4StdCFileByteStream.cpp, as demonstrated by mp42hls.
Explain the vulnerability: CVE-2018-20185
Description:In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.
Explain the vulnerability: CVE-2018-20886
Description:cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).
Explain the vulnerability: CVE-2018-20869
Description:cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).
Explain the vulnerability: CVE-2018-20490
Description:An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.
Explain the vulnerability: CVE-2018-20243
Description:The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629.
Explain the vulnerability: CVE-2018-20613
Description:TEMMOKU T1.09 Beta allows admin/user/add CSRF.
Explain the vulnerability: CVE-2018-20306
Description:A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.
Explain the vulnerability: CVE-2018-20756
Description:MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
Explain the vulnerability: CVE-2018-20582
Description:The GREE+ (aka com.gree.greeplus) application 1.4.0.8 for Android suffers from Cross Site Request Forgery.
Explain the vulnerability: CVE-2018-20097
Description:There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
Explain the vulnerability: CVE-2018-20644
Description:PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.
Explain the vulnerability: CVE-2018-20594
Description:An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.
Explain the vulnerability: CVE-2018-20982
Description:The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
Explain the vulnerability: CVE-2018-20652
Description:An attempted excessive memory allocation was discovered in the function tinyexr::AllocateImage in tinyexr.h in tinyexr v0.9.5. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted input, which leads to an out-of-memory exception.
Explain the vulnerability: CVE-2018-20717
Description:In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to gain Remote Code Execution. This occurs because protection against serialized objects looks for a 0: followed by an integer, but does not consider 0:+ followed by an integer.
Explain the vulnerability: CVE-2018-20890
Description:cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).
Explain the vulnerability: CVE-2018-20193
Description:Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 (build 9627) 4.2 Release (build 7631). This occurs because appropriate controls are not performed. Specifically, it is possible for a readonly user to change the administrator user password by making a local copy of the /dana-admin/user/update.cgi page, changing the "user" value, and saving the changes.
Explain the vulnerability: CVE-2018-20469
Description:An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions.
Explain the vulnerability: CVE-2018-20486
Description:MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.
Explain the vulnerability: CVE-2018-20605
Description:imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.
Explain the vulnerability: CVE-2018-20310
Description:Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
Explain the vulnerability: CVE-2018-20557
Description:An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter.
Explain the vulnerability: CVE-2018-20941
Description:cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349).
Explain the vulnerability: CVE-2018-20384
Description:iNovo Broadband IB-8120-W21 139.4410mp1.004200.002 and IB-8120-W21E1 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Explain the vulnerability: CVE-2018-20853
Description:An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks.
Explain the vulnerability: CVE-2018-20150
Description:In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
Explain the vulnerability: CVE-2018-20015
Description:YzmCMS v5.2 has admin/role/add.html CSRF.
Explain the vulnerability: CVE-2018-20916
Description:cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).
Explain the vulnerability: CVE-2018-20783
Description:In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
Explain the vulnerability: CVE-2018-20629
Description:PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
Explain the vulnerability: CVE-2018-20146
Description:An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
Explain the vulnerability: CVE-2018-20845
Description:Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
Explain the vulnerability: CVE-2018-20900
Description:cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).
Explain the vulnerability: CVE-2018-20453
Description:The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file.
Explain the vulnerability: CVE-2018-20795
Description:tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary files via path traversal with the path parameter, through the copy_cut action in ajax_calls.php and the paste_clipboard action in execute.php.
Explain the vulnerability: CVE-2018-20541
Description:There is a heap-based buffer overflow in libxsmm_sparse_csc_reader at generator_spgemm_csc_reader.c in LIBXSMM 1.10, a different vulnerability than CVE-2018-20542 (which is in a different part of the source code and is seen at different addresses).
Explain the vulnerability: CVE-2018-20404
Description:ETK_E900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack via IOCTL 0x9C402048, which calls memmove and constantly fails on an arbitrary (uncontrollable) address, resulting in an eternal hang or a BSoD.
Explain the vulnerability: CVE-2018-20957
Description:The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.
Explain the vulnerability: CVE-2018-20687
Description:An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Explain the vulnerability: CVE-2018-20238
Description:Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.
Explain the vulnerability: CVE-2018-20392
Description:S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Explain the vulnerability: CVE-2018-20539
Description:There is a Segmentation fault triggered by illegal address access at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1.8.1 that will cause a denial of service.
Explain the vulnerability: CVE-2018-20493
Description:An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
Explain the vulnerability: CVE-2018-20169
Description:An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
Explain the vulnerability: CVE-2018-20885
Description:cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416).
Explain the vulnerability: CVE-2018-20305
Description:D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address.
Explain the vulnerability: CVE-2018-20755
Description:MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
Explain the vulnerability: CVE-2018-20240
Description:The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.
Explain the vulnerability: CVE-2018-20610
Description:imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.
Explain the vulnerability: CVE-2018-20997
Description:An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.
Explain the vulnerability: CVE-2018-20094
Description:An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.
Explain the vulnerability: CVE-2018-20352
Description:Use-after-free vulnerability in the mg_cgi_ev_handler function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
Explain the vulnerability: CVE-2018-20647
Description:PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.
Explain the vulnerability: CVE-2018-20578
Description:An issue was discovered in NuttX before 7.27. The function netlib_parsehttpurl() in apps/netutils/netlib/netlib_parsehttpurl.c mishandles URLs longer than hostlen bytes (in the webclient, this is set by default to 40), leading to an Infinite Loop. The attack vector is the Location header of an HTTP 3xx response.
Explain the vulnerability: CVE-2018-20128
Description:An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pathname followed by a crafted substring.
Explain the vulnerability: CVE-2018-20597
Description:UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.
Explain the vulnerability: CVE-2018-20714
Description:The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin.
Explain the vulnerability: CVE-2018-20201
Description:There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file.
Explain the vulnerability: CVE-2018-20651
Description:A NULL pointer dereference was discovered in elf_link_add_object_symbols in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31.1. This occurs for a crafted ET_DYN with no program headers. A specially crafted ELF file allows remote attackers to cause a denial of service, as demonstrated by ld.
Explain the vulnerability: CVE-2018-20485
Description:Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
Explain the vulnerability: CVE-2018-20190
Description:In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.
Explain the vulnerability: CVE-2018-20743
Description:murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.
Explain the vulnerability: CVE-2018-20313
Description:Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
Explain the vulnerability: CVE-2018-20606
Description:imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI.
Explain the vulnerability: CVE-2018-20942
Description:cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351).
Explain the vulnerability: CVE-2018-20807
Description:An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly.
Explain the vulnerability: CVE-2018-20387
Description:Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Explain the vulnerability: CVE-2018-20368
Description:The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
Explain the vulnerability: CVE-2018-20915
Description:cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369).
Explain the vulnerability: CVE-2018-20503
Description:Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter.
Explain the vulnerability: CVE-2018-20850
Description:Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server.
Explain the vulnerability: CVE-2018-20780
Description:Traq 3.7.1 allows admin/users/new CSRF to create an admin account (aka group_id=1).
Explain the vulnerability: CVE-2018-20000
Description:Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.
Explain the vulnerability: CVE-2018-20903
Description:cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).
Explain the vulnerability: CVE-2018-20846
Description:Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
Explain the vulnerability: CVE-2018-20145
Description:Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.
Explain the vulnerability: CVE-2018-20796
Description:In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Explain the vulnerability: CVE-2018-20779
Description:Traq 3.7.1 allows SQL Injection via a tickets?search= URI.
Explain the vulnerability: CVE-2018-20329
Description:Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information.
Explain the vulnerability: CVE-2018-20407
Description:An issue was discovered in Bento4 1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42hls.
Explain the vulnerability: CVE-2018-20057
Description:An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter.
Explain the vulnerability: CVE-2018-20811
Description:A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12.
Explain the vulnerability: CVE-2018-20391
Description:TEKNOTEL CBW700N 81.447.392110.729.024 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Explain the vulnerability: CVE-2018-20684
Description:In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.
Explain the vulnerability: CVE-2018-20309
Description:Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
Explain the vulnerability: CVE-2018-20866
Description:cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
Explain the vulnerability: CVE-2018-20165
Description:Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI.
Explain the vulnerability: CVE-2018-20535
Description:There is a use-after-free at asm/preproc.c (function pp_getline) in Netwide Assembler (NASM) 2.14rc16 that will cause a denial of service during a line-number increment attempt.
Explain the vulnerability: CVE-2018-20020
Description:LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution
Explain the vulnerability: CVE-2018-20470
Description:An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.
Explain the vulnerability: CVE-2018-20923
Description:cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377).
Explain the vulnerability: CVE-2018-20889
Description:cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).
Explain the vulnerability: CVE-2018-20098
Description:There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
Explain the vulnerability: CVE-2018-20974
Description:The js-jobs plugin before 1.0.7 for WordPress has CSRF.
Explain the vulnerability: CVE-2018-20427
Description:libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file, a different vulnerability than CVE-2018-9132.
Explain the vulnerability: CVE-2018-20348
Description:libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c.
Explain the vulnerability: CVE-2018-20827
Description:The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.
Explain the vulnerability: CVE-2018-20124
Description:hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
Explain the vulnerability: CVE-2018-20574
Description:The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
Explain the vulnerability: CVE-2018-20061
Description:A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a logged-in user; however, many ERPNext sites allow account creation via the web. No special privileges are needed to conduct the attack. By calling a JavaScript function that calls a server-side Python function with carefully chosen arguments, a SQL attack can be carried out which allows SQL queries to be constructed to return any columns from any tables in the database. This is related to /api/resource/Item?fields= URIs, frappe.get_list, and frappe.call.
Explain the vulnerability: CVE-2018-20431
Description:GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins/ole2_extractor.c.
Explain the vulnerability: CVE-2018-20962
Description:The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
Explain the vulnerability: CVE-2018-20489
Description:An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
Explain the vulnerability: CVE-2018-20173
Description:Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
Explain the vulnerability: CVE-2018-20870
Description:The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).
Explain the vulnerability: CVE-2018-20935
Description:cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412).
Explain the vulnerability: CVE-2018-20671
Description:load_specific_debug_section in objdump.c in GNU Binutils through 2.31.1 contains an integer overflow vulnerability that can trigger a heap-based buffer overflow via a crafted section size.
Explain the vulnerability: CVE-2018-20558
Description:An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the site_name parameter.
Explain the vulnerability: CVE-2018-20626
Description:PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
Explain the vulnerability: CVE-2018-20299
Description:An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow in the RCP+ parser of the web server.
Explain the vulnerability: CVE-2018-20763
Description:In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
Explain the vulnerability: CVE-2018-20333
Description:An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /update_applist.asp to see if a USB device is attached to the router and if there are apps installed on the router.
Explain the vulnerability: CVE-2018-20919
Description:cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373).
Explain the vulnerability: CVE-2018-20630
Description:PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory.
Explain the vulnerability: CVE-2018-20775
Description:admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI.
Explain the vulnerability: CVE-2018-20149
Description:In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Explain the vulnerability: CVE-2018-20237
Description:Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature.
Explain the vulnerability: CVE-2018-20372
Description:TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client.
Explain the vulnerability: CVE-2018-20958
Description:The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.
Explain the vulnerability: CVE-2018-20959
Description:Jura E8 devices lack Bluetooth connection security.
Explain the vulnerability: CVE-2018-20236
Description:There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system.
Explain the vulnerability: CVE-2018-20723
Description:A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.
Explain the vulnerability: CVE-2018-20373
Description:Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP client.
Explain the vulnerability: CVE-2018-20148
Description:In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
Explain the vulnerability: CVE-2018-20631
Description:PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file.
Explain the vulnerability: CVE-2018-20774
Description:Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.
Explain the vulnerability: CVE-2018-20918
Description:cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372).
Explain the vulnerability: CVE-2018-20298
Description:S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.
Explain the vulnerability: CVE-2018-20762
Description:GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.
Explain the vulnerability: CVE-2018-20332
Description:An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download&file= followed by a full pathname, and listing of arbitrary directories is possible with /file?action=download&dir= followed by a full pathname. This is related to plugin/controllers/file.py in the e2openplugin-OpenWebif project.
Explain the vulnerability: CVE-2018-20559
Description:An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter.
Explain the vulnerability: CVE-2018-20220
Description:An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated, and some of these pages may disclose sensitive information.
Explain the vulnerability: CVE-2018-20365
Description:LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow.
Explain the vulnerability: CVE-2018-20735
Description:An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. NOTE: the vendor disputes this because they believe it is adequate to prevent this escalation by means of a custom, non-default configuration
Explain the vulnerability: CVE-2018-20488
Description:An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.
Explain the vulnerability: CVE-2018-20172
Description:An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.
Explain the vulnerability: CVE-2018-20871
Description:In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permissions ("other" write access) occur in certain cases (GE-6890).
Explain the vulnerability: CVE-2018-20934
Description:cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).
Explain the vulnerability: CVE-2018-20467
Description:In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
Explain the vulnerability: CVE-2018-20826
Description:The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.
Explain the vulnerability: CVE-2018-20125
Description:hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings.
Explain the vulnerability: CVE-2018-20575
Description:Orange Livebox 00.96.320S devices have an undocumented /system_firmwarel.stm URI for manual firmware update. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2.
Explain the vulnerability: CVE-2018-20060
Description:urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Explain the vulnerability: CVE-2018-20430
Description:GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_extractor.c, related to EXTRACTOR_common_convert_to_utf8 in common/convert.c.
Explain the vulnerability: CVE-2018-20963
Description:The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
Explain the vulnerability: CVE-2018-20719
Description:In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
Explain the vulnerability: CVE-2018-20349
Description:The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.
Explain the vulnerability: CVE-2018-20099
Description:There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
Explain the vulnerability: CVE-2018-20133
Description:ymlref allows code injection.
Explain the vulnerability: CVE-2018-20975
Description:Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
Explain the vulnerability: CVE-2018-20426
Description:libming 0.4.8 has a NULL pointer dereference in the newVar3 function of the decompile.c file, a different vulnerability than CVE-2018-7866.
Explain the vulnerability: CVE-2018-20867
Description:cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).
Explain the vulnerability: CVE-2018-20164
Description:An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
Explain the vulnerability: CVE-2018-20534
Description:There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application
Explain the vulnerability: CVE-2018-20021
Description:LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources like CPU and RAM
Explain the vulnerability: CVE-2018-20888
Description:cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424).
Explain the vulnerability: CVE-2018-20758
Description:MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
Explain the vulnerability: CVE-2018-20685
Description:In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
Explain the vulnerability: CVE-2018-20406
Description:Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
Explain the vulnerability: CVE-2018-20056
Description:An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter.
Explain the vulnerability: CVE-2018-20797
Description:An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp.
Explain the vulnerability: CVE-2018-20778
Description:admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.
Explain the vulnerability: CVE-2018-20328
Description:Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
Explain the vulnerability: CVE-2018-20001
Description:In Libav 12.3, there is a floating point exception in the range_decode_culshift function (called from range_decode_bits) in libavcodec/apedec.c that will lead to remote denial of service via crafted input.
Explain the vulnerability: CVE-2018-20902
Description:cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408).
Explain the vulnerability: CVE-2018-20847
Description:An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.
Explain the vulnerability: CVE-2018-20144
Description:GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.
Explain the vulnerability: CVE-2018-20781
Description:In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.
Explain the vulnerability: CVE-2018-20914
Description:In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368).
Explain the vulnerability: CVE-2018-20017
Description:SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI.
Explain the vulnerability: CVE-2018-20851
Description:Helpy before 2.2.0 allows agents to edit admins.
Explain the vulnerability: CVE-2018-20386
Description:ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Explain the vulnerability: CVE-2018-20369
Description:Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. The injection point of the issue is the Add_Update module.
Explain the vulnerability: CVE-2018-20410
Description:WellinTech KingSCADA before 3.7.0.0.1 contains a stack-based buffer overflow. The vulnerability is triggered when sending a specially crafted packet to the AlarmServer (AEserver.exe) service listening on TCP port 12401.
Explain the vulnerability: CVE-2018-20943
Description:cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352).
Explain the vulnerability: CVE-2018-20806
Description:Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
Explain the vulnerability: CVE-2018-20105
Description:A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
Explain the vulnerability: CVE-2018-20742
Description:An issue was discovered in UC Berkeley RISE Opaque before 2018-12-01. There is no boundary check on ocall_malloc. The return value could be a pointer to enclave memory. It could cause an arbitrary enclave memory write.
Explain the vulnerability: CVE-2018-20312
Description:Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode.
Explain the vulnerability: CVE-2018-20607
Description:imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI.
Explain the vulnerability: CVE-2018-20484
Description:Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
Explain the vulnerability: CVE-2018-20938
Description:cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).
Explain the vulnerability: CVE-2018-20892
Description:cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).
Explain the vulnerability: CVE-2018-20345
Description:Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=<username>" query filter parameters. Enterprise editions with RBAC enabled are not affected.
Explain the vulnerability: CVE-2018-20715
Description:The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.
Explain the vulnerability: CVE-2018-20200
Description:CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967
Explain the vulnerability: CVE-2018-20650
Description:A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.
Explain the vulnerability: CVE-2018-20579
Description:Contiki-NG before 4.2 has a stack-based buffer overflow in the push function in os/lib/json/jsonparse.c that allows an out-of-bounds write of an '{' or '[' character.
Explain the vulnerability: CVE-2018-20129
Description:An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the filename=1.jpg.p*hp value.
Explain the vulnerability: CVE-2018-20980
Description:The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
Explain the vulnerability: CVE-2018-20596
Description:Jspxcms v9.0.0 allows SSRF.
Explain the vulnerability: CVE-2018-20703
Description:CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string.
Explain the vulnerability: CVE-2018-20353
Description:An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
Explain the vulnerability: CVE-2018-20646
Description:PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory.
Explain the vulnerability: CVE-2018-20095
Description:An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at excessive memory allocation, as demonstrated by mp42hls.
Explain the vulnerability: CVE-2018-20580
Description:The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
Explain the vulnerability: CVE-2018-20979
Description:The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
Explain the vulnerability: CVE-2018-20304
Description:wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argument. NOTE: this is not a Microsoft product.
Explain the vulnerability: CVE-2018-20241
Description:The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.
Explain the vulnerability: CVE-2018-20611
Description:imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.