yahoo-inc/cve-impacts huggingface dataset:
CVE-2018-16226: A vulnerability in the web admin component of Mitel MiVoice Office 400, versions R5.0 HF3 (v8839a1) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack, due to insufficient validation for the start.asp page. A successful exploit could allow the attacker to execute arbitrary scripts to access sensitive browser-based information.
Key phrases: execute arbitrary scripts, conduct a reflected cross-site scripting (, execute arbitrary scripts to access sensitive browser-, reflected cross-site scripting (xss), sensitive browser-based information
CVE-2018-16227: The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.
Key phrases: buffer over-read, buffer over read
CVE-2018-16228: The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().
Key phrases: buffer over-read, buffer over read
CVE-2018-16229: The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().
Key phrases: buffer over-read, buffer over read
CVE-2018-1623: IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 144408.
Key phrases: be stored locally which can be read by
CVE-2018-16230: The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).
Key phrases: buffer over-read, buffer over read
CVE-2018-16231: Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (daemon crash) via an unspecified sequence of FTP commands.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash, unspecified
CVE-2018-16232: An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with privileges for the affected page to execute arbitrary commands.
Key phrases: execute arbitrary commands, command injection
CVE-2018-16233: MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
Key phrases: xss
CVE-2018-16234: MorningStar WhatWeb 0.4.9 has XSS via JSON report files.
Key phrases: xss
CVE-2018-16235: Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget.
Key phrases: xss
CVE-2018-16236: cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.
Key phrases: XSS via a crafted filename in the logs, xss
CVE-2018-16237: An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI.
Key phrases: directory traversal
CVE-2018-16238: An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file.
Key phrases: remote code execution
CVE-2018-16239: An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.
CVE-2018-16242: oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol.
Key phrases: bypass the locking mechanism by using Bluetooth Low Energy, predictable nonce
CVE-2018-16243: SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen.
Key phrases: xss, logviewer.iwc, centralmanage.cen, useradministration.iwc, database.iwc, alertmanagement.iwc, eventannotations.iwc
CVE-2018-16247: YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter.
Key phrases: xss
CVE-2018-16248: b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.
Key phrases: inject arbitrary Web scripts or HTML, inject arbitrary Web scripts or HTML via a, xss, arbitrary web script
CVE-2018-16249: In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Key phrases: remote attacks, xss
CVE-2018-1625: IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 144410.
Key phrases: sensitive information
CVE-2018-16250: The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first name" and "last name" parameters.
Key phrases: xss
CVE-2018-16251: A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters.
Key phrases: injection issue
CVE-2018-16252: FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
Key phrases: xml external entity injection
CVE-2018-16253: In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509 certificates. This is an even more permissive variant of CVE-2006-4790 and CVE-2014-1568.
CVE-2018-16254: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Key phrases: xss
CVE-2018-16255: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Key phrases: xss
CVE-2018-16256: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Key phrases: xss
CVE-2018-16257: There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Key phrases: xss
CVE-2018-16258: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Key phrases: xss
CVE-2018-16259: There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Key phrases: xss
CVE-2018-1626: IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 144411.
Key phrases: session fixation hijacking
CVE-2018-16261: In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Trust.
Key phrases: privilege escalation
CVE-2018-16262: The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations. Such actions include installing, decrypting, and killing other packages. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: perform package management actions, unprivileged process, improper d-bus security policy configurations
CVE-2018-16263: The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: control its A2DP MediaEndpoint, unprivileged process, improper d-bus security policy configurations
CVE-2018-16264: The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: partially control Bluetooth or acquire sensitive information, unprivileged process, improper d-bus security policy configurations
CVE-2018-16265: The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing process, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: create a system user interface and control the, unprivileged process, d-bus security policy configurations
CVE-2018-16266: The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: fully control or capture windows, unprivileged process
CVE-2018-16267: The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: perform popup-related system actions, unprivileged process, arbitrary strings
CVE-2018-16268: The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security policy configurations. Such actions include playing an arbitrary sound file or DTMF tones. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: perform media-related system actions, unprivileged process
CVE-2018-16269: The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: take over the internal notification message data, unprivileged process
CVE-2018-16270: Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
Key phrases: dump Bluetooth HCI packets to an arbitrary file, unprivileged process, arbitrary file path
CVE-2018-16271: The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: manipulate a user's mailbox, unprivileged process, d-bus security policy configurations
CVE-2018-16272: The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Key phrases: fully control the Wi-Fi interface
CVE-2018-16275: OPSWAT MetaDefender before v4.11.2 allows CSV injection.
Key phrases: CSV injection, csv injection
CVE-2018-16276: An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges.
Key phrases: user access read writes, incorrect bounds checking, escalate privileges, crash
CVE-2018-16277: The Image Import function in XWiki through 10.7 has XSS.
Key phrases: xss
CVE-2018-16278: phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajax_save_draft function with the dir parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the diy/
CVE-2018-16281: The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control.
Key phrases: incorrect access control
CVE-2018-16282: A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands with root privilege via, command injection, arbitrary os command
CVE-2018-16283: The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
Key phrases: Directory Traversal via the Image.php url parameter, directory traversal
CVE-2018-16285: The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
Key phrases: wp-admin/admin-ajax.php, xss
CVE-2018-16286: LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits.
Key phrases: bypass because the CAPTCHA requirement, authentication bypass, four digits
CVE-2018-16287: LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs.
Key phrases: file upload via signEzUI/playlist/edit
CVE-2018-16288: LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.
Key phrases: reading of arbitrary files via signEzUI/playlist
CVE-2018-16291: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Key phrases: use-after-free, arbitrary code execution, malicious site, use after free
CVE-2018-16292: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Key phrases: use-after-free, arbitrary code execution, malicious site, use after free
CVE-2018-16293: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Key phrases: use-after-free, arbitrary code execution, malicious site, use after free
CVE-2018-16294: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16295, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Key phrases: use-after-free, arbitrary code execution, malicious site, use after free
CVE-2018-16295: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Key phrases: use-after-free, arbitrary code execution, malicious site, use after free
CVE-2018-16296: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Key phrases: use-after-free, arbitrary code execution, malicious site, use after free
CVE-2018-16297: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, and CVE-2018-16296. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Key phrases: use-after-free, arbitrary code execution, malicious site, use after free
CVE-2018-16298: An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.
Key phrases: xss
CVE-2018-16299: The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
Key phrases: Directory Traversal via the ajax/include.php file, directory traversal
CVE-2018-1630: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onmode. IBM X-Force ID: 144430.
Key phrases: gain root privileges, gain root privileges through a symbolic link vulnerability
CVE-2018-16300: The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion.
Key phrases: stack consumption in print-bgp.c:bgp_attr_print, unlimited recursion
CVE-2018-16301: The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.
Key phrases: buffer overflow
CVE-2018-16302: MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file.
Key phrases: buffer overflow
CVE-2018-16303: PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.
Key phrases: denial of service (resource consumption), cause a denial of service (resource consumption
CVE-2018-16307: An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name (containing a random string) is used in the HTTP Host header, the application performs an HTTP request to the specified domain. The response from that request is then included in the application's own response.
Key phrases: out-of-band resource load
CVE-2018-16308: The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
Key phrases: CSV injection, csv injection
CVE-2018-1631: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in oninit mongohash. IBM X-Force ID: 144431.
Key phrases: gain root privileges, gain root privileges through a symbolic link vulnerability
CVE-2018-16310: Technicolor TG588V V2 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by macof. NOTE: this might overlap CVE-2018-15852 and CVE-2018-15907. NOTE: Technicolor denies that the described behavior is a vulnerability and states that Wi-Fi traffic is slowed or stopped only while the devices are exposed to a MAC flooding attack. This has been confirmed through testing against official up-to-date versions
Key phrases: denial of service (networking outage), cause a denial of service (networking outage, wi-fi traffic, mac flooding
CVE-2018-16313: Bludit 2.3.4 allows XSS via a user name.
Key phrases: XSS via a user name, xss
CVE-2018-16314: An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.
CVE-2018-16315: In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.
Key phrases: csrf
CVE-2018-16316: A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
Key phrases: inject arbitrary JavaScript, inject arbitrary JavaScript and/or HTML via the Team, cross-site scripting (xss)
CVE-2018-1632: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in .infxdirs. IBM X-Force ID: 144432.
Key phrases: gain root privileges, gain root privileges through a symbolic link vulnerability
CVE-2018-16320: idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.
Key phrases: admincp.php?app=config Directory Traversal, directory traversal
CVE-2018-16323: ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.
Key phrases: sensitive information, information leak
CVE-2018-16324: In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
Key phrases: xss
CVE-2018-16325: There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.
Key phrases: xss
CVE-2018-16326: PHP Scripts Mall Olx Clone 3.4.2 has XSS.
Key phrases: xss
CVE-2018-16327: There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.
Key phrases: stored xss
CVE-2018-16328: In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c.
Key phrases: null pointer dereference
CVE-2018-16329: In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c.
Key phrases: null pointer dereference
CVE-2018-1633: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onsrvapd. IBM X-Force ID: 144434.
Key phrases: gain root privileges, gain root privileges through a symbolic link vulnerability
CVE-2018-16330: Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
Key phrases: XSS via crafted attributes of an invalid IMG, xss
CVE-2018-16331: admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.
Key phrases: change the administrator account's password, csrf
CVE-2018-16332: An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability.
Key phrases: csrf
CVE-2018-16333: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server. While processing the ssid parameter for a POST request, the value is directly used in a sprintf call to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.
Key phrases: buffer overflow
CVE-2018-16334: An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection.
Key phrases: os command injection
CVE-2018-16335: newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
Key phrases: denial of service (heap-based buffer overflow and application crash), cause a denial of service (heap-, unspecified other impact, heap based buffer overflow, unspecified impact
CVE-2018-16336: Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999.
Key phrases: denial of service (heap-based buffer over-read), cause a denial of service (heap-, buffer over read
CVE-2018-16337: An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save.
Key phrases: csrf
CVE-2018-16338: An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic.
Key phrases: csrf
CVE-2018-16339: An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser.
Key phrases: csrf
CVE-2018-1634: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in infos.DBSERVERNAME. IBM X-Force ID: 144437.
Key phrases: gain root privileges, gain root privileges through a symbolic link vulnerability
CVE-2018-16342: ShowDoc v1.8.0 has XSS via a new page.
Key phrases: xss
CVE-2018-16343: SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.
Key phrases: execute arbitrary code, execute arbitrary code because parseIf() in
CVE-2018-16344: An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock.
Key phrases: delete arbitrary files, delete arbitrary files via directory traversal sequences in, database access
CVE-2018-16345: An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent.
Key phrases: csrf
CVE-2018-16346: ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
Key phrases: xss
CVE-2018-16347: An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize.
Key phrases: xss
CVE-2018-16348: SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
Key phrases: xss
CVE-2018-16349: WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter.
Key phrases: xss
CVE-2018-1635: Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144439.
Key phrases: execute predefined code with root privileges, stack-based buffer overflow, stack based buffer overflow
CVE-2018-16350: WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.
Key phrases: xss
CVE-2018-16352: There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used.
Key phrases: php code upload
CVE-2018-16353: An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter.
Key phrases: sql injection
CVE-2018-16354: An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter.
Key phrases: sql injection
CVE-2018-16356: An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter.
Key phrases: sql injection
CVE-2018-16357: An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter.
Key phrases: sql injection
CVE-2018-16358: A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.
Key phrases: upload HTML content containing an XSS payload with, cross-site scripting (xss), xss payload
CVE-2018-16359: Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows attackers to rename files on the host OS.
Key phrases: rename files on the host OS
CVE-2018-1636: Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144441.
Key phrases: execute predefined code with root privileges, stack-based buffer overflow, stack based buffer overflow
CVE-2018-16361: An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.
Key phrases: XSS via the id parameter, xss
CVE-2018-16362: An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of arbitrary code (if CSP settings permit it) via repo_manage_page.php or list.php.
Key phrases: execution of arbitrary code (if CSP settings, cross-site scripting (xss)
CVE-2018-16363: The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\\\\wpfilemanager.php.
Key phrases: xss
CVE-2018-16364: A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.
Key phrases: for remote code execution on Windows via a, serialization
CVE-2018-16365: An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF.
Key phrases: CSRF, csrf
CVE-2018-16366: An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF.
Key phrases: CSRF, csrf
CVE-2018-16367: In OnlineJudge 2.0, the sandbox has an incorrect access control vulnerability that can write a file anywhere. A user can write a directory listing to /tmp, and can leak file data with a #include.
Key phrases: incorrect access control, to write files, directory list
CVE-2018-16368: SplashXPath::strokeAdjust in splash/SplashXPath.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm.
Key phrases: denial of service (heap-based buffer over-read), cause a denial of service (heap-, buffer over read
CVE-2018-16369: XRef::fetch in XRef.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (stack consumption) via a crafted pdf file, related to AcroForm::scanField, as demonstrated by pdftohtml. NOTE: this might overlap CVE-2018-7453.
Key phrases: denial of service (stack consumption), cause a denial of service (stack consumption
CVE-2018-16370: In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive.
Key phrases: execute arbitrary PHP code
CVE-2018-16371: PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=User_group&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=.
Key phrases: xss
CVE-2018-16372: The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued.
Key phrases: reflected xss
CVE-2018-16373: Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.
Key phrases: upload
CVE-2018-16374: Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.
Key phrases: xss
CVE-2018-16375: An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c can lead to a heap-based buffer overflow.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2018-16376: An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
Key phrases: heap-based buffer overflow, out-of-bounds write, remote denial of service, unspecified other impact, heap based buffer overflow, out of bounds write, unspecified impact
CVE-2018-16379: Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen.
Key phrases: xss
CVE-2018-1638: IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483.
CVE-2018-16380: An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account.
Key phrases: csrf
CVE-2018-16381: e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter.
Key phrases: xss
CVE-2018-16382: Netwide Assembler (NASM) 2.14rc15 has a buffer over-read in x86/regflags.c.
Key phrases: buffer over-read, buffer over read
CVE-2018-16384: A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.
Key phrases: bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set, SQL injection bypass, sql injection bypass
CVE-2018-16385: ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.
Key phrases: SQL Injection via the public/index/, sql injection
CVE-2018-16386: An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection (and an arbitrary log filename) can be achieved via the PATH_INFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error messages.
Key phrases: log injection
CVE-2018-16387: An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add.
Key phrases: csrf
CVE-2018-16388: e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by uploading a .php
CVE-2018-16389: e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter.
Key phrases: SQL injection via the old_ip parameter, sql injection
CVE-2018-1639: The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579.
Key phrases: obtain sensitive information, obtain sensitive information beyond its assigned privileges
CVE-2018-16391: Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), buffer overflows, unspecified other impact, unspecified impact
CVE-2018-16392: Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), buffer overflows, unspecified other impact, unspecified impact
CVE-2018-16393: Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), buffer overflows, unspecified other impact, unspecified impact
CVE-2018-16395: An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
Key phrases: illegitimate certificate
CVE-2018-16396: An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
Key phrases: tainted strings
CVE-2018-16397: In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,
Key phrases: arbitrary file, file upload
CVE-2018-16398: In Twistlock AuthZ Broker 0.1, regular expressions are mishandled, as demonstrated by containers/aa/pause?aaa=\\\\/start to bypass a policy in which "docker start" is allowed but "docker pause" is not allowed.
Key phrases: bypass a policy
CVE-2018-1640: IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 144580.
Key phrases: execute arbitrary commands, execute arbitrary commands on the system
CVE-2018-16402: libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.
Key phrases: denial of service (double free and application crash), cause a denial of service (double free, unspecified other impact, unspecified impact
CVE-2018-16403: libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.
Key phrases: heap-based buffer over-read, application crash, buffer over read
CVE-2018-16405: An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.
Key phrases: xss
CVE-2018-16406: An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.
Key phrases: xss
CVE-2018-16407: An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.
Key phrases: xss
CVE-2018-16408: D-Link DIR-846 devices with firmware 100.26 allow remote attackers to execute arbitrary code as root via a SetNetworkTomographySettings request by leveraging admin access.
Key phrases: execute arbitrary code, execute arbitrary code as root via a SetNetworkTomographySettings, admin access
CVE-2018-16409: In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF.
Key phrases: send arbitrary HTTP GET requests, ssrf
CVE-2018-16410: Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php.
Key phrases: /profile/deleteInvitation, sql injection
CVE-2018-16412: ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2018-16413: ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2018-16416: Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.
Key phrases: change the administrator's password, cross-site request forgery (csrf), cross site request forgery
CVE-2018-16417: Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command injection.
Key phrases: Command injection, command injection
CVE-2018-16418: A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), buffer overflow, unspecified other impact, unspecified impact
CVE-2018-16419: Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), buffer overflows, unspecified other impact, unspecified impact
CVE-2018-16420: Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), buffer overflows, unspecified other impact, unspecified impact
CVE-2018-16421: Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), buffer overflows, unspecified other impact, unspecified impact
CVE-2018-16422: A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), single byte buffer overflow, unspecified other impact, unspecified impact
CVE-2018-16423: A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Key phrases: denial of service (application crash), double free, unspecified other impact, unspecified impact