yahoo-inc/cve-impacts huggingface dataset:
CVE-2018-11490: The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.
Key phrases: heap-based buffer overflow, denial of service, unspecified other impact, heap based buffer overflow, unspecified impact
CVE-2018-11491: ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution.
Key phrases: remote command execution, unauthenticated access
CVE-2018-11492: ASUS HG100 devices allow denial of service via an IPv4 packet flood.
Key phrases: denial of service via an IPv4 packet flood
CVE-2018-11493: An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add.
Key phrases: csrf
CVE-2018-11494: The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to execute arbitrary code if the remove step is skipped, because the attacker can discover a secret temporary directory name (containing 10 random digits) via a directory traversal attack involving language_info['code'].
Key phrases: execute arbitrary code, execute arbitrary code if the remove step is, directory traversal
CVE-2018-11495: OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\\\\model\\\\catalog\\\\download.php via admin/index.php?route=catalog/download/edit, related to the download_id. For example, an attacker can download ../../config.php.
Key phrases: the download_id, directory traversal
CVE-2018-11496: In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in read_stream in stream.c, because decompress_file in lrzip.c lacks certain size validation.
Key phrases: use-after-free, use after free
CVE-2018-11498: In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size during a memcpy in the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted input file, as well as achieve remote code execution.
Key phrases: unchecked buffer size, denial of service, remote code execution
CVE-2018-11499: A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.
Key phrases: denial of service (application crash), use-after-free, unspecified other impact, use after free, unspecified impact
CVE-2018-1150: NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists.
Key phrases: take over user accounts if the file /tmp, backdoor
CVE-2018-11500: An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account.
Key phrases: csrf
CVE-2018-11501: PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS.
Key phrases: csrf, xss
CVE-2018-11502: An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker can remotely delete all mod notes and mod note logs in the modCP and ACP via CSRF.
Key phrases: save notes and display them in a list, csrf
CVE-2018-11503: The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
Key phrases: denial of service (heap-based buffer over-read), cause a denial of service (heap-, buffer over read
CVE-2018-11504: The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
Key phrases: denial of service (heap-based buffer over-read), cause a denial of service (heap-, buffer over read
CVE-2018-11505: The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output.
Key phrases: discover the Firebase token by reading logcat output, firebase token
CVE-2018-11506: The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.
Key phrases: denial of service (stack-based buffer overflow), cause a denial of service (stack-, unspecified other impact, stack based buffer overflow, unspecified impact
CVE-2018-11507: An issue was discovered in Free Lossless Image Format (FLIF) 0.3. An attacker can trigger a long loop in image_load_pnm in image/image-pnm.cpp.
Key phrases: long loop
CVE-2018-11508: The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.
Key phrases: obtain sensitive information, obtain sensitive information from kernel memory via adjtimex
CVE-2018-11509: ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.
Key phrases: login and upload a webshell
CVE-2018-1151: The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi.
Key phrases: execute arbitrary code, execute arbitrary code or cause denial of service
CVE-2018-11510: The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.
Key phrases: remote code execution
CVE-2018-11511: The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.
Key phrases: sql injection
CVE-2018-11512: Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, stored cross-site scripting (xss)
CVE-2018-11514: PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_resume_det.php, as demonstrated by changing .docx to .php.
Key phrases: .php, unrestricted upload, dangerous type
CVE-2018-11515: The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.
Key phrases: sql injection
CVE-2018-11516: The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted .swf file.
Key phrases: denial of service (heap corruption and application crash), cause a denial of service (heap corruption, unspecified other impact, unspecified impact
CVE-2018-11517: mySCADA myPRO 7 allows remote attackers to discover all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 requests to TCP port 11010.
Key phrases: discover all ProjectIDs in a project by sending
CVE-2018-11518: A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can record these frequencies and use them for service activations. This is a request-forgery issue when the required series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the caller). In this case, the IVR system accepts an activation request from a less-secure channel (any loudspeaker in the caller's physical environment) without verifying that the request was intended (it matches a nonce sent over a more-secure channel to the caller's earpiece).
Key phrases: the caller), phreaking, request-forgery issue
CVE-2018-1152: libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
Key phrases: denial of service
CVE-2018-11522: Yosoro 1.0.4 has stored XSS.
Key phrases: xss
CVE-2018-11523: upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.
Key phrases: allows Arbitrary File Upload, arbitrary file upload
CVE-2018-11525: The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
Key phrases: csv injection
CVE-2018-11526: The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
Key phrases: csv injection
CVE-2018-11527: An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpass_save.
Key phrases: change the administrator's username and password via, cross-site request forgery (csrf)
CVE-2018-11528: WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.
Key phrases: sql injection
CVE-2018-11529: VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.
Key phrases: execute arbitrary code, use after free, denial of service conditions
CVE-2018-1153: Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic.
Key phrases: modify or view traffic, man in the middle
CVE-2018-11531: Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2018-11532: An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field.
Key phrases: xss
CVE-2018-11535: An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.
Key phrases: sql injection
CVE-2018-11536: md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2018-11537: Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
Key phrases: bypass the domain whitelist filter, bypass the domain whitelist filter via a crafted
CVE-2018-11538: servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.
Key phrases: CSRF Token Bypass, csrf, csrf token bypass
CVE-2018-1154: In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue.
Key phrases: automate the discovery of username aliases via brute, username enumeration issue, unauthorized access
CVE-2018-11541: A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privileged content via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
Key phrases: privileged content via an unspecified vector, root privilege escalation
CVE-2018-11542: A Remote Command Execution (RCE) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the execution of arbitrary commands via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
Key phrases: Build 446, remote command execution (rce), unspecified vector, arbitrary commands
CVE-2018-11543: A Local File Inclusion (LFI) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the downloading of arbitrary files via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
Key phrases: Build 446, local file inclusion (lfi), arbitrary file, unspecified
CVE-2018-11544: The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/data/com.theolivetree.ftpserver/shared_prefs/com.theolivetree.ftpserver_preferences.xml file as the prefUsername and prefUserpass strings.
Key phrases: insecure data storage
CVE-2018-11545: md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link label composed solely of backslash escapes.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2018-11546: md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.
Key phrases: heap-based buffer over-read, off-by-one error, buffer over read
CVE-2018-11547: md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandles loop termination.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2018-11548: An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connections from the same source IP address.
CVE-2018-11549: An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member" via a QQ number, as demonstrated by a form[qq_10]= substring.
Key phrases: stored xss
CVE-2018-1155: In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.
Key phrases: inject JavaScript code into an image filename parameter, cross-site scripting (xss) issue
CVE-2018-11551: AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.
Key phrases: execute arbitrary code, execute arbitrary code on a targeted system, dll hijacking
CVE-2018-11552: There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable application.
Key phrases: execute arbitrary HTML, reflected xss, arbitrary html
CVE-2018-11553: SGIN.CN xiangyun platform V9.4.10 has XSS via the login_url parameter to /login.php.
Key phrases: xss
CVE-2018-11554: The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach.
Key phrases: response discrepancy information exposure issue, brute-force approach, hijack
CVE-2018-11555: tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.
Key phrases: out-of-bounds write, out of bounds write
CVE-2018-11556: tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.
Key phrases: out-of-bounds write, out of bounds write
CVE-2018-11557: YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter.
Key phrases: xss
CVE-2018-11558: DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name parameter.
Key phrases: xss
CVE-2018-11559: DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter.
Key phrases: xss
CVE-2018-1156: Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.
Key phrases: execute arbitrary code, a remote authenticated attacker execute arbitrary code on, stack buffer overflow
CVE-2018-11560: The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.
Key phrases: buffer overflow, control-flow hijacking
CVE-2018-11561: An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER (EETHER), an Ethereum ERC20 token, will lead to an unauthorized increase of an attacker's digital assets.
Key phrases: integer overflow, unauthorized increase
CVE-2018-11562: An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.
Key phrases: reflected XSS if a user clicks on a, reflected xss
CVE-2018-11563: An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application.
Key phrases: execute arbitrary stylesheet or JavaScript
CVE-2018-11564: Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/poc.svg" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.
Key phrases: upload malicious code via the picture upload feature, stored xss, file upload
CVE-2018-11565: Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information.
Key phrases: usernames
CVE-2018-11567: Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device's hearing range. NOTE: The vendor states "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do. Customers do not need to take any action for these mitigations to work.
Key phrases: obtain transcripts of speech not intended for Alexa, empty output-speech reprompts, custom wildcard (gibberish) input slots
CVE-2018-11568: Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '<' and '>' characters have &lt; and &gt; representations.
Key phrases: reflected xss
CVE-2018-11569: Controller/ListController.php in Eventum 3.5.0 is vulnerable to Deserialization of Untrusted Data. Fixed in version 3.5.2.
Key phrases: deserialization of untrusted data
CVE-2018-1157: Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request.
Key phrases: memory exhaustion, crash, reboot
CVE-2018-11571: ClipperCMS 1.3.3 allows Session Fixation.
Key phrases: Session Fixation, session fixation
CVE-2018-11572: ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
Key phrases: xss
CVE-2018-11574: Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the `refuse-app` option are unaffected.
Key phrases: authentication bypass, integer overflow, crash, information disclosure, improper input validation
CVE-2018-11575: ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2018-11576: ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2018-11577: Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.
Key phrases: segmentation fault
CVE-2018-11578: GifIndexToTrueColor in ngiflib.c in MiniUPnP ngiflib 0.4 has a Segmentation fault.
Key phrases: segmentation fault
CVE-2018-11579: class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
Key phrases: unauthenticated settings change
CVE-2018-1158: Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.
Key phrases: stack exhaustion, crash
CVE-2018-11580: An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.
Key phrases: dos, hundreds of thousands of posts
CVE-2018-11581: Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2018-11583: SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.
Key phrases: xss
CVE-2018-11586: XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Key phrases: read arbitrary files, read arbitrary files or conduct server-side, xml external entity (xxe), server-side request forgery (ssrf), server side request forgery
CVE-2018-11587: There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.
Key phrases: remote code execution
CVE-2018-11588: Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php.
Key phrases: xss
CVE-2018-11589: Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.
Key phrases: attacks via the searchU parameter in viewLogs.php, sql injection
CVE-2018-1159: Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting.
Key phrases: memory corruption, crash
CVE-2018-11590: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflow during syntax parsing. This was addressed by fixing stack size detection on Linux in jsutils.c.
Key phrases: denial of service (application crash), cause a denial of service (application crash, integer overflow
CVE-2018-11591: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing. This was addressed by adding validation for a debug trace print statement in jsvar.c.
Key phrases: denial of service (application crash), cause a denial of service (application crash, null pointer dereference
CVE-2018-11592: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via an Out-of-bounds Read during syntax parsing in which certain height validation is missing in libs/graphics/jswrap_graphics.c.
Key phrases: denial of service (application crash), cause a denial of service (application crash, out-of-bounds read
CVE-2018-11593: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclosure with a user crafted input file via a Buffer Overflow during syntax parsing because strncpy is misused in jslex.c.
Key phrases: denial of service (application crash), cause a denial of service (application crash, information disclosure, buffer overflow
CVE-2018-11594: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing of "VOID" tokens in jsparse.c.
Key phrases: denial of service (application crash), cause a denial of service (application crash, buffer overflow
CVE-2018-11595: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Privileges with a user crafted input file via a Buffer Overflow during syntax parsing, because strncat is misused.
Key phrases: denial of service (application crash), cause a denial of service (application crash, escalation of privileges, buffer overflow
CVE-2018-11596: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because a check for '\\\\0' is made for the wrong array element in jsvar.c.
Key phrases: denial of service (application crash), cause a denial of service (application crash, buffer overflow
CVE-2018-11597: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because of a missing check for stack exhaustion with many '{' characters in jsparse.c.
Key phrases: denial of service (application crash), cause a denial of service (application crash, buffer overflow, stack exhaustion
CVE-2018-11598: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Disclosure with user crafted input files via a Buffer Overflow or Out-of-bounds Read during syntax parsing of certain for loops in jsparse.c.
Key phrases: denial of service (application crash), cause a denial of service (application crash, information disclosure, buffer overflow, out-of-bounds read
CVE-2018-1160: Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
Key phrases: achieve arbitrary code execution, out of bounds write
CVE-2018-1161: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13. Authentication is not required to exploit this vulnerability. The specific flaw exists within nvwsworker.exe. When parsing the boundary header of a multipart request, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-4215.
Key phrases: execute arbitrary code, execute arbitrary code on vulnerable installations of Quest, execute code
CVE-2018-11614: This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Intents. The issue lies in the ability to send an Intent that would not otherwise be reachable. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5361.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on vulnerable installations of Samsung Members
CVE-2018-11615: This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.
Key phrases: deny service on vulnerable installations of npm mosca, specific flaw, crash
CVE-2018-11616: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5543.
Key phrases: execute arbitrary code, execute arbitrary code on vulnerable installations of Tencent, execute code
CVE-2018-11617: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Format events for ComboBox fields. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5415.
Key phrases: execute arbitrary code, execute arbitrary code on vulnerable installations of Foxit, execute code
CVE-2018-11618: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the resetForm method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5416.
Key phrases: execute arbitrary code, execute arbitrary code on vulnerable installations of Foxit, execute code
CVE-2018-11619: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the setFocus method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5417.
Key phrases: execute arbitrary code, execute arbitrary code on vulnerable installations of Foxit, execute code
CVE-2018-1162: This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Quest NetVault Backup 11.2.0.13. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed. The specific flaw exists within the handling of Export requests. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to arbitrarily overwrite files resulting in a denial-of-service condition. Was ZDI-CAN-4222.
Key phrases: create a denial-of-service condition, arbitrarily overwrite files, denial of service
CVE-2018-11620: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5756.
Key phrases: execute arbitrary code, disclose sensitive information on vulnerable installations of Foxit
CVE-2018-11621: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5896.
Key phrases: execute arbitrary code, disclose sensitive information on vulnerable installations of Foxit
CVE-2018-11622: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-5873.
Key phrases: execute arbitrary code, execute arbitrary code on vulnerable installations of Foxit, execute code
CVE-2018-11623: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAdLayer method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6003.
Key phrases: execute arbitrary code, execute arbitrary code on vulnerable installations of Foxit, type confusion condition, execute code
CVE-2018-11624: In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file.
Key phrases: cause a use after free via a crafted
CVE-2018-11625: In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file.
Key phrases: cause a heap-based buffer over-, heap-based buffer over-read, buffer over read
CVE-2018-11626: SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys function.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2018-11627: Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Key phrases: xss
CVE-2018-11628: Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS.
Key phrases: send a crafted URL for XSS, xss
CVE-2018-11629: Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this id as not being a vulnerability because what can be done through the ports revolve around controlling lighting, not code execution. A certain set of commands are listed, which bear some similarity to code, but they are not arbitrary and do not allow admin-level control of a machine
Key phrases: gain total super user control, gain total super user control of an IoT, admin-level control of a machine, code execution
CVE-2018-1163: This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to critical functions. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4752.
Key phrases: execute arbitrary code, bypass authentication, bypass authentication on vulnerable installations of Quest NetVault
CVE-2018-11631: Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy (BLE) traffic.
Key phrases: send an arbitrary number of call or SMS, bluetooth low energy (ble) traffic
CVE-2018-11632: An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings via wp-admin/admin-post.php CSRF. There's no nonce or capability check in the whatsapp_share_setting_add_update() function.
Key phrases: spear phishing social engineering, csrf
CVE-2018-11633: An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.
Key phrases: spear phishing social engineering, cross-site request forgery (csrf)
CVE-2018-11634: Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows local users to access the web application's user passwords in cleartext by reading /var/www/xms/xmsdb/default.db.
Key phrases: access the web application's user passwords in, plaintext storage of passwords
CVE-2018-11635: Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication.
Key phrases: bypass authentication, hard-coded cryptographic key
CVE-2018-11636: Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to execute malicious and unauthorized actions.
Key phrases: execute malicious and unauthorized actions, cross-site request forgery (csrf), cross site request forgery
CVE-2018-11637: Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to read arbitrary files from the /var/ directory because a symlink exists under the web root.
Key phrases: read arbitrary files, read arbitrary files from the /var/ directory because, information leakage
CVE-2018-11638: Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to upload malicious code to the web root to gain code execution.
Key phrases: gain code execution, upload malicious code to the web root to, unrestricted upload
CVE-2018-11639: Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext.
Key phrases: access a user's password in cleartext, plaintext storage
CVE-2018-1164: This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by improper access controls that allow access to critical functions without authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-CAN-4540.
Key phrases: cause a denial-of-service condition, critical functions without authentication, denial of service, improper access control, reboot
CVE-2018-11640: XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitrary files or cause a denial of service (resource consumption).
Key phrases: read arbitrary files, denial of service (resource consumption), read arbitrary files or cause a denial of, xml external entity (xxe)
CVE-2018-11641: Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service.
Key phrases: interact with a web service, hard-coded credentials
CVE-2018-11642: Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS through 3.5 allows local users to execute code as the root user.
Key phrases: execute code as the root user, incorrect permission assignment
CVE-2018-11643: SQL injection vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to execute arbitrary SQL commands via the filterPattern parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the filterPattern parameter, sql injection
CVE-2018-11645: psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.
Key phrases: determine the existence and size of arbitrary files
CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.
Key phrases: application crash
CVE-2018-11647: index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.
Key phrases: xss
CVE-2018-11649: Hue 3.12 has XSS via the /pig/save/ name and script parameters.
Key phrases: xss
CVE-2018-1165: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMB_IOC_SVCENUM IOCTL. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4983.
Key phrases: obtain the ability to execute low-privileged, escalate privileges on vulnerable installations of Joyent SmartOS, execute code
CVE-2018-11650: Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.
Key phrases: xss security issue
CVE-2018-11651: Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.
Key phrases: xss security issue