yahoo-inc/cve-impacts huggingface dataset:
CVE-2018-0536: Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz.cgi.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via quiz.cgi, cross-site scripting
CVE-2018-0537: Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz_op.cgi.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via quiz_op.cgi, cross-site scripting
CVE-2018-0538: Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0539: QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors.
Key phrases: execute arbitrary commands, execute arbitrary commands via unspecified vectors
CVE-2018-0540: Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0541: Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code via unspecified vectors.
Key phrases: execute arbitrary code, cause a denial-of-service (, buffer overflow, denial-of-service (dos) condition, unspecified vectors, denial of service
CVE-2018-0542: Directory traversal vulnerability in WebProxy version 1.7.8 allows an attacker to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2018-0543: Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0544: Untrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0545: LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via unspecified vectors, arbitrary os command
CVE-2018-0546: Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0547: Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0548: Cybozu Garoon 4.0.0 to 4.6.0 allows remote authenticated attackers to bypass access restriction to view the closed title of "Space" via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction to view the closed title, unspecified vectors
CVE-2018-0549: Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0550: Cybozu Garoon 3.5.0 to 4.6.1 allows remote authenticated attackers to bypass access restriction to view the closed title of "Cabinet" via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction to view the closed title, unspecified vectors
CVE-2018-0551: Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0552: Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver. 5.1.26 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0553: The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing
CVE-2018-0554: Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.
Key phrases: execute arbitrary commands, bypass authentication, bypass authentication and execute arbitrary commands on the, unspecified vectors
CVE-2018-0555: Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file.
Key phrases: execute arbitrary code, execute arbitrary code via a specially crafted file, buffer overflow
CVE-2018-0556: Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via unspecified vectors, buffalo, arbitrary os command
CVE-2018-0557: Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'E-mail Details Screen' via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML 'E, cross-site scripting, unspecified vectors
CVE-2018-0558: Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML in ', cross-site scripting, unspecified vectors
CVE-2018-0559: Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML 'Address, cross-site scripting, unspecified vectors
CVE-2018-0560: Hatena Bookmark App for iOS Version 3.0 to 3.70 allows remote attackers to spoof the address bar via vectors related to URL display.
Key phrases: spoof the address bar via vectors related to, url display, spoofing
CVE-2018-0561: Untrusted search path vulnerability in The installer of PhishWall Client Internet Explorer edition Ver. 3.7.15 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0562: Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0563: Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0564: Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15) allows remote attackers to perform arbitrary operations via unspecified vectors.
Key phrases: perform arbitrary operations, perform arbitrary operations via unspecified vectors, session fixation
CVE-2018-0565: Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0566: Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors.
Key phrases: bypass authentication, obtain the schedules without access, bypass authentication to obtain the schedules without access, unspecified vectors
CVE-2018-0567: Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction to access and write non, unspecified vectors
CVE-2018-0568: Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via unspecified vectors, unrestricted file upload
CVE-2018-0569: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via unspecified vectors, arbitrary os commands
CVE-2018-0570: Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0571: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
Key phrases: upload arbitrary files
CVE-2018-0572: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction to view or alter a, unspecified vectors
CVE-2018-0573: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction for a content to view, unspecified vectors, file upload
CVE-2018-0574: Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0575: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction in mail form to view, unspecified vectors, file upload
CVE-2018-0576: Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0577: Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0578: Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0579: Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0580: Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (for Windows) Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER (for Windows) Ver.1.6.3 and earlier, with its timestamp prior to April 25, 2018, 17:02:49) allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0581: Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0582: Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0583: Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0584: IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication [effect_of_bypassing_authentication] via unspecified vectors.
Key phrases: bypass authentication, bypass authentication [effect_of_bypassing_authentication] via unspecified vectors
CVE-2018-0585: Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0586: Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2018-0587: Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.
Key phrases: upload arbitrary image files, upload arbitrary image files via unspecified vectors, unrestricted file upload
CVE-2018-0588: Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2018-0589: Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction to add a new form, unspecified vectors
CVE-2018-0590: Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction to modify the other users, unspecified vectors
CVE-2018-0591: The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing
CVE-2018-0592: Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0593: Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0594: Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0595: Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0596: Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0597: Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0598: Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0599: Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0600: Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0601: Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0602: Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0603: Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0604: Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.
Key phrases: remote code execution via unspecified vectors
CVE-2018-0605: Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0606: SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2018-0607: SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.
Key phrases: execute arbitrary code, denial of service (DoS), execute arbitrary code or cause a denial of, buffer overflow, denial of service (dos), unspecified vectors
CVE-2018-0609: Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0610: Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code or obtain sensitive information, local file inclusion
CVE-2018-0611: The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing
CVE-2018-0612: Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0613: NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D 01.03.00 and earlier, CSDJ-A 03.00.00) allows remote authenticated attackers to bypass access restriction to conduct arbitrary operations with administrative privilege via unspecified vectors.
Key phrases: conduct arbitrary operations, bypass access restriction, bypass access restriction to conduct arbitrary operations with, unspecified vectors
CVE-2018-0614: Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D 01.03.00 and earlier, CSDJ-A 03.00.00) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0617: Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2018-0618: Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0619: Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0620: Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0621: Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0622: The DHC Online Shop App for Android version 3.2.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing
CVE-2018-0623: Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver. 20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of msjet49.dll loaded by the vulnerable products.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0624: Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series Ver.20.0.2 and earlier, and Yayoi Kokyaku Kanri 17 Ver.11.0.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This flaw exists within the handling of ykkapi.dll loaded by the vulnerable products.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0625: Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via formSysCmd parameter, arbitrary os command
CVE-2018-0626: Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via sysCmd in formWsc, arbitrary os command
CVE-2018-0627: Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via targetAPSsid parameter, targetapssid parameter, arbitrary os command
CVE-2018-0628: Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via HTTP request and, arbitrary os command
CVE-2018-0629: Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via HTTP request and, arbitrary os command
CVE-2018-0630: Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via sysCmd parameter, arbitrary os command
CVE-2018-0631: Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via targetAPSsid parameter, arbitrary os command
CVE-2018-0632: Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response.
Key phrases: execute arbitrary code, execute arbitrary code via HTTP request and response, buffer overflow
CVE-2018-0633: Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.
Key phrases: execute arbitrary code, execute arbitrary code via submit-url parameter, buffer overflow
CVE-2018-0634: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via FactoryPassword parameter or, arbitrary os command
CVE-2018-0635: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via filename parameter, arbitrary os command
CVE-2018-0636: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via FactoryPassword parameter of, arbitrary os command
CVE-2018-0637: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via export.cgi encKey parameter, arbitrary os command
CVE-2018-0638: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via import.cgi encKey parameter, arbitrary os command
CVE-2018-0639: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time parameter, and offset parameter.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via tools_firmware.cgi date parameter, arbitrary os command
CVE-2018-0640: Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, time parameter, and offset parameter.
Key phrases: execute arbitrary code, execute arbitrary code via netWizard.cgi date parameter, buffer overflow
CVE-2018-0641: Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter, time parameter, and offset parameter.
Key phrases: execute arbitrary code, execute arbitrary code via tools_system.cgi date parameter, buffer overflow
CVE-2018-0642: Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0643: Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-server) 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via unspecified vectors, arbitrary os command
CVE-2018-0644: Buffer overflow in Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-client2) 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 5.0.0 (panda-client2) 1:2.0.0+p48-u4jma1 and earlier, and Ubuntu16.04 ORCA (Online Receipt Computer Advantage) 5.0.0 (panda-client2) 1:2.0.0+p48-u5jma1 and earlier allows authenticated attackers to cause denial-of-service (DoS) condition via unspecified vectors.
Key phrases: cause denial-of-service (DoS, buffer overflow, denial-of-service (dos) condition, unspecified vectors, denial of service
CVE-2018-0645: MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors.
Key phrases: remote PHP code execution via unspecified vectors, remote php code execution
CVE-2018-0646: Directory traversal vulnerability in Explzh v.7.58 and earlier allows an attacker to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2018-0647: Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2018-0648: Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0649: Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0650: The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing
CVE-2018-0651: Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and earlier, STARDOM FCN/FCJ Simulator R4.20 and earlier, ASTPLANNER R15.01 and earlier, TriFellows V5.04 and earlier) allows remote attackers to stop the license management function or execute an arbitrary program via unspecified vectors.
Key phrases: stop the license management function or execute an, buffer overflow, arbitrary program, unspecified vectors, execute arbitrary
CVE-2018-0652: Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting
CVE-2018-0653: Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Wiki, cross-site scripting
CVE-2018-0654: Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting
CVE-2018-0655: Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting
CVE-2018-0656: Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0657: Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0658: Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier allows an attacker with administrative rights to execute arbitrary PHP code on the server via unspecified vectors.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code on the server via, input validation issue, unspecified vectors
CVE-2018-0659: Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing files via specially crafted ATC file.
Key phrases: create or overwrite existing files via specially crafted, directory traversal
CVE-2018-0660: Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file.
Key phrases: create arbitrary files, create arbitrary files via specially crafted ATC file, directory traversal
CVE-2018-0661: Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to bypass access restriction to add files on a specific directory that may result in executing arbitrary OS commands/code or information including credentials leakage or alteration.
Key phrases: executing arbitrary OS commands, bypass access restriction, bypass access restriction to add files on a, credentials leakage, alteration, execute arbitrary
CVE-2018-0662: Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to add malicious files on the device and execute arbitrary code.
Key phrases: execute arbitrary code, add malicious files on the device and execute
CVE-2018-0663: Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) use hardcoded credentials which may allow an remote authenticated attacker to execute arbitrary OS commands on the device via unspecified vector.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands on the device via, hardcoded credentials, unspecified vector, arbitrary os command
CVE-2018-0664: A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors.
Key phrases: alter environment variables via unspecified vectors
CVE-2018-0665: Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0666.
Key phrases: embed arbitrary scripts, embed arbitrary scripts to the configuration data through
CVE-2018-0666: Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0665.
Key phrases: embed arbitrary scripts, embed arbitrary scripts to the configuration data through
CVE-2018-0667: Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2018-0668: Buffer overflow in INplc-RT 3.08 and earlier allows remote attackers to cause denial-of-service (DoS) condition that may result in executing arbtrary code via unspecified vectors.
Key phrases: cause denial-of-service (DoS, buffer overflow, denial-of-service (dos) condition, unspecified vectors, denial of service
CVE-2018-0669: INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0670.
Key phrases: bypass authentication, bypass authentication to execute an arbitrary command through, execute arbitrary, arbitrary commands
CVE-2018-0670: INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0669.
Key phrases: bypass authentication, bypass authentication to execute an arbitrary command through, execute arbitrary, arbitrary commands
CVE-2018-0671: Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on the Windows system via unspecified vectors.
Key phrases: execute arbitrary code, execute arbitrary code on the Windows system via, privilege escalation, unspecified vectors
CVE-2018-0672: Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2018-0673: Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2018-0674: AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.
Key phrases: an arbitrary script execution via unspecified vectors
CVE-2018-0675: AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.
Key phrases: an arbitrary script execution via unspecified vectors
CVE-2018-0676: BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and execute an arbitrary command via unspecified vectors.
Key phrases: bypass authentication, bypass authentication to access to the management screen, execute arbitrary, arbitrary commands, unspecified
CVE-2018-0677: BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS commands via unspecified vectors.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via unspecified vectors, arbitrary os command
CVE-2018-0678: Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via unspecified vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, buffer overflow
CVE-2018-0679: Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions) allows attacker with administrator rights to inject arbitrary web script or HTML via the administrative page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting
CVE-2018-0680: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to read/send mail or change the configuration.
Key phrases: read/send mail or change the configuration, hard-coded credentials, read send mail, hard coded credentials
CVE-2018-0681: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to login to the Management page and change the configuration.
Key phrases: login to the Management page and change the, hard-coded credentials, hard coded credentials