admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-06-08 22:18:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'DWF-2018-07-20-02' of https://github.com/distributedweaknessfiling/cvelist

Browse Source
This commit is contained in:
CVE Team 2018-07-23 11:08:22 -04:00
commit 60a4484f86
No known key found for this signature in database
GPG Key ID: 0DA1F9F56BC892E8
3 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
2018/1999xxx/CVE-2018-1999022.json Normal file
View File

@ -0,0 +1 @@
{ "CVE_data_meta": { "ASSIGNER": "kurt@seifried.org", "DATE_ASSIGNED": "2018-07-22T01:05:34.777936", "DATE_REQUESTED": "2018-07-19T23:25:02", "ID": "CVE-2018-1999022", "REQUESTER": "pear-group@php.net" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "HTML_QuickForm", "version": { "version_data": [ { "version_value": "3.2.14" } ] } } ] }, "vendor_name": "PEAR" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "eval injection (CWE-95)" } ] } ] }, "references": { "reference_data": [ { "url": "http://blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform/" }, { "url": "https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform" } ] } }

1
2018/1999xxx/CVE-2018-1999023.json Normal file
View File

@ -0,0 +1 @@
{ "CVE_data_meta": { "ASSIGNER": "kurt@seifried.org", "DATE_ASSIGNED": "2018-07-22T01:05:34.780576", "DATE_REQUESTED": "2018-07-21T05:38:45", "ID": "CVE-2018-1999023", "REQUESTER": "shadowm2006@gmail.com" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "The Battle for Wesnoth", "version": { "version_data": [ { "version_value": "1.7.0 - 1.14.3" } ] } } ] }, "vendor_name": "The Battle for Wesnoth Project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Code Injection" } ] } ] }, "references": { "reference_data": [ { "url": "https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380" } ] } }

1
2018/1999xxx/CVE-2018-1999024.json Normal file
View File

@ -0,0 +1 @@
{ "CVE_data_meta": { "ASSIGNER": "kurt@seifried.org", "DATE_ASSIGNED": "2018-07-22T01:05:34.781792", "DATE_REQUESTED": "2018-07-21T09:23:02", "ID": "CVE-2018-1999024", "REQUESTER": "thomas@kluyver.me.uk" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "MathJax", "version": { "version_data": [ { "version_value": "prior to version 2.7.4" } ] } } ] }, "vendor_name": "MathJax" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \\unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Cross Site Scripting (XSS)" } ] } ] }, "references": { "reference_data": [ { "url": "https://blog.bentkowski.info/2018/06/xss-in-google-colaboratory-csp-bypass.html" }, { "url": "https://github.com/mathjax/MathJax/commit/a55da396c18cafb767a26aa9ad96f6f4199852f1" } ] } }