admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-07-29 05:56:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Synchronized data.

Browse Source
This commit is contained in:
CVE Team 2018-04-20 14:03:25 -04:00
parent b1e93415dc
commit fcebd1fddd
No known key found for this signature in database
GPG Key ID: 0DA1F9F56BC892E8
5 changed files with 73 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
2018/10xxx/CVE-2018-10250.json Normal file
View File

@ -0,0 +1,62 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-10250",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "n/a",
"version" : {
"version_data" : [
{
"version_value" : "n/a"
}
]
}
}
]
},
"vendor_name" : "n/a"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixin_category action, aka a WeChat Classified Management keyword search."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "n/a"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "https://github.com/idreamsoft/iCMS/issues/22",
"refsource" : "MISC",
"url" : "https://github.com/idreamsoft/iCMS/issues/22"
}
]
}
}

2
2018/1xxx/CVE-2018-1289.json
View File

@ -63,6 +63,8 @@
"references" : {
"reference_data" : [
{
"name" : "[dev] 20180419 [SECURITY] CVE-2018-1289: Apache Fineract SQL Injection Vulnerability by orderBy and sortOrder parameters",
"refsource" : "MLIST",
"url" : "https://lists.apache.org/thread.html/4a1312b18ed2979fba9e2df07839e6a940eeeea12ed9154db1a49a5a@%3Cdev.fineract.apache.org%3E"
}
]

4
2018/1xxx/CVE-2018-1290.json
View File

@ -44,7 +44,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injection. This could be done in Methods like retrieveAuditEntries of AuditsApiResource Class and retrieveCommands of MakercheckersApiResource Class"
"value" : "In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injection. This could be done in Methods like retrieveAuditEntries of AuditsApiResource Class and retrieveCommands of MakercheckersApiResource Class."
}
]
},
@ -63,6 +63,8 @@
"references" : {
"reference_data" : [
{
"name" : "[dev] 20180419 [SECURITY] CVE-2018-1290: Apache Fineract SQL Injection Vulnerability - Single quotation escape caused by two continuous SQL parameters",
"refsource" : "MLIST",
"url" : "https://lists.apache.org/thread.html/69cc2b54b32f0936f40dc9be41f41fe1566710a75edbe2eb0a948ae4@%3Cdev.fineract.apache.org%3E"
}
]

4
2018/1xxx/CVE-2018-1291.json
View File

@ -44,7 +44,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' which are appended directly with SQL statements. A hacker/user can inject/draft the 'orderBy' query parameter by way of the \"order\" param in such a way toto read/update the data for which he doesn't have authorization."
"value" : "Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' which are appended directly with SQL statements. A hacker/user can inject/draft the 'orderBy' query parameter by way of the \"order\" param in such a way to read/update the data for which he doesn't have authorization."
}
]
},
@ -63,6 +63,8 @@
"references" : {
"reference_data" : [
{
"name" : "[dev] 20180419 [SECURITY] CVE-2018-1291: Apache Fineract SQL Injection Vulnerability - Order by injection via Order Param",
"refsource" : "MLIST",
"url" : "https://lists.apache.org/thread.html/1f7fadc93500b3fe14603b132b13c18fff3d0a35e50ebd0246f325c0@%3Cdev.fineract.apache.org%3E"
}
]

4
2018/1xxx/CVE-2018-1292.json
View File

@ -44,7 +44,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating , a hacker could inject SQL to read/update data for which he doesn't have authorization for by way of the 'reportName' parameter."
"value" : "Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn't have authorization for by way of the 'reportName' parameter."
}
]
},
@ -63,6 +63,8 @@
"references" : {
"reference_data" : [
{
"name" : "[dev] 20180419 [SECURITY] CVE-2018-1292: Apache Fineract SQL Injection Vulnerability - Injection via reportName parameter",
"refsource" : "MLIST",
"url" : "https://lists.apache.org/thread.html/a24610817845d022d5fe89cfe21563ef83bea35ca95de867cd2c4ee9@%3Cdev.fineract.apache.org%3E"
}
]