{"vulnerability": "2018-21", "sightings": [{"uuid": "ce2e1780-bcd0-499d-8cf6-32788f175ac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21031", "type": "seen", "source": "https://t.me/ctinow/191765", "content": "https://ift.tt/k5Qjm8K\nCVE-2018-21031 | Plex Media Server 1.18.2.2029-36236cc4c Access Control insufficiently protected credentials", "creation_timestamp": "2024-02-23T14:41:19.000000Z"}, {"uuid": "92e22d0d-89e8-42f5-93ed-bb701a5f8bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21030", "type": "seen", "source": "https://t.me/ctinow/177405", "content": "https://ift.tt/mp0S4QU\nCVE-2018-21030 | Jupyter Notebook up to 5.4.x CSP improper restriction of rendered ui layers (DLA 2432-1)", "creation_timestamp": "2024-02-01T09:07:07.000000Z"}, {"uuid": "e712af58-fecb-4259-a122-6f22001025b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21270", "type": "seen", "source": "https://t.me/cibsecurity/17136", "content": "\u203c CVE-2018-21270 \u203c\n\nVersions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-04T00:26:25.000000Z"}, {"uuid": "546fe18f-a609-45d5-9b6f-2ac8f7dc5d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21014", "type": "seen", "source": "https://t.me/cibsecurity/6604", "content": "ATENTION\u203c New - CVE-2018-21014\n\nThe buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-09-09T16:39:15.000000Z"}, {"uuid": "2b1101ec-7aae-4ef8-bdb7-42b4a3ee281b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21013", "type": "seen", "source": "https://t.me/cibsecurity/6605", "content": "ATENTION\u203c New - CVE-2018-21013\n\nThe Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-09-09T16:39:16.000000Z"}, {"uuid": "ee8eccf4-708b-4d67-9031-9cb43a684c60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21037", "type": "seen", "source": "https://t.me/cibsecurity/10550", "content": "ATENTION\u203c New - CVE-2018-21037\n\nSubrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-17T17:31:16.000000Z"}, {"uuid": "43e7a45c-16ae-4b19-ac50-b45ca365fb3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21012", "type": "seen", "source": "https://t.me/cibsecurity/6606", "content": "ATENTION\u203c New - CVE-2018-21012\n\nThe cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-09-09T16:39:17.000000Z"}, {"uuid": "43d5265d-ab05-4717-be86-8cf3502c7289", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21011", "type": "seen", "source": "https://t.me/cibsecurity/6607", "content": "ATENTION\u203c New - CVE-2018-21011\n\nThe charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-09-09T16:39:18.000000Z"}, {"uuid": "7d8c62ed-1c20-40c0-b899-77a0bf792806", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21035", "type": "seen", "source": "https://t.me/cibsecurity/10191", "content": "ATENTION\u203c New - CVE-2018-21035\n\nIn Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-02-29T00:33:10.000000Z"}, {"uuid": "843825c7-9662-42b1-811c-e6b50a369afa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21057", "type": "seen", "source": "https://t.me/cibsecurity/11179", "content": "ATENTION\u203c New - CVE-2018-21057 (android)\n\nAn issue was discovered on Samsung mobile devices with N(7.x) O(8.x, and P(9.0) (Exynos chipsets) software. There is a stack-based buffer overflow in the Shannon Baseband. The Samsung ID is SVE-2018-12757 (September 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:17.000000Z"}, {"uuid": "124d1451-d1e6-402a-a768-da5331b3fe8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21056", "type": "seen", "source": "https://t.me/cibsecurity/11180", "content": "ATENTION\u203c New - CVE-2018-21056 (android)\n\nAn issue was discovered on Samsung mobile devices with O(8.x) software. The Smartwatch displays Secure Folder Notification content. The Samsung ID is SVE-2018-12458 (September 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:18.000000Z"}, {"uuid": "d0e626f4-bbde-4009-82db-a4d5f3ddc297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21055", "type": "seen", "source": "https://t.me/cibsecurity/11181", "content": "ATENTION\u203c New - CVE-2018-21055 (android)\n\nAn issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm models using MSM8996 chipsets) software. A device can be rooted with a custom image to execute arbitrary scripts in the INIT context. The Samsung ID is SVE-2018-11940 (September 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:18.000000Z"}, {"uuid": "26131a24-167d-4618-861f-2639277ae2cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21054", "type": "seen", "source": "https://t.me/cibsecurity/11182", "content": "ATENTION\u203c New - CVE-2018-21054 (android)\n\nAn issue was discovered on Samsung mobile devices with M(6.0), N(7.x) and O(8.x) except exynos9610/9820 in all Platforms, M(6.0) except MSM8909 SC77xx/9830 exynos3470/5420, N(7.0) except MSM8939, N(7.1) except MSM8996 SDM6xx/M6737T software. There is an integer underflow with a resultant buffer overflow in eCryptFS. The Samsung ID is SVE-2017-11857 (September 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:19.000000Z"}, {"uuid": "dcc3e78a-8af5-48a7-bb3f-37c40b95305d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21053", "type": "seen", "source": "https://t.me/cibsecurity/11183", "content": "ATENTION\u203c New - CVE-2018-21053 (android)\n\nAn issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is Clipboard access in the lockscreen state via a physical keyboard. The Samsung ID is SVE-2018-12684 (October 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:21.000000Z"}, {"uuid": "ccf5b3a9-5c72-4d2e-83c1-d461e4147146", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21052", "type": "seen", "source": "https://t.me/cibsecurity/11184", "content": "ATENTION\u203c New - CVE-2018-21052 (android)\n\nAn issue was discovered on Samsung mobile devices with N(7.x) and O(8.X) (Exynos chipsets) software. There is incorrect usage of shared memory in the vaultkeeper Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12855 (October 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:22.000000Z"}, {"uuid": "ddf6fd49-540c-40d5-9638-ae37e1e4203c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21051", "type": "seen", "source": "https://t.me/cibsecurity/11185", "content": "ATENTION\u203c New - CVE-2018-21051 (android)\n\nAn issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) (Exynos chipsets) software. There is an invalid free in the fingerprint Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12853 (October 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:23.000000Z"}, {"uuid": "e4c48b1d-dd50-4508-a85b-305796e0568a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21050", "type": "seen", "source": "https://t.me/cibsecurity/11186", "content": "ATENTION\u203c New - CVE-2018-21050 (android)\n\nAn issue was discovered on Samsung mobile devices with N(7.x) and O(8.X) (Exynos chipsets) software. There is a Buffer overflow in the esecomm Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12852 (October 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:23.000000Z"}, {"uuid": "0566b67e-53ca-45ff-a896-084f04037864", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21049", "type": "seen", "source": "https://t.me/cibsecurity/11187", "content": "ATENTION\u203c New - CVE-2018-21049 (android)\n\nAn issue was discovered on Samsung mobile devices with N(7.x) and O(8.X) (Exynos chipsets) software. There is an arbitrary memory write in a Trustlet because a secure driver allows access to sensitive APIs. The Samsung ID is SVE-2018-12881 (November 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:24.000000Z"}, {"uuid": "ab019e7c-e80c-4029-87b6-bc2aa24725e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21048", "type": "seen", "source": "https://t.me/cibsecurity/11188", "content": "ATENTION\u203c New - CVE-2018-21048 (android)\n\nAn issue was discovered on Samsung mobile devices with O(8.x) software. There is a Notification leak on a locked device in Standalone Dex mode. The Samsung ID is SVE-2018-12925 (November 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:25.000000Z"}, {"uuid": "f8825deb-4481-4623-861a-be7d512320e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21058", "type": "seen", "source": "https://t.me/cibsecurity/11178", "content": "ATENTION\u203c New - CVE-2018-21058 (android)\n\nAn issue was discovered on Samsung mobile devices with N(7.0), O(8.0) (exynos7420 or Exynos 8890/8996 chipsets) software. Cache attacks can occur against the Keymaster AES-GCM implementation because T-Tables are used; the Cryptography Extension (CE) is not used. The Samsung ID is SVE-2018-12761 (September 2018).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-13T08:14:16.000000Z"}, {"uuid": "7c59d9d3-54da-4e1f-b4c1-1e00c2afda0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21268", "type": "seen", "source": "https://t.me/cibsecurity/13061", "content": "ATENTION\u203c New - CVE-2018-21268\n\nThe traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-25T20:55:30.000000Z"}, {"uuid": "a4f937f1-8e25-408d-9485-9658446abb54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21036", "type": "seen", "source": "https://t.me/cibsecurity/13565", "content": "ATENTION\u203c New - CVE-2018-21036\n\nSails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-07-21T18:55:08.000000Z"}, {"uuid": "da43a0ae-0fd0-4d27-8afc-c04a2fef49b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21235", "type": "seen", "source": "https://t.me/cibsecurity/12566", "content": "ATENTION\u203c New - CVE-2018-21235\n\nAn issue was discovered in Foxit E-mail advertising system before September 2018. It allows authentication bypass and information disclosure, related to Interspire Email Marketer.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:42.000000Z"}, {"uuid": "41caba1e-75de-459b-bae6-725e4f9610c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21233", "type": "seen", "source": "https://t.me/cibsecurity/11801", "content": "ATENTION\u203c New - CVE-2018-21233\n\nTensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-05-04T18:29:15.000000Z"}, {"uuid": "80e914cc-fbb1-4cbe-b96f-e5b8c239382e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21234", "type": "seen", "source": "https://t.me/cibsecurity/12240", "content": "ATENTION\u203c New - CVE-2018-21234\n\nJodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-05-22T02:55:30.000000Z"}, {"uuid": "010472dd-f582-49c1-acef-e3f0eb6a5732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21242", "type": "seen", "source": "https://t.me/cibsecurity/12559", "content": "ATENTION\u203c New - CVE-2018-21242\n\nAn issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:32.000000Z"}, {"uuid": "9c0a3365-fe62-4e54-9ff5-9d408d6d3d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21241", "type": "seen", "source": "https://t.me/cibsecurity/12560", "content": "ATENTION\u203c New - CVE-2018-21241\n\nAn issue was discovered in Foxit PhantomPDF before 8.3.6. It has an untrusted search path that allows a DLL to execute remote code.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:33.000000Z"}, {"uuid": "b378e8a7-2a64-4306-9051-e732e031112f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21240", "type": "seen", "source": "https://t.me/cibsecurity/12561", "content": "ATENTION\u203c New - CVE-2018-21240\n\nAn issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows memory consumption via an ArrayBuffer(0xfffffffe) call.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:35.000000Z"}, {"uuid": "ebdcdd87-ca71-4393-acd5-0294cb55c77d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21239", "type": "seen", "source": "https://t.me/cibsecurity/12562", "content": "ATENTION\u203c New - CVE-2018-21239\n\nAn issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:36.000000Z"}, {"uuid": "7574bdd5-21ad-44a6-964a-795a644cb823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21238", "type": "seen", "source": "https://t.me/cibsecurity/12563", "content": "ATENTION\u203c New - CVE-2018-21238\n\nAn issue was discovered in Foxit PhantomPDF before 8.3.7. It allows memory consumption via an ArrayBuffer(0xfffffffe) call.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:37.000000Z"}, {"uuid": "6acef244-f25f-4c36-a37e-3ad2574f5800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21237", "type": "seen", "source": "https://t.me/cibsecurity/12564", "content": "ATENTION\u203c New - CVE-2018-21237\n\nAn issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:37.000000Z"}, {"uuid": "4e8ae716-1930-4845-bb15-6cb1b549c756", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21236", "type": "seen", "source": "https://t.me/cibsecurity/12565", "content": "ATENTION\u203c New - CVE-2018-21236\n\nAn issue was discovered in Foxit Reader before 2.4.4. It has a NULL pointer dereference.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:38.000000Z"}, {"uuid": "f812ce96-f411-439f-98af-a80b05eb05a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21244", "type": "seen", "source": "https://t.me/cibsecurity/12557", "content": "ATENTION\u203c New - CVE-2018-21244\n\nAn issue was discovered in Foxit PhantomPDF before 8.3.6. It allows arbitrary application execution via an embedded executable file in a PDF portfolio, aka FG-VD-18-029.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:29.000000Z"}, {"uuid": "f9d286ce-4afa-4d71-bc1f-d0f5ff51274d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21243", "type": "seen", "source": "https://t.me/cibsecurity/12558", "content": "ATENTION\u203c New - CVE-2018-21243\n\nAn issue was discovered in Foxit PhantomPDF before 8.3.6. It has COM object mishandling when Microsoft Word is used.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-04T20:55:30.000000Z"}, {"uuid": "6b8214b2-1591-41dd-a9ea-010b77f3beb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21246", "type": "seen", "source": "https://t.me/cibsecurity/12749", "content": "ATENTION\u203c New - CVE-2018-21246\n\nCaddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-15T20:55:16.000000Z"}, {"uuid": "c063fa0a-eecc-4460-a54d-02ab8a7ab2aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21245", "type": "seen", "source": "https://t.me/cibsecurity/12750", "content": "ATENTION\u203c New - CVE-2018-21245\n\nPound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-15T20:55:18.000000Z"}, {"uuid": "a374ed83-6d4c-49d7-ab30-0f06ccf62aa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21249", "type": "seen", "source": "https://t.me/cibsecurity/12901", "content": "ATENTION\u203c New - CVE-2018-21249\n\nAn issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:36.000000Z"}, {"uuid": "eb364392-ac18-47dd-bbb6-e25a5971723c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21248", "type": "seen", "source": "https://t.me/cibsecurity/12902", "content": "ATENTION\u203c New - CVE-2018-21248\n\nAn issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:37.000000Z"}, {"uuid": "f1543eb3-1e44-4201-aaa0-1db38237c180", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21247", "type": "seen", "source": "https://t.me/cibsecurity/12819", "content": "ATENTION\u203c New - CVE-2018-21247\n\nAn issue was discovered in LibVNCServer before 0.9.13. There is a memory leak in the libvncclient/rfbproto.c ConnectToRFBRepeater function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-17T20:55:36.000000Z"}, {"uuid": "e0d3ae54-5adf-420e-8875-13366ecf62e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21255", "type": "seen", "source": "https://t.me/cibsecurity/12896", "content": "ATENTION\u203c New - CVE-2018-21255\n\nAn issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:30.000000Z"}, {"uuid": "7d3b7104-82c8-4f3e-814a-f8bbe7d59286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21254", "type": "seen", "source": "https://t.me/cibsecurity/12897", "content": "ATENTION\u203c New - CVE-2018-21254\n\nAn issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:31.000000Z"}, {"uuid": "ae943f50-beb7-4796-88d3-575f2a018b2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21253", "type": "seen", "source": "https://t.me/cibsecurity/12898", "content": "ATENTION\u203c New - CVE-2018-21253\n\nAn issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:33.000000Z"}, {"uuid": "f7ce2f81-a81e-475c-8a35-f1dba442675d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21262", "type": "seen", "source": "https://t.me/cibsecurity/12890", "content": "ATENTION\u203c New - CVE-2018-21262\n\nAn issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:24.000000Z"}, {"uuid": "cd4836dc-4b44-4dcb-a573-d33231117b73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21261", "type": "seen", "source": "https://t.me/cibsecurity/12891", "content": "ATENTION\u203c New - CVE-2018-21261\n\nAn issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:25.000000Z"}, {"uuid": "1542ce47-176b-4cf6-aced-1ad8e0d0dc50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21260", "type": "seen", "source": "https://t.me/cibsecurity/12892", "content": "ATENTION\u203c New - CVE-2018-21260\n\nAn issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:26.000000Z"}, {"uuid": "08c5fe65-176f-41fb-b3ae-1dfe847df795", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21259", "type": "seen", "source": "https://t.me/cibsecurity/12893", "content": "ATENTION\u203c New - CVE-2018-21259\n\nAn issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malformed link in a channel.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:27.000000Z"}, {"uuid": "eb8cdbba-fa44-4510-91ca-ad02e9902ac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21258", "type": "seen", "source": "https://t.me/cibsecurity/12894", "content": "ATENTION\u203c New - CVE-2018-21258\n\nAn issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:28.000000Z"}, {"uuid": "78b7200c-561a-4899-9e77-a87c1637eb64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21257", "type": "seen", "source": "https://t.me/cibsecurity/12895", "content": "ATENTION\u203c New - CVE-2018-21257\n\nAn issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Channel header slash command API.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:29.000000Z"}, {"uuid": "96ec2316-518c-49cb-b797-742237135b4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21251", "type": "seen", "source": "https://t.me/cibsecurity/12899", "content": "ATENTION\u203c New - CVE-2018-21251\n\nAn issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:34.000000Z"}, {"uuid": "9ddb101a-5348-4ce6-a39b-ce75caf0e601", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21250", "type": "seen", "source": "https://t.me/cibsecurity/12900", "content": "ATENTION\u203c New - CVE-2018-21250\n\nAn issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-19T20:55:35.000000Z"}, {"uuid": "3a06c040-e8ef-4662-bc6a-71e3e7cf2b78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21268", "type": "seen", "source": "https://t.me/cibsecurity/13165", "content": "ATENTION\u203c New - CVE-2018-21268\n\nThe traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-07-01T11:55:36.000000Z"}, {"uuid": "4154f6d5-89ad-499d-b0a2-d62a70a1b26c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21268", "type": "seen", "source": "https://t.me/cibsecurity/13176", "content": "ATENTION\u203c New - CVE-2018-21268\n\nThe traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-07-01T14:55:31.000000Z"}, {"uuid": "5b7507d8-a4d9-420a-bf27-77cc51e95790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-21269", "type": "seen", "source": "https://t.me/cibsecurity/15597", "content": "\u203c CVE-2018-21269 \u203c\n\ncheckpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-27T06:29:37.000000Z"}]}