Skip to content

Commit ebd802e

Browse files
aboutcode-automationaboutcode-automation
committed
Sync EUVD catalog: Thu Apr 30 00:47:06 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent f2b5080 commit ebd802e

133 files changed

Lines changed: 4598 additions & 1 deletion

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/2026/04/EUVD-2018-21818.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21818",
3+
"enisaUuid": "205666aa-305c-3dd8-9ea0-c2785f812673",
4+
"description": "Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms targeting the merge-viewer endpoint. Attackers can submit POST requests to /servlet/actions/merge-viewer/summary with login credentials to hijack user sessions and gain unauthorized access to the PACS system.",
5+
"datePublished": "Apr 29, 2026, 7:24:32 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:32 PM",
7+
"baseScore": 6.9,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
10+
"references": "https://www.exploit-db.com/exploits/44681\nhttp://www.merge.com/\nhttps://www.vulncheck.com/advisories/merge-pacs-cross-site-request-forgery-via-merge-viewer\n",
11+
"aliases": "CVE-2018-25298\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "5519f7f6-140b-31e1-82ef-cbb063a21b9f",
17+
"product": {
18+
"name": "Merge PACS"
19+
},
20+
"product_version": "7.0"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "0676e1cc-45a5-3bd4-90e3-e14f26b98e5c",
26+
"vendor": {
27+
"name": "Merge"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21819.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21819",
3+
"enisaUuid": "b6ae5149-b6da-3992-b4ca-ea350297330f",
4+
"description": "Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands.",
5+
"datePublished": "Apr 29, 2026, 7:24:33 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:33 PM",
7+
"baseScore": 8.6,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44649\nhttps://www.mersenne.org/\nhttps://www.mersenne.org/download/#download\nhttps://www.vulncheck.com/advisories/prime95-29-4b8-local-buffer-overflow-via-seh\n",
11+
"aliases": "CVE-2018-25299\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "28e30481-f090-3ce5-b92f-4adc40910067",
17+
"product": {
18+
"name": "Prime95"
19+
},
20+
"product_version": "29.4b8"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "1402aa26-7dbe-3d3d-b1b6-fef83e943a2f",
26+
"vendor": {
27+
"name": "Mersenne"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21821.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21821",
3+
"enisaUuid": "0dcea886-e593-3f2c-b04c-d18110fb7ada",
4+
"description": "XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database information.",
5+
"datePublished": "Apr 29, 2026, 7:24:33 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:33 PM",
7+
"baseScore": 8.8,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44622\nhttp://www2.xataboost.com\nhttps://www.vulncheck.com/advisories/xataboost-cms-sql-injection-via-news-php\n",
11+
"aliases": "CVE-2018-25300\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "e8ce0824-94a5-3128-aa75-c2797876bacb",
17+
"product": {
18+
"name": "XATABoost CMS"
19+
},
20+
"product_version": "1.0.0"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "8200d566-aaa8-3b77-8c88-c86e143940c7",
26+
"vendor": {
27+
"name": "xataboost"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21822.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21822",
3+
"enisaUuid": "cc8dc32b-9b77-3f73-9132-a969fba6dd1d",
4+
"description": "Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious username string. Attackers can craft a payload containing junk data, SEH chain pointers, and shellcode that overwrites the SEH handler to redirect execution and run arbitrary commands like opening calc.exe.",
5+
"datePublished": "Apr 29, 2026, 7:24:34 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:34 PM",
7+
"baseScore": 8.6,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44565\nhttps://downloads.tomsguide.com/MPEG-Easy-Burner,0301-10418.html\nhttps://www.vulncheck.com/advisories/easy-mpeg-to-dvd-burner-seh-local-buffer-overflow\n",
11+
"aliases": "CVE-2018-25301\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "fb3ab6d5-0db2-3182-81a9-fa3fc6937273",
17+
"product": {
18+
"name": "Easy MPEG to DVD Burner"
19+
},
20+
"product_version": "1.7.11"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "58b86d49-8f56-3f64-8644-daa54cce19b1",
26+
"vendor": {
27+
"name": "Easy MPEG"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21823.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21823",
3+
"enisaUuid": "8b6e1126-2c72-3756-91c6-55872221c67d",
4+
"description": "Allok AVI to DVD SVCD VCD Converter 4.0.1217 contains a structured exception handling (SEH) based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the License Name field. Attackers can craft a payload with junk data, NSEH bypass, SEH handler address, and shellcode that triggers the overflow when pasted into the License Name field and the Register button is clicked, resulting in code execution.",
5+
"datePublished": "Apr 29, 2026, 7:24:35 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:35 PM",
7+
"baseScore": 8.5,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44549\nhttp://www.alloksoft.com/\nhttps://www.vulncheck.com/advisories/allok-avi-to-dvd-svcd-vcd-converter-buffer-overflow-seh\n",
11+
"aliases": "CVE-2018-25302\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "0e12d4e2-c384-3b5d-90e6-261255766857",
17+
"product": {
18+
"name": "Allok AVI to DVD SVCD VCD Converter"
19+
},
20+
"product_version": "4.0.1217"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "1a5c7ea0-d687-3e6c-8a3d-4fde9163ce06",
26+
"vendor": {
27+
"name": "Alloksoft"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21824.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21824",
3+
"enisaUuid": "91f75970-d9cf-3f47-87cd-e4a645d78666",
4+
"description": "Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input string with 780 bytes of junk data followed by SEH chain pointers and shellcode, then paste it into the License Name field during registration to achieve code execution.",
5+
"datePublished": "Apr 29, 2026, 7:24:35 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:35 PM",
7+
"baseScore": 8.6,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44518\nhttp://www.alloksoft.com/\nhttps://www.vulncheck.com/advisories/allok-video-to-dvd-burner-buffer-overflow-seh\n",
11+
"aliases": "CVE-2018-25303\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "49c8440a-8e0f-3554-a3db-8fd679abe9d5",
17+
"product": {
18+
"name": "Allok Video to DVD Burner"
19+
},
20+
"product_version": "2.6.1217"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "cb6e1521-c77c-3406-a8f0-ce4f80c95a65",
26+
"vendor": {
27+
"name": "Alloksoft"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21825.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21825",
3+
"enisaUuid": "6452cd3d-904d-3a75-ab94-8788409e5be6",
4+
"description": "Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code.",
5+
"datePublished": "Apr 29, 2026, 7:24:36 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:36 PM",
7+
"baseScore": 8.6,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44499\nhttps://filehippo.com/download_free_download_manager/925/\nhttps://www.vulncheck.com/advisories/free-download-manager-built-417-local-buffer-overflow-seh\n",
11+
"aliases": "CVE-2018-25304\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "b32be065-229c-3adc-81fb-f89e3ee35f59",
17+
"product": {
18+
"name": "FREE DOWNLOAD MANAGER"
19+
},
20+
"product_version": "2.0"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "b3d4472b-b0fe-3153-9c39-aadc8e99efc8",
26+
"vendor": {
27+
"name": "Filehippo"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21826.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21826",
3+
"enisaUuid": "9f0741e6-60c7-34ac-a7eb-61a7699729a5",
4+
"description": "librsvg2-bin 2.40.13 contains a buffer overflow vulnerability that allows local attackers to cause a denial of service by processing malformed SVG files. Attackers can supply crafted SVG input to the rsvg conversion tool to trigger a segmentation fault in the cairo image compositor.",
5+
"datePublished": "Apr 29, 2026, 7:24:37 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:37 PM",
7+
"baseScore": 6.9,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44491\nhttps://www.vulncheck.com/advisories/librsvg2-bin-buffer-overflow-via-malformed-svg\n",
11+
"aliases": "CVE-2018-25305\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "877b76d6-addc-336c-999f-5287e6cbf7e5",
17+
"product": {
18+
"name": "RSVG"
19+
},
20+
"product_version": "2.40.13"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "5c7eba9e-d349-3084-a9d9-c542033440bf",
26+
"vendor": {
27+
"name": "xenial"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21827.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21827",
3+
"enisaUuid": "c9775618-d7c3-3ef6-b5f2-f105bea076d1",
4+
"description": "PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations. Attackers can trigger a segmentation fault in the XRef::getEntry function within libpoppler by providing a specially crafted PDF file to the pdfunite utility.",
5+
"datePublished": "Apr 29, 2026, 7:24:37 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:24:37 PM",
7+
"baseScore": 6.9,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44490\nhttps://launchpad.net/ubuntu/artful/+package/poppler-utils\nhttps://launchpad.net/ubuntu/+source/poppler/0.57.0-2ubuntu4.2\nhttps://www.vulncheck.com/advisories/pdfunite-buffer-overflow-via-malformed-pdf\n",
11+
"aliases": "CVE-2018-25306\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "9b5bfe3e-b6d8-3ebc-baa9-de5d562282fc",
17+
"product": {
18+
"name": "PDFunite"
19+
},
20+
"product_version": "0.41.0"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "cb7124a9-dac7-39c0-8363-d1d3354b4b48",
26+
"vendor": {
27+
"name": "poppler-utils"
28+
}
29+
}
30+
]
31+
}

‎advisories/2026/04/EUVD-2018-21828.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "EUVD-2018-21828",
3+
"enisaUuid": "d61ab091-4e59-3e98-8f53-155c2c8a5114",
4+
"description": "SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges.",
5+
"datePublished": "Apr 29, 2026, 7:24:38 PM",
6+
"dateUpdated": "Apr 29, 2026, 7:51:34 PM",
7+
"baseScore": 8.6,
8+
"baseScoreVersion": "4.0",
9+
"baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
10+
"references": "https://www.exploit-db.com/exploits/44455\nhttps://www.vulncheck.com/advisories/sysgauge-pro-local-buffer-overflow-seh\n",
11+
"aliases": "CVE-2018-25307\n",
12+
"assigner": "VulnCheck",
13+
"epss": 0.0,
14+
"enisaIdProduct": [
15+
{
16+
"id": "181b8aa3-3db8-3964-9153-db01f0ec4ff2",
17+
"product": {
18+
"name": "SysGauge Pro"
19+
},
20+
"product_version": "4.6.12"
21+
}
22+
],
23+
"enisaIdVendor": [
24+
{
25+
"id": "b108187f-0ac0-3a6c-9c37-3a3c37f9fb07",
26+
"vendor": {
27+
"name": "Sysgauge"
28+
}
29+
}
30+
]
31+
}

0 commit comments

Comments
 (0)