Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2018-1133
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
Affected Products: Moodle 3.x unknown
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=371199'}, {'name': '46551', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/46551/'}, {'name': '104307', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104307'}]
CVE State: PUBLISHED
Explain CVE-2018-1134
An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.
Affected Products: Moodle 3.x unknown
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=371200'}, {'name': '104307', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104307'}]
CVE State: PUBLISHED
Explain CVE-2018-1135
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.
Affected Products: Moodle 3.x unknown
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=371201'}, {'name': '104307', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104307'}]
CVE State: PUBLISHED
Explain CVE-2018-1136
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.
Affected Products: Moodle 3.x unknown
References: [{'name': '104307', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104307'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=371202'}]
CVE State: PUBLISHED
Explain CVE-2018-1137
An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.
Affected Products: Moodle 3.x unknown
References: [{'name': '104307', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104307'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=371204'}]
CVE State: PUBLISHED
Explain CVE-2018-1139
A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.
Affected Products: samba
References: [{'name': 'RHSA-2018:2613', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2613'}, {'name': 'USN-3738-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3738-1/'}, {'name': 'RHSA-2018:2612', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2612'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1139'}, {'name': '105084', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105084'}, {'name': 'RHSA-2018:3056', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3056'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20180814-0001/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.samba.org/samba/security/CVE-2018-1139.html'}, {'name': 'GLSA-202003-52', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202003-52'}]
CVE State: PUBLISHED
Explain CVE-2018-1140
A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server, used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable
Affected Products: samba
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.samba.org/show_bug.cgi?id=13374'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.samba.org/samba/security/CVE-2018-1140.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20180814-0001/'}, {'name': '105082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105082'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1140'}, {'name': 'GLSA-202003-52', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202003-52'}]
CVE State: PUBLISHED
Explain CVE-2018-1141
When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the installation location.
Affected Products: Nessus
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-01'}, {'name': '1040557', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040557'}]
CVE State: PUBLISHED
Explain CVE-2018-1142
Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request, an authenticated attacker could potentially execute arbitrary JavaScript code by manipulating certain URL parameters related to offline plugins.
Affected Products: Tenable Appliance
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-02'}]
CVE State: PUBLISHED
Explain CVE-2018-1143
A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to twonky_command.cgi.
Affected Products: N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-08'}]
CVE State: PUBLISHED
Explain CVE-2018-1144
A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to proxy.cgi.
Affected Products: N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-08'}]
CVE State: PUBLISHED
Explain CVE-2018-1145
A remote unauthenticated user can overflow a stack buffer in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to proxy.cgi.
Affected Products: N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-08'}]
CVE State: PUBLISHED
Explain CVE-2018-1146
A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled the telnet session requires no password and provides root access.
Affected Products: N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-08'}]
CVE State: PUBLISHED
Explain CVE-2018-1147
In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file, which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session. In other scenarios, XSS could also occur by altering variables from the Advanced Settings.
Affected Products: Tenable Nessus
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-05'}, {'name': '1040918', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040918'}]
CVE State: PUBLISHED
Explain CVE-2018-1148
In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change.
Affected Products: Tenable Nessus
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-05'}, {'name': '1040918', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040918'}]
CVE State: PUBLISHED
Explain CVE-2018-1149
cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests.
Affected Products: NUUO NVRMini2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.nuuo.com/backend/CKEdit/upload/files/NUUO_NVRsolo_v3_9_1_Release%20note.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/tenable/poc/tree/master/nuuo/nvrmini2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-25'}, {'name': '105720', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105720'}]
CVE State: PUBLISHED
Explain CVE-2018-1150
NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists.
Affected Products: NUUO NVRMini2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.nuuo.com/backend/CKEdit/upload/files/NUUO_NVRsolo_v3_9_1_Release%20note.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-25'}, {'name': '105720', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105720'}]
CVE State: PUBLISHED
Explain CVE-2018-1151
The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi.
Affected Products: TV Media Player
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-14'}]
CVE State: PUBLISHED
Explain CVE-2018-1152
libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
Affected Products: libjpeg-turbo
References: [{'name': '104543', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104543'}, {'name': 'USN-3706-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3706-2/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-17'}, {'name': 'USN-3706-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3706-1/'}, {'name': '[debian-lts-announce] 20190122 [SECURITY] [DLA 1638-1] libjpeg-turbo security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6'}, {'name': 'openSUSE-SU-2019:1118', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html'}, {'name': 'openSUSE-SU-2019:1343', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html'}, {'name': '[debian-lts-announce] 20200731 [SECURITY] [DLA 2302-1] libjpeg-turbo security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html'}]
CVE State: PUBLISHED
Explain CVE-2018-1153
Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic.
Affected Products: Burp Suite Community Edition
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://releases.portswigger.net/2018/06/1734.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-18'}]
CVE State: PUBLISHED
Explain CVE-2018-1154
In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue.
Affected Products: SecurityCenter
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-11'}, {'name': '1041431', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041431'}]
CVE State: PUBLISHED
Explain CVE-2018-1155
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.
Affected Products: SecurityCenter
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-11'}, {'name': '1041431', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041431'}]
CVE State: PUBLISHED
Explain CVE-2018-1156
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mikrotik.com/download/changelogs'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mikrotik.com/download/changelogs/bugfix-release-tree'}]
CVE State: PUBLISHED
Explain CVE-2018-1157
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mikrotik.com/download/changelogs'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mikrotik.com/download/changelogs/bugfix-release-tree'}, {'name': "20190723 Two vulnerabilities found in MikroTik's RouterOS", 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2019/Jul/20'}]
CVE State: PUBLISHED
Explain CVE-2018-1158
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mikrotik.com/download/changelogs'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mikrotik.com/download/changelogs/bugfix-release-tree'}, {'name': "20190723 Two vulnerabilities found in MikroTik's RouterOS", 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2019/Jul/20'}]
CVE State: PUBLISHED
Explain CVE-2018-1159
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mikrotik.com/download/changelogs'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mikrotik.com/download/changelogs/bugfix-release-tree'}]
CVE State: PUBLISHED
Explain CVE-2018-1160
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
Affected Products: Netatalk
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://netatalk.sourceforge.net/3.1/ReleaseNotes3.1.12.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://attachments.samba.org/attachment.cgi?id=14735'}, {'name': '106301', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106301'}, {'name': '46034', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/46034/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/tenable/poc/tree/master/netatalk/cve_2018_1160/'}, {'name': '46048', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/46048/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.synology.com/security/advisory/Synology_SA_18_62'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2018-48'}, {'name': 'DSA-4356', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4356'}, {'name': '46675', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/46675/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/152440/QNAP-Netatalk-Authentication-Bypass.html'}]
CVE State: PUBLISHED
Explain CVE-2018-1161
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13. Authentication is not required to exploit this vulnerability. The specific flaw exists within nvwsworker.exe. When parsing the boundary header of a multipart request, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-4215.
Affected Products: Quest NetVault Backup
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-004'}]
CVE State: PUBLISHED
Explain CVE-2018-1162
This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Quest NetVault Backup 11.2.0.13. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed. The specific flaw exists within the handling of Export requests. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to arbitrarily overwrite files resulting in a denial-of-service condition. Was ZDI-CAN-4222.
Affected Products: Quest NetVault Backup
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-005'}]
CVE State: PUBLISHED
Explain CVE-2018-1163
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to critical functions. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4752.
Affected Products: Quest NetVault Backup
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-006'}]
CVE State: PUBLISHED
Explain CVE-2018-1164
This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by improper access controls that allow access to critical functions without authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-CAN-4540.
Affected Products: ZyXEL P-870H-51 DSL Router
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-135'}]
CVE State: PUBLISHED
Explain CVE-2018-1165
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMB_IOC_SVCENUM IOCTL. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4983.
Affected Products: Joyent SmartOS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://help.joyent.com/hc/en-us/articles/360000124928'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-158'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}]
CVE State: PUBLISHED
Explain CVE-2018-1166
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMBIOC_TREE_RELE ioctl. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4984.
Affected Products: Joyent SmartOS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://help.joyent.com/hc/en-us/articles/360000124928'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-159'}]
CVE State: PUBLISHED
Explain CVE-2018-1167
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5501.
Affected Products: Spotify Music Player
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-280'}]
CVE State: PUBLISHED
Explain CVE-2018-1168
This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the access controls for the installed product files. The installation procedure leaves critical files open to manipulation by any authenticated user. An attacker can leverage this vulnerability to escalate privileges to SYSTEM. Was ZDI-CAN-5097.
Affected Products: ABB MicroSCADA
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://library.e.abb.com/public/7a88a74b12bb492ea138b1f2365d00f6/ABBVU-PGGA-33888_ABB_SoftwareVulnerabilityHandlingAdvisory_Rev_A.pdf?x-sign=MJfu9cHtRUUubpLAYzyWFTmW5W+mg3kZ/nm7F/Jw5HlFTQf4eNyfLAgE8HozRJEC'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-141'}]
CVE State: PUBLISHED
Explain CVE-2018-1169
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5521.
Affected Products: Amazon Music Player
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-215'}, {'name': '103215', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103215'}]
CVE State: PUBLISHED
Explain CVE-2018-1170
This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Customer-Link App and Customer-Link Bridge. The issue results from the lack of a proper protection mechanism against unauthorized firmware updates. An attacker can leverage this vulnerability to inject CAN messages. Was ZDI-CAN-5264.
Affected Products: Volkswagen Customer-Link App
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-214'}]
CVE State: PUBLISHED
Explain CVE-2018-1171
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DTrace DOF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-5106.
Affected Products: Joyent SmartOS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://help.joyent.com/hc/en-us/articles/360000608188'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html'}, {'name': '1041303', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041303'}, {'name': '104799', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104799'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-236'}]
CVE State: PUBLISHED
Explain CVE-2018-1172
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
Affected Products: The Squid Software Foundation Squid
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-309'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/Advisories/SQUID-2018_3.txt'}]
CVE State: PUBLISHED
Explain CVE-2018-1173
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the XFA borderColor attribute. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5436.
Affected Products: Foxit Reader
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.foxitsoftware.com/support/security-bulletins.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-311'}]
CVE State: PUBLISHED
Explain CVE-2018-1174
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the bitmapDPI attribute of PrintParams objects. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5437.
Affected Products: Foxit Reader
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-312'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.foxitsoftware.com/support/security-bulletins.php'}]
CVE State: PUBLISHED
Explain CVE-2018-1175
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the interactive attribute of PrintParams objects. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5438.
Affected Products: Foxit Reader
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-313'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.foxitsoftware.com/support/security-bulletins.php'}]
CVE State: PUBLISHED
Explain CVE-2018-1176
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ePub files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5442.
Affected Products: Foxit Reader
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.foxitsoftware.com/support/security-bulletins.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-314'}]
CVE State: PUBLISHED
Explain CVE-2018-1177
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the addAnnot method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5488.
Affected Products: Foxit Reader
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.foxitsoftware.com/support/security-bulletins.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-315'}]
CVE State: PUBLISHED
Explain CVE-2018-1178
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the addField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5489.
Affected Products: Foxit Reader
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.foxitsoftware.com/support/security-bulletins.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-316'}]
CVE State: PUBLISHED
Explain CVE-2018-1179
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DataSubBlock structures in GIF images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5490.
Affected Products: Foxit Reader
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.foxitsoftware.com/support/security-bulletins.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-317'}]
CVE State: PUBLISHED
Explain CVE-2018-1180
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AFSimple_Calculate method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5491.
Affected Products: Foxit Reader
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.foxitsoftware.com/support/security-bulletins.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://zerodayinitiative.com/advisories/ZDI-18-318'}]
CVE State: PUBLISHED
Explain CVE-2018-1182
An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root level privileges.
Affected Products: EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only)
References: [{'name': '1040458', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040458'}, {'name': '103317', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103317'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://seclists.org/fulldisclosure/2018/Mar/16'}]
CVE State: PUBLISHED
Explain CVE-2018-1183
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service.
Affected Products: Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Solutions Enabler Virtual Appliance, Dell EMC VASA Provider Virtual Appliance, Dell EMC SMIS, Dell EMC VMAX Embedded Management (eManagement), Dell EMC VNX2 Operating Environment (OE) for File, Dell EMC VNX2 Operating Environment (OE) for Block, Dell EMC VNX1 Operating Environment (OE) for File, Dell EMC VNX1 Operating Environment (OE) for Block, Dell EMC VNXe3200 Operating Environment (OE), Dell EMC VNXe1600 Operating Environment (OE), Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), Dell EMC ViPR SRM, Dell EMC ViPR SRM, Dell EMC XtremIO, Dell EMC VMAX eNAS, Dell EMC Unity Operating Environment (OE)
References: [{'name': '20180425 DSA-2018-013: Dell EMC ECOM XML External Entity Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Apr/61'}, {'name': '104024', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104024'}]
CVE State: PUBLISHED
Explain CVE-2018-1184
An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Boxmgmt CLI may allow a malicious user with boxmgmt privileges to bypass Boxmgmt CLI and run arbitrary commands with root privileges.
Affected Products: EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, EMC RecoverPoint versions prior to 5.0.1.3
References: [{'name': '1040320', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040320'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://seclists.org/fulldisclosure/2018/Feb/9'}]
CVE State: PUBLISHED
Explain CVE-2018-1185
An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Admin CLI may allow a malicious user with admin privileges to escape from the restricted shell to an interactive shell and run arbitrary commands with root privileges.
Affected Products: EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, EMC RecoverPoint versions prior to 5.0.1.3
References: [{'name': '1040320', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040320'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://seclists.org/fulldisclosure/2018/Feb/9'}, {'name': '44614', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44614/'}]
CVE State: PUBLISHED
Explain CVE-2018-1186
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Cluster description of the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.
Affected Products: Isilon OneFS
References: [{'name': '103033', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103033'}, {'name': '20180319 DSA-2018-018: Dell EMC Isilon OneFS Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Mar/50'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities'}, {'name': '44039', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44039/'}]
CVE State: PUBLISHED
Explain CVE-2018-1187
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting vulnerability in the Network Configuration page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.
Affected Products: Isilon OneFS
References: [{'name': '103033', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103033'}, {'name': '20180319 DSA-2018-018: Dell EMC Isilon OneFS Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Mar/50'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities'}, {'name': '44039', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44039/'}]
CVE State: PUBLISHED
Explain CVE-2018-1188
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-site scripting vulnerability in the Authorization Providers page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.
Affected Products: Isilon OneFS
References: [{'name': '103033', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103033'}, {'name': '20180319 DSA-2018-018: Dell EMC Isilon OneFS Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Mar/50'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities'}, {'name': '44039', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44039/'}]
CVE State: PUBLISHED
Explain CVE-2018-1189
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Antivirus Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.
Affected Products: Isilon OneFS
References: [{'name': '103033', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103033'}, {'name': '20180319 DSA-2018-018: Dell EMC Isilon OneFS Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2018/Mar/50'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities'}, {'name': '44039', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44039/'}]
CVE State: PUBLISHED
Explain CVE-2018-1190
An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management.
Affected Products: Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0
References: [{'name': '102427', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/102427'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudfoundry.org/cve-2018-1190/'}]
CVE State: PUBLISHED
Explain CVE-2018-1191
Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials.
Affected Products: Garden-runC
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudfoundry.org/blog/cve-2018-1191/'}]
CVE State: PUBLISHED
Explain CVE-2018-1192
In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.
Affected Products: Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudfoundry.org/blog/cve-2018-1192/'}]
CVE State: PUBLISHED
Explain CVE-2018-1193
Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.
Affected Products: Cloud Foundry Router
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudfoundry.org/blog/cve-2018-1193/'}]
CVE State: PUBLISHED
Explain CVE-2018-1195
In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication.
Affected Products: Cloud Controller
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudfoundry.org/blog/cve-2018-1195/'}]
CVE State: PUBLISHED
Explain CVE-2018-1196
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.
Affected Products: Spring Boot
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pivotal.io/security/cve-2018-1196'}]
CVE State: PUBLISHED