DuyTa/cve-kgrag-db huggingface dataset:
CVE-2018-18349
Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
CVSS v3.0 Score: 6.5 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: debian_linux, enterprise_linux_workstation, chrome, enterprise_linux_server, enterprise_linux_desktop
Related CWEs: CWE-732
Related CAPECs: CAPEC-17, CAPEC-206, CAPEC-234
MITRE ATT&CK Techniques: T1553.002, T1083, T1505.005
MITRE ATT&CK Tactics: T1134, T1505, T1553
References: http://www.securityfocus.com/bid/106084, https://access.redhat.com/errata/RHSA-2018:3803, https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CWE: CWE-732
MITRE ATT&CK techniques: T1553.002, T1083, T1505.005, T1550.004, T1134.001, T1574.010, T1548, T1554, T1574.005
MITRE ATT&CK tactics: T1134, T1505, T1553, T1550, T1574
CVE-2018-3683
Unquoted service paths in Intel Quartus Prime in versions 15.1 - 18.0 allow a local attacker to potentially execute arbitrary code.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: quartus_prime
Related CWEs: CWE-428
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00151.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00151.html
CWE: CWE-428
CVE-2018-9051
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002021.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.1 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:C
Affected Products: windows_optimization_master
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002021, https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002021
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2018-1903
IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo access. IBM X-Force ID: 152532.
CVSS v3.0 Score: 6.7 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sterling_connect\
References: http://www.ibm.com/support/docview.wss?uid=ibm10875386, https://exchange.xforce.ibmcloud.com/vulnerabilities/152532, http://www.ibm.com/support/docview.wss?uid=ibm10875386
CVE-2018-17880
On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: dir-823g, dir-823g_firmware
Related CWEs: CWE-306
Related CAPECs: CAPEC-216, CAPEC-12, CAPEC-36
References: https://xz.aliyun.com/t/2834#toc-5, https://xz.aliyun.com/t/2834#toc-5
CWE: CWE-306
CVE-2018-8118
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 11, Internet Explorer 10.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2012, windows_10, internet_explorer, windows_server_2016, windows_7
Related CWEs: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8118, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8118
CWE: CWE-787
CVE-2018-11518
A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can record these frequencies and use them for service activations. This is a request-forgery issue when the required series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the caller). In this case, the IVR system accepts an activation request from a less-secure channel (any loudspeaker in the caller's physical environment) without verifying that the request was intended (it matches a nonce sent over a more-secure channel to the caller's earpiece).
CVSS v3.0 Score: 8.1 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: legacy_ivr_firmware, legacy_ivr
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://virgil-cj.blogspot.com/2018/05/0day-legacy-ivr-lets-phreak.html, https://datarift.blogspot.com/2018/05/CVE-2018-11518-abusing-ivr-systems.html, https://twitter.com/mishradhiraj_/status/1001664204485652482
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2018-18504
A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results is a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. This vulnerability affects Firefox < 65.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ubuntu_linux, firefox
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: http://www.securityfocus.com/bid/106773, https://usn.ubuntu.com/3874-1/, https://www.mozilla.org/security/advisories/mfsa2019-01/
CWE: CWE-125
CVE-2018-1757
IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing authentication in IGI for the survey application. IBM X-Force ID: 148601.
CVSS v3.0 Score: 5.3 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: security_identity_governance_and_intelligence
Related CWEs: CWE-306
Related CAPECs: CAPEC-216, CAPEC-12, CAPEC-36
References: http://www.ibm.com/support/docview.wss?uid=ibm10728883, https://exchange.xforce.ibmcloud.com/vulnerabilities/148601, http://www.ibm.com/support/docview.wss?uid=ibm10728883
CWE: CWE-306
CVE-2018-11688
Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS v3.0 Score: 6.1 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: openfire
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://packetstormsecurity.com/files/148057/Ignite-Realtime-Openfire-3.7.1-Cross-Site-Scripting.html, http://seclists.org/fulldisclosure/2018/Jun/13, http://seclists.org/fulldisclosure/2018/Jun/24
CWE: CWE-79
CVE-2018-0247
A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic. The vulnerability is due to incorrect implementation of authentication for WebAuth clients in a specific configuration. An attacker could exploit this vulnerability by sending traffic to local network resources without having gone through authentication. A successful exploit could allow the attacker to bypass authentication and pass traffic. This affects Cisco Aironet Access Points running Cisco IOS Software and Cisco Wireless LAN Controller (WLC) releases prior to 8.5.110.0 for the following specific WLC configuration only: (1) The Access Point (AP) is configured in FlexConnect Mode with NAT. (2) The WLAN is configured for central switching, meaning the client is being assigned a unique IP address. (3) The AP is configured with a Split Tunnel access control list (ACL) for access to local network resources, meaning the AP is doing the NAT on the connection. (4) The client is using WebAuth. This vulnerability does not apply to .1x clients in the same configuration. Cisco Bug IDs: CSCvc79502, CSCvf71789.
CVSS v3.0 Score: 4.7 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v2.0 Score: 3.3 (LOW)
CVSS v2.0 Vector: AV:A/AC:L/Au:N/C:N/I:P/A:N
Affected Products: wireless_lan_controller_software, aironet_access_point_software
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: http://www.securityfocus.com/bid/104087, http://www.securitytracker.com/id/1040814, http://www.securitytracker.com/id/1040815
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2018-14884
An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: storage_automation_store, php
Related CWEs: CWE-476
References: http://php.net/ChangeLog-7.php, https://access.redhat.com/errata/RHSA-2019:2519, https://bugs.php.net/bug.php?id=75535
CWE: CWE-476
CVE-2018-0712
Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions could allow remote attackers to run arbitrary commands or install malware on the NAS.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: qts
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: http://www.securitytracker.com/id/1041141, https://www.qnap.com/zh-tw/security-advisory/nas-201806-19, http://www.securitytracker.com/id/1041141
CWE: CWE-77
CVE-2018-2486
SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS v3.0 Score: 5.4 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: marketing_sapscore, marketing_uicuan
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.securityfocus.com/bid/106171, https://launchpad.support.sap.com/#/notes/2705204, https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699
CWE: CWE-79
CVE-2018-2726
Vulnerability in the Oracle Financial Services Market Risk component of Oracle Financial Services Applications (subcomponent: User Interface). The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Market Risk. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Market Risk accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Market Risk accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.0 Score: 8.1 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Affected Products: financial_services_market_risk
References: http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html, http://www.securityfocus.com/bid/102664, http://www.securitytracker.com/id/1040214
CVE-2018-18014
* Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001.  NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: xenmobile_server
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: https://advisories.dxw.com/advisories/xen-mobile-backing-service-allows-unauthenticated-local-users-to-execute-system-commands-as-root/, https://advisories.dxw.com/advisories/xen-mobile-backing-service-allows-unauthenticated-local-users-to-execute-system-commands-as-root/
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2018-16559
A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted network packets sent to port 80/tcp or 443/tcp could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/tcp or 443/tcp. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: simatic_s7-1500_firmware, simatic_s7-1500
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://cert-portal.siemens.com/productcert/pdf/ssa-180635.pdf, https://cert-portal.siemens.com/productcert/pdf/ssa-180635.pdf
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2018-11968
Improper check before assigning value can lead to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4020, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA8081, QCA9377, QCA9379, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, QCN5502, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150, Snapdragon_High_Med_2016, SXR1130
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: snapdragon_high_med_2016_firmware, sd_712_firmware, qca8081_firmware, qca6174a, sd_675
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11968, https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11968
CWE: CWE-190
CVE-2018-0786
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: windows_server_2012, windows_10, powershell_core, windows_server_2016, windows_7
Related CWEs: CWE-295
Related CAPECs: CAPEC-475, CAPEC-459
References: http://www.securityfocus.com/bid/102380, http://www.securitytracker.com/id/1040152, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0786
CWE: CWE-295
CVE-2018-11276
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, double free of memory allocation is possible in Kernel when it explicitly tries to free that memory on driver probe failure, since memory allocated is automatically freed on probe.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: android
Related CWEs: CWE-415
References: https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-components, https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=83a44ca6057bf9c1e36515cded28edc32a4a1501, https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bulletin
CWE: CWE-415
CVE-2018-2688
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVSS v3.0 Score: 8.6 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v2.0 Score: 4.4 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Affected Products: vm_virtualbox
References: http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html, http://www.securityfocus.com/bid/102692, http://www.securitytracker.com/id/1040202
CVE-2018-5679
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process, a different vulnerability than CVE-2018-5677 and CVE-2018-5680.
CVSS v3.0 Score: 8.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: phantompdf, reader
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: http://www.securityfocus.com/bid/104300, https://srcincite.io/advisories/src-2018-0015/, https://www.foxitsoftware.com/support/security-bulletins.php
CWE: CWE-125
CVE-2018-18761
SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: saltos
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://www.exploit-db.com/exploits/45731/, https://www.exploit-db.com/exploits/45731/
CWE: CWE-89
CVE-2018-11756
In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openwhisk, php
References: http://www.securityfocus.com/bid/104915, https://github.com/apache/incubator-openwhisk-runtime-php/commit/6caf902f527250ee4b7b695929b628d560e0dad1, https://lists.apache.org/thread.html/439bd5ff5822708c645a0d816ed9914b88c97eda32eae6ea211bc0dc%40%3Cdev.openwhisk.apache.org%3E
CVE-2018-8411
An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2012, windows_10, windows_server_2016, windows_7, windows_server_2019
Related CWEs: CWE-732
Related CAPECs: CAPEC-17, CAPEC-206, CAPEC-234
MITRE ATT&CK Techniques: T1553.002, T1083, T1505.005
MITRE ATT&CK Tactics: T1134, T1505, T1553
References: http://www.securityfocus.com/bid/105508, http://www.securitytracker.com/id/1041832, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8411
CWE: CWE-732
MITRE ATT&CK techniques: T1553.002, T1083, T1505.005, T1550.004, T1134.001, T1574.010, T1548, T1554, T1574.005
MITRE ATT&CK tactics: T1134, T1505, T1553, T1550, T1574
CVE-2018-13180
The mintToken function of a smart contract implementation for IMM Coin (IMC), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: immcoin
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md, https://github.com/BlockChainsSecurity/EtherTokens/tree/master/IMMCoin, https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CWE: CWE-190
CVE-2018-15795
Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.
CVSS v3.0 Score: 8.1 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Affected Products: credhub_service_broker
Related CWEs: CWE-338
References: http://www.securityfocus.com/bid/105915, https://pivotal.io/security/cve-2018-15795, http://www.securityfocus.com/bid/105915
CWE: CWE-338
CVE-2018-4056
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: debian_linux, coturn
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://lists.debian.org/debian-lts-announce/2019/02/msg00017.html, https://talosintelligence.com/vulnerability_reports/TALOS-2018-0730, https://www.debian.org/security/2019/dsa-4373
CWE: CWE-89
CVE-2018-5682
PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message.
CVSS v3.0 Score: 5.3 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: prestashop
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://forge.prestashop.com/browse/BOOM-4613, http://forge.prestashop.com/browse/BOOM-4613
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2018-0433
A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: vbond_orchestrator, vedge_cloud_router_platform, vmanage_network_management_system, vedge_5000_firmware, vedge_1000
Related CWEs: CWE-78, CWE-77
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: http://www.securityfocus.com/bid/105295, https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-injection, http://www.securityfocus.com/bid/105295
CWE: CWE-78, CWE-77
CVE-2018-8530
A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypass Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8512.
CVSS v3.0 Score: 4.3 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: windows_10, edge
References: http://www.securityfocus.com/bid/105487, http://www.securitytracker.com/id/1041825, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8530
CVE-2018-14297
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of FreeText annotations. By manipulating a document's elements, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6213.
CVSS v3.0 Score: 8.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: foxit_reader, windows, phantompdf
Related CWEs: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php, https://zerodayinitiative.com/advisories/ZDI-18-757, https://www.foxitsoftware.com/support/security-bulletins.php
CWE: CWE-416
CVE-2018-0171
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ios
Related CWEs: CWE-20, CWE-787
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
WARNING: This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog
References: http://www.securityfocus.com/bid/103538, http://www.securitytracker.com/id/1040580, https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04
CWE: CWE-20, CWE-787
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2018-4353
A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS Mojave 10.14.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://support.apple.com/kb/HT209139, https://support.apple.com/kb/HT209139
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2018-7823
A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine Basic when sending crafted ethernet message.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: modicon_m221, somachine_basic, modicon_m221_firmware
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01/, https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01/
CVE-2018-10854
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: linux_kernel, cloudforms_management_engine
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10854, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10854
CWE: CWE-79
CVE-2018-11572
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
CVSS v3.0 Score: 5.4 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: clippercms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/ClipperCMS/ClipperCMS/issues/485, https://github.com/ClipperCMS/ClipperCMS/issues/485
CWE: CWE-79
CVE-2018-1148
In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change.
CVSS v3.0 Score: 6.5 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: nessus
Related CWEs: CWE-384
Related CAPECs: CAPEC-31, CAPEC-21, CAPEC-59
MITRE ATT&CK Techniques: T1134, T1539, T1550.004
MITRE ATT&CK Tactics: T1134, T1550
References: http://www.securitytracker.com/id/1040918, https://www.tenable.com/security/tns-2018-05, http://www.securitytracker.com/id/1040918
CWE: CWE-384
MITRE ATT&CK techniques: T1134, T1539, T1550.004, T1134.003, T1134.001, T1134.002, T1606, T1528
MITRE ATT&CK tactics: T1134, T1550
CVE-2018-20687
An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: commandcenter_secure_gateway
Related CWEs: CWE-611
Related CAPECs: CAPEC-221
References: http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html, http://seclists.org/fulldisclosure/2019/Nov/11, http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html
CWE: CWE-611
CVE-2018-8142
A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1035.
CVSS v3.0 Score: 5.3 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_10, windows_server_2016
References: http://www.securityfocus.com/bid/103962, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8142, http://www.securityfocus.com/bid/103962
CVE-2018-4372
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
CVSS v3.0 Score: 8.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: tvos, iphone_os, itunes, icloud, windows
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: https://support.apple.com/kb/HT209192, https://support.apple.com/kb/HT209194, https://support.apple.com/kb/HT209195
CWE: CWE-119
CVE-2018-0039
Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials allow network based attackers unauthorized access to information stored in Grafana or exploit other weaknesses or vulnerabilities in Grafana.
CVSS v3.0 Score: 6.5 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: contrail_service_orchestration
Related CWEs: CWE-561, CWE-798
Related CAPECs: CAPEC-191, CAPEC-70
MITRE ATT&CK Techniques: T1078.001, T1552.001
MITRE ATT&CK Tactics: T1078, T1552
References: https://kb.juniper.net/JSA10872, https://kb.juniper.net/JSA10872
CWE: CWE-561, CWE-798
MITRE ATT&CK techniques: T1078.001, T1552.001
MITRE ATT&CK tactics: T1078, T1552
CVE-2018-1183
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: emc_vmax_embedded_management, emc_unity_operating_environment, emc_unisphere, emc_vmax_enas, emc_vnxe_3100_operating_environment
Related CWEs: CWE-611
Related CAPECs: CAPEC-221
References: http://seclists.org/fulldisclosure/2018/Apr/61, http://www.securityfocus.com/bid/104024, http://seclists.org/fulldisclosure/2018/Apr/61
CWE: CWE-611
CVE-2018-6162
Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.0 Score: 8.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: debian_linux, macos, enterprise_linux_workstation, chrome, enterprise_linux_server
Related CWEs: CWE-787, CWE-502
Related CAPECs: CAPEC-586
References: http://www.securityfocus.com/bid/104887, https://access.redhat.com/errata/RHSA-2018:2282, https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CWE: CWE-787, CWE-502
CVE-2018-8210
A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8213.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2012, windows_10, windows_rt_8.1, windows_8.1, windows_server_2016
Related CWEs: CWE-404
Related CAPECs: CAPEC-496, CAPEC-125, CAPEC-666
MITRE ATT&CK Techniques: T1499.001, T1499.003, T1499
MITRE ATT&CK Tactics: T1498, T1499
References: http://www.securityfocus.com/bid/104407, http://www.securitytracker.com/id/1041093, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8210
CWE: CWE-404
MITRE ATT&CK techniques: T1499.001, T1499.003, T1499, T1498.001
MITRE ATT&CK tactics: T1498, T1499
CVE-2018-18355
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS v3.0 Score: 4.3 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: debian_linux, enterprise_linux_workstation, chrome, enterprise_linux_server, enterprise_linux_desktop
References: http://www.securityfocus.com/bid/106084, https://access.redhat.com/errata/RHSA-2018:3803, https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE-2018-16451
The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: leap, debian_linux, tcpdump, enterprise_linux, fedora
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html, http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html, http://seclists.org/fulldisclosure/2019/Dec/26
CWE: CWE-125
CVE-2018-8777
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: enterprise_linux, debian_linux, ubuntu_linux, ruby
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html, http://www.securityfocus.com/bid/103683, http://www.securitytracker.com/id/1042004
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2018-8473
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8509.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: chakracore, windows_10, edge, windows_server_2019
Related CWEs: CWE-787
References: http://www.securityfocus.com/bid/105459, http://www.securitytracker.com/id/1041825, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8473
CWE: CWE-787
CVE-2018-12304
Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: Short Description, Publisher Name, Publisher Contact, or Website URL.
CVSS v3.0 Score: 6.1 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: nas_os
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170, https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CWE: CWE-79
CVE-2018-8957
CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php.
CVSS v3.0 Score: 5.4 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: covercms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/ttylx/Cve_reveal, https://github.com/ttylx/Cve_reveal/blob/master/CoverCMS_01/Covercms_1.md, https://github.com/ttylx/Cve_reveal/blob/master/CoverCMS_01/re.md
CWE: CWE-79
CVE-2018-19706
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: acrobat_dc, windows, acrobat_reader_dc, mac_os_x
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: http://www.securityfocus.com/bid/106162, https://helpx.adobe.com/security/products/acrobat/apsb18-41.html, http://www.securityfocus.com/bid/106162
CWE: CWE-125
CVE-2018-12315
Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password.
CVSS v3.0 Score: 6.5 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: as602t, data_master
Related CWEs: CWE-640
Related CAPECs: CAPEC-50
References: https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc, https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc
CWE: CWE-640
CVE-2018-12095
A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.
CVSS v3.0 Score: 5.4 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: oecms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://cxsecurity.com/issue/WLB-2018060092, https://www.exploit-db.com/exploits/44895/, https://cxsecurity.com/issue/WLB-2018060092
CWE: CWE-79
CVE-2018-12338
Undocumented Factory Backdoor in ECOS System Management Appliance (aka SMA) 5.2.68 allows the vendor to extract confidential information and manipulate security relevant configurations via remote root SSH access.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: system_management_appliance
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html, https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html