alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2018-11142 (published 2018-05-31)
The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-863
Affected vendors: quest
Affected products: kace_system_management_appliance
CVE-2018-11143 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11144 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11145 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11146 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11147 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11148 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11149 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-1115 (published 2018-05-10)
postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-732
Affected vendors: opensuse, postgresql
Affected products: leap, postgresql
CVE-2018-11150 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11151 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11152 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11153 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11154 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11155 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11156 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11157 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11158 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11159 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-1116 (published 2018-07-10)
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Weakness: CWE-285
Affected vendors: canonical, debian, polkit_project
Affected products: debian_linux, polkit, ubuntu_linux
CVE-2018-11160 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11161 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11162 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11163 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11164 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11165 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11166 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11167 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11168 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11169 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-1117 (published 2018-06-20)
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-532
Affected vendors: ovirt, redhat
Affected products: enterprise_virtualization, ovirt-ansible-roles
CVE-2018-11170 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11171 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11172 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11173 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11174 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11175 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11176 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11177 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11178 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11179 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-1118 (published 2018-05-10)
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-665
Affected vendors: canonical, debian, linux, redhat
Affected products: debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, linux_kernel, ubuntu_linux, virtualization_host
CVE-2018-11180 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11181 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11182 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11183 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11184 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11185 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11186 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11187 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11188 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11189 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11190 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11191 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11192 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11193 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11194 (published 2018-06-02)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: quest
Affected products: disk_backup
CVE-2018-11195 (published 2018-06-01)
Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious users with physical access to the web browser of a Mahara user, after they have logged in, to potentially gain access to their Mahara credentials.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-200
Affected vendors: mahara
Affected products: mahara
CVE-2018-11196 (published 2018-06-01)
Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A archive and uploading that to Mahara. In contrast to other ZIP files that are uploaded, ClamAV (when activated) does not check Leap2A archives for viruses, allowing malicious files to be available for download. While files cannot be executed on Mahara itself, Mahara can be used to transfer such files to user computers.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-434
Affected vendors: mahara
Affected products: mahara
CVE-2018-11198 (published 2019-09-06)
An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: acquia
Affected products: mautic
CVE-2018-1120 (published 2018-06-20)
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-122
Affected vendors: canonical, debian, linux, redhat
Affected products: debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, linux_kernel, ubuntu_linux, virtualization_host
CVE-2018-11200 (published 2019-09-20)
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: acquia
Affected products: mautic
CVE-2018-11202 (published 2018-05-16)
A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: hdfgroup
Affected products: hdf5
CVE-2018-11203 (published 2018-05-16)
A division by zero was discovered in H5D__btree_decode_key in H5Dbtree.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-369
Affected vendors: hdfgroup
Affected products: hdf5
CVE-2018-11204 (published 2018-05-16)
A NULL pointer dereference was discovered in H5O__chunk_deserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: hdfgroup
Affected products: hdf5
CVE-2018-11205 (published 2018-05-16)
A out of bounds read was discovered in H5VM_memcpyvv in H5VM.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: hdfgroup
Affected products: hdf5
CVE-2018-11206 (published 2018-05-16)
An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: hdfgroup
Affected products: hdf5
CVE-2018-11207 (published 2018-05-16)
A division by zero was discovered in H5D__chunk_init in H5Dchunk.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-369
Affected vendors: hdfgroup
Affected products: hdf5
CVE-2018-11208 (published 2018-05-16)
An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not intended to block this type of XSS by a user with the admin privilege
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: zblogcn
Affected products: z-blogphp
CVE-2018-11209 (published 2018-05-16)
An issue was discovered in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid issue
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-327
Affected vendors: zblogcn
Affected products: z-blogphp
CVE-2018-1121 (published 2018-06-13)
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-367
Affected vendors: procps_project
Affected products: procps
CVE-2018-11210 (published 2018-05-16)
TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml2 developers have determined that the reported overflow is due to improper use of the library and not a vulnerability in tinyxml2
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: tinyxml2_project
Affected products: tinyxml2
CVE-2018-11212 (published 2018-05-16)
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-369
Affected vendors: canonical, debian, ijg, netapp, opensuse, oracle, redhat
Affected products: debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, jdk, jre, leap, libjpeg, oncommand_unified_manager, oncommand_workflow_automation, satellite, snapmanager, ubuntu_linux
CVE-2018-11213 (published 2018-05-16)
An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Affected vendors: canonical, debian, ijg
Affected products: debian_linux, libjpeg, ubuntu_linux
CVE-2018-11214 (published 2018-05-16)
An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Affected vendors: canonical, debian, ijg
Affected products: debian_linux, libjpeg, ubuntu_linux
CVE-2018-11215 (published 2019-07-03)
Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cloudera
Affected products: data_science_workbench
CVE-2018-11218 (published 2018-06-17)
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, oracle, redhat, redislabs
Affected products: communications_operations_monitor, debian_linux, openstack, redis
CVE-2018-11219 (published 2018-06-17)
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: debian, oracle, redhat, redislabs
Affected products: communications_operations_monitor, debian_linux, openstack, redis
CVE-2018-1122 (published 2018-05-23)
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-829
Affected vendors: canonical, debian, procps-ng_project
Affected products: debian_linux, procps-ng, ubuntu_linux
CVE-2018-11220 (published 2018-05-31)
Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: bitmain
Affected products: antminer_d3, antminer_d3_firmware, antminer_l3\+, antminer_l3\+_firmware, antminer_s9, antminer_s9_firmware
CVE-2018-11221 (published 2018-06-16)
Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: artica
Affected products: pandora_fms
CVE-2018-11222 (published 2018-06-16)
Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: artica
Affected products: pandora_fms
CVE-2018-11223 (published 2018-06-16)
XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=" call.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pandorafms
Affected products: artica_pandora_fms
CVE-2018-11224 (published 2018-05-17)
An issue was discovered in Libav 12.3. A read access violation in the in_table_init16 function in libavcodec/aacsbr.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: libav
Affected products: libav
CVE-2018-11225 (published 2018-05-17)
The dcputs function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: libming
Affected products: libming
CVE-2018-11226 (published 2018-05-17)
The getString function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: libming
Affected products: libming
CVE-2018-11227 (published 2019-07-03)
Monstra CMS 3.0.4 and earlier has XSS via index.php.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: monstra
Affected products: monstra_cms
CVE-2018-11228 (published 2018-06-08)
Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP).
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: crestron
Affected products: crestron_toolbox_protocol_firmware, dmc-str, tsw-1060, tsw-1060-nc, tsw-560, tsw-560-nc, tsw-760, tsw-760-nc
CVE-2018-11229 (published 2018-06-08)
Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in Crestron Toolbox Protocol (CTP).
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: crestron
Affected products: crestron_toolbox_protocol_firmware, dmc-str, tsw-1060, tsw-1060-nc, tsw-560, tsw-560-nc, tsw-760, tsw-760-nc
CVE-2018-1123 (published 2018-05-23)
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-122
Affected vendors: canonical, debian, procps-ng_project
Affected products: debian_linux, procps-ng, ubuntu_linux
CVE-2018-11230 (published 2018-05-17)
jbig2_add_page in jbig2enc.cc in libjbig2enc.a in jbig2enc 0.29 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: jbig2enc_project
Affected products: jbig2enc
CVE-2018-11231 (published 2018-05-23)
In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential information.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: divido
Affected products: divido
CVE-2018-11232 (published 2018-05-18)
The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: linux
Affected products: linux_kernel
CVE-2018-11233 (published 2018-05-30)
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: canonical, git-scm
Affected products: git, ubuntu_linux
CVE-2018-11235 (published 2018-05-30)
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: canonical, debian, git-scm, gitforwindows, redhat
Affected products: debian_linux, enterprise_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_server_eus, enterprise_linux_workstation, git, ubuntu_linux
CVE-2018-11236 (published 2018-05-18)
stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: gnu, netapp, oracle, redhat
Affected products: communications_session_border_controller, data_ontap_edge, element_software_management, enterprise_communications_broker, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, glibc, virtualization_host
CVE-2018-11237 (published 2018-05-18)
An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: canonical, gnu, netapp, oracle, redhat
Affected products: communications_session_border_controller, data_ontap_edge, element_software_management, enterprise_communications_broker, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, glibc, ubuntu_linux, virtualization_host
CVE-2018-11239 (published 2018-05-19)
An integer overflow in the _transfer function of a smart contract implementation for Hexagon (HXG), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a _to argument in conjunction with a large _value argument, as exploited in the wild in May 2018, aka the "burnOverflow" issue.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-190
Affected vendors: hexagontoken
Affected products: hexagon
CVE-2018-1124 (published 2018-05-23)
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: canonical, debian, opensuse, procps-ng_project, redhat, schneider-electric
Affected products: debian_linux, enterprise_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, leap, procps-ng, struxureware_data_center_expert, ubuntu_linux
CVE-2018-11240 (published 2018-09-21)
An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' feature of the T-Router protocol. If the command syntax is correct, there is code execution both on the other modem and on the main servers. This is fixed in production builds as of Spring 2018.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: softcase
Affected products: t-router, t-router_firmware
CVE-2018-11241 (published 2018-09-21)
An issue was discovered on SoftCase T-Router build 20112017 devices. A remote attacker can read and write to arbitrary files on the system as root, as demonstrated by code execution after writing to a crontab file. This is fixed in production builds as of Spring 2018.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: softcase
Affected products: t-router, t-router_firmware
CVE-2018-11242 (published 2018-05-20)
An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-312
Affected vendors: makemytrip
Affected products: makemytrip
CVE-2018-11243 (published 2018-05-18)
PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: upx
Affected products: upx
CVE-2018-11244 (published 2018-05-18)
The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: dopewp
Affected products: bbe_theme
CVE-2018-11245 (published 2018-05-18)
app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: misp-project
Affected products: misp
CVE-2018-11246 (published 2021-01-11)
K7TSMngr.exe in K7Computing K7AntiVirus Premium 15.1.0.53 has a Memory Leak.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: k7computing
Affected products: antivrius, enterprise_security, total_security, ultimate_security
CVE-2018-11247 (published 2018-08-15)
The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute arbitrary code via a session on port 81.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: nasdaq
Affected products: bwise
CVE-2018-11248 (published 2018-05-18)
util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored in an unintended directory because of Directory Traversal.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: liulishuo
Affected products: filedownloader
CVE-2018-1125 (published 2018-05-23)
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-121
Affected vendors: canonical, debian, opensuse, procps-ng_project
Affected products: debian_linux, leap, procps-ng, ubuntu_linux
CVE-2018-11251 (published 2018-05-18)
In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: imagemagick
Affected products: imagemagick
CVE-2018-11254 (published 2018-05-18)
An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file, a related issue to CVE-2017-8054.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-674
Affected vendors: podofo_project
Affected products: podofo
CVE-2018-11255 (published 2018-05-18)
An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: podofo_project
Affected products: podofo
CVE-2018-11256 (published 2018-05-18)
An issue was discovered in PoDoFo 0.9.5. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: podofo_project
Affected products: podofo
CVE-2018-11257 (published 2018-07-06)
Permissions, Privileges, and Access Controls in TA in Snapdragon Mobile has an options that allows RPMB erase for secure devices in versions SD 210/SD 212/SD 205, SD 845, SD 850.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: qualcomm
Affected products: sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_845, sd_845_firmware, sd_850, sd_850_firmware
CVE-2018-11258 (published 2018-07-06)
In ADSP RPC in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, a Use After Free condition can occur in versions MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDX20.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9650, mdm9650_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_415, sd_415_firmware, sd_425, sd_425_firmware, sd_450, sd_450_firmware, sd_615, sd_615_firmware, sd_616
CVE-2018-11259 (published 2018-07-06)
Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and configures the EFS partition addresses in its MPU partition.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-732
Affected vendors: qualcomm
Affected products: mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9635m, mdm9635m_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, mdm9655, mdm9655_firmware, msm8909w, msm8909w_firmware, msm8996au, msm8996au_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_410, sd_410_firmware, sd_412
CVE-2018-1126 (published 2018-05-23)
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: canonical, debian, procps-ng_project, redhat, schneider-electric
Affected products: debian_linux, enterprise_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_tus, enterprise_linux_workstation, procps-ng, struxureware_data_center_expert, ubuntu_linux
CVE-2018-11260 (published 2018-11-27)
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a fast Initial link setup (FILS) connection request, integer overflow may lead to a buffer overflow when the key length is zero.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: google
Affected products: android
CVE-2018-11261 (published 2018-11-27)
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible Use-after-free issue in Media Codec process. Any application using codec service will be affected.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: android
CVE-2018-11262 (published 2018-09-04)
In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while trying to find out total number of partition via a non zero check, there could be possibility where the 'TotalPart' could cross 'GptHeader->MaxPtCnt' and which could result in OOB write in patching GPT.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-682
Affected vendors: google
Affected products: android
CVE-2018-11263 (published 2018-09-06)
In all Android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, radio_id is received from the FW and is used to access the buffer to copy the radio stats received for each radio from FW. If the radio_id received from the FW is greater than or equal to maximum, an OOB write will occur. On supported Google Pixel and Nexus devices, this has been addressed in security patch level 2018-08-05.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: google
Affected products: android