alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2018-9052 (published 2018-03-27)
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100283c.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: windows_optimization_master_project
Affected products: windows_optimization_master
CVE-2018-9053 (published 2018-03-27)
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf10026cc.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: windows_optimization_master_project
Affected products: windows_optimization_master
CVE-2018-9054 (published 2018-03-27)
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100284c.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: windows_optimization_master_project
Affected products: windows_optimization_master
CVE-2018-9055 (published 2018-03-27)
JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: jasper_project
Affected products: jasper
CVE-2018-9056 (published 2018-03-27)
Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on the directional branch predictor, as demonstrated by a pattern history table (PHT), aka BranchScope.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: arm, intel
Affected products: atom_c, atom_e, atom_x3, atom_z, celeron_j, celeron_n, core_i3, core_i5, core_i7, core_m, core_m3, core_m5, core_m7, cortex-a, pentium_j, pentium_n, xeon, xeon_bronze_3104, xeon_bronze_3106, xeon_e-1105c, xeon_e3, xeon_e3_1105c_v2, xeon_e3_1125c, xeon_e3_1125c_v2, xeon_e3_1220
CVE-2018-9057 (published 2018-03-27)
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-332
Affected vendors: hashicorp
Affected products: terraform
CVE-2018-9058 (published 2018-03-27)
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: long_range_zip_project
Affected products: long_range_zip
CVE-2018-9059 (published 2018-04-20)
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious login request to forum.ghp.  NOTE: this may overlap CVE-2014-3791.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: sharing-file
Affected products: easy_file_sharing_web_server
CVE-2018-9062 (published 2018-07-19)
In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-74
Affected vendors: lenovo
Affected products: 20hm, 20hn, 20hq, 20hr, 20jb, 20jc, 20jd, 20je, 20jf, 20jg, 20k3, 20k4, 20k5, 20k6, 20ke, 20kf, 20kg, 20kh, 20kj, 20kk, 20ld, 20le, 20lf, 20lg, e42-80
CVE-2018-9063 (published 2018-05-04)
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: lenovo
Affected products: system_update
CVE-2018-9064 (published 2018-07-30)
In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: lenovo
Affected products: xclarity_administrator
CVE-2018-9065 (published 2018-07-30)
In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-312
Affected vendors: lenovo
Affected products: xclarity_administrator
CVE-2018-9066 (published 2018-07-30)
In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA's underlying operating system.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: lenovo
Affected products: xclarity_administrator
CVE-2018-9067 (published 2018-07-13)
The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could have led to exposure of approximately 400 email addresses and 8,500 IMEI.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: lenovo
Affected products: lenovo_help
CVE-2018-9068 (published 2018-07-26)
The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
Affected vendors: ibm, lenovo
Affected products: bladecenter_hs22, bladecenter_hs22_firmware, bladecenter_hs23, bladecenter_hs23_firmware, bladecenter_hs23e, bladecenter_hs23e_firmware, flex_system_x220_m4, flex_system_x220_m4_firmware, flex_system_x222_m4, flex_system_x222_m4_firmware, flex_system_x240_m4, flex_system_x240_m4_firmware, flex_system_x240_m5, flex_system_x240_m5_firmware, flex_system_x280_m4, flex_system_x280_m4_firmware, flex_system_x280_x6, flex_system_x280_x6_firmware, flex_system_x440_m4, flex_system_x440_m4_firmware, flex_system_x480_m4, flex_system_x480_m4_firmware, flex_system_x480_x6, flex_system_x480_x6_firmware, flex_system_x880
CVE-2018-9069 (published 2018-10-02)
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-362
Affected vendors: hp, lenovo
Affected products: 310s-14isk, 310s-14isk_firmware, 320-15ikbra, 320-15ikbra_firmware, 320-15ikbrn, 320-15ikbrn_firmware, 320-15ikbrn_touch, 320-15ikbrn_touch_firmware, 320-17ikbrn, 320s-14ikb, 320s-15ikb, 320s-15ikb_firmware, 320s-15isk, 320s-15isk_firmware, 510s-14isk, 510s-14isk_firmware, 520-15ikbrn, 520-15ikbrn_firmware, 520s-14ikb, 520s-14ikb_firmware, 7000-15_u42, 7000-15_u42_firmware, 7000_u42, 7000_u42_firmware, 710s_plus-13ikb_16g
CVE-2018-9070 (published 2018-07-13)
For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: lenovo
Affected products: smart_assistant
CVE-2018-9071 (published 2018-11-16)
Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: lenovo
Affected products: chassis_management_module, chassis_management_module_firmware
CVE-2018-9072 (published 2018-11-30)
In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: lenovo
Affected products: xclarity_integrator
CVE-2018-9073 (published 2018-11-16)
Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
Affected vendors: lenovo
Affected products: chassis_management_module, chassis_management_module_firmware
CVE-2018-9074 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-22
Affected vendors: lenovo
Affected products: iomega_ez_media_\&_backup_center, iomega_storcenter_ix2, iomega_storcenter_ix2-dl, iomega_storcenter_ix4-300d, iomega_storcenter_px12-400r, iomega_storcenter_px12-450r, iomega_storcenter_px2-300d, iomega_storcenter_px4-300d, iomega_storcenter_px4-300r, iomega_storcenter_px6-300d, lenovo_ez_media_\&_backup_center, lenovo_ix2, lenovo_ix4-300d, lenovoemc_firmware, lenovoemc_px12-400r, lenovoemc_px12-450r, lenovoemc_px2-300d, lenovoemc_px4-300d, lenovoemc_px4-300r, lenovoemc_px4-400d, lenovoemc_px4-400r, lenovoemc_px6-300d
CVE-2018-9075 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "``" characters in the client:password parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: lenovo
Affected products: iomega_ez_media_\&_backup_center, iomega_storcenter_ix2, iomega_storcenter_ix2-dl, iomega_storcenter_ix4-300d, iomega_storcenter_px12-400r, iomega_storcenter_px12-450r, iomega_storcenter_px2-300d, iomega_storcenter_px4-300d, iomega_storcenter_px4-300r, iomega_storcenter_px6-300d, lenovo_ez_media_\&_backup_center, lenovo_ix2, lenovo_ix4-300d, lenovoemc_firmware, lenovoemc_px12-400r, lenovoemc_px12-450r, lenovoemc_px2-300d, lenovoemc_px4-300d, lenovoemc_px4-300r, lenovoemc_px4-400d, lenovoemc_px4-400r, lenovoemc_px6-300d
CVE-2018-9076 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: lenovo
Affected products: iomega_ez_media_\&_backup_center, iomega_storcenter_ix2, iomega_storcenter_ix2-dl, iomega_storcenter_ix4-300d, iomega_storcenter_px12-400r, iomega_storcenter_px12-450r, iomega_storcenter_px2-300d, iomega_storcenter_px4-300d, iomega_storcenter_px4-300r, iomega_storcenter_px6-300d, lenovo_ez_media_\&_backup_center, lenovo_ix2, lenovo_ix4-300d, lenovoemc_firmware, lenovoemc_px12-400r, lenovoemc_px12-450r, lenovoemc_px2-300d, lenovoemc_px4-300d, lenovoemc_px4-300r, lenovoemc_px4-400d, lenovoemc_px4-400r, lenovoemc_px6-300d
CVE-2018-9077 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the share : name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: lenovo
Affected products: iomega_ez_media_\&_backup_center, iomega_storcenter_ix2, iomega_storcenter_ix2-dl, iomega_storcenter_ix4-300d, iomega_storcenter_px12-400r, iomega_storcenter_px12-450r, iomega_storcenter_px2-300d, iomega_storcenter_px4-300d, iomega_storcenter_px4-300r, iomega_storcenter_px6-300d, lenovo_ez_media_\&_backup_center, lenovo_ix2, lenovo_ix4-300d, lenovoemc_firmware, lenovoemc_px12-400r, lenovoemc_px12-450r, lenovoemc_px2-300d, lenovoemc_px4-300d, lenovoemc_px4-300r, lenovoemc_px4-400d, lenovoemc_px4-400r, lenovoemc_px6-300d
CVE-2018-9078 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: lenovo
Affected products: ez_media_\&_backup_center, ez_media_\&_backup_center_firmware, ix2, ix2_firmware, ix4-300d, ix4-300d_firmware, px12-400r, px12-400r_firmware, px12-450r, px12-450r_firmware, px2-300d, px2-300d_firmware, px4-300d, px4-300d_firmware, px4-300r, px4-300r_firmware, px4-400d, px4-400d_firmware, px4-400r, px4-400r_firmware, px6-300d, px6-300d_firmware, storcenter_ix2, storcenter_ix2-dl, storcenter_ix2-dl_firmware
CVE-2018-9079 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: lenovo
Affected products: ez_media_\&_backup_center, ez_media_\&_backup_center_firmware, ix2, ix2_firmware, ix4-300d, ix4-300d_firmware, px12-400r, px12-400r_firmware, px12-450r, px12-450r_firmware, px2-300d, px2-300d_firmware, px4-300d, px4-300d_firmware, px4-300r, px4-300r_firmware, px4-400d, px4-400d_firmware, px4-400r, px4-400r_firmware, px6-300d, px6-300d_firmware, storcenter_ix2, storcenter_ix2-dl, storcenter_ix2-dl_firmware
CVE-2018-9080 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-287
Affected vendors: lenovo
Affected products: ez_media_\&_backup_center, ez_media_\&_backup_center_firmware, ix2, ix2_firmware, ix4-300d, ix4-300d_firmware, px12-400r, px12-400r_firmware, px12-450r, px12-450r_firmware, px2-300d, px2-300d_firmware, px4-300d, px4-300d_firmware, px4-300r, px4-300r_firmware, px4-400d, px4-400d_firmware, px4-400r, px4-400r_firmware, px6-300d, px6-300d_firmware, storcenter_ix2, storcenter_ix2-dl, storcenter_ix2-dl_firmware
CVE-2018-9081 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: lenovo
Affected products: ez_media_\&_backup_center, ez_media_\&_backup_center_firmware, ix2, ix2_firmware, ix4-300d, ix4-300d_firmware, px12-400r, px12-400r_firmware, px12-450r, px12-450r_firmware, px2-300d, px2-300d_firmware, px4-300d, px4-300d_firmware, px4-300r, px4-300r_firmware, px4-400d, px4-400d_firmware, px4-400r, px4-400r_firmware, px6-300d, px6-300d_firmware, storcenter_ix2, storcenter_ix2-dl, storcenter_ix2-dl_firmware
CVE-2018-9082 (published 2018-09-28)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-384
Affected vendors: lenovo
Affected products: ez_media_\&_backup_center, ez_media_\&_backup_center_firmware, ix2, ix2_firmware, ix4-300d, ix4-300d_firmware, px12-400r, px12-400r_firmware, px12-450r, px12-450r_firmware, px2-300d, px2-300d_firmware, px4-300d, px4-300d_firmware, px4-300r, px4-300r_firmware, px4-400d, px4-400d_firmware, px4-400r, px4-400r_firmware, px6-300d, px6-300d_firmware, storcenter_ix2, storcenter_ix2-dl, storcenter_ix2-dl_firmware
CVE-2018-9083 (published 2018-11-27)
In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: lenovo
Affected products: system_management_module_firmware, thinkagile_hx_enclosure_7x81, thinkagile_hx_enclosure_7y87, thinkagile_hx_enclosure_7z02, thinkagile_vx_enclosure_7y11, thinkagile_vx_enclosure_7y91, thinksystem_d2_enclosure_7x20, thinksystem_modular_enclosure_7x22
CVE-2018-9084 (published 2018-11-27)
In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: lenovo
Affected products: system_management_module_firmware, thinkagile_hx_enclosure_7x81, thinkagile_hx_enclosure_7y87, thinkagile_hx_enclosure_7z02, thinkagile_vx_enclosure_7y11, thinkagile_vx_enclosure_7y91, thinksystem_d2_enclosure_7x20, thinksystem_modular_enclosure_7x22
CVE-2018-9085 (published 2018-11-16)
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-276
Affected vendors: ibm, lenovo
Affected products: bladecenter, bladecenter_hs23_firmware, bladecenter_hs23e_firmware, flex_system_x220, flex_system_x220_m4_firmware, flex_system_x222_m4, flex_system_x222_m4_firmware, flex_system_x240_m4, flex_system_x240_m4_firmware, flex_system_x280_x6, flex_system_x280_x6_firmware, flex_system_x440_m4, flex_system_x440_m4_firmware, flex_system_x480_x6, flex_system_x480_x6_firmware, flex_system_x880_x6, flex_system_x880_x6_firmware, idataplex_dx360_m4_, idataplex_dx360_m4_firmware, idataplex_dx360_m4_water_cooled_firmware, system_x3100_m4, system_x3100_m4_firmware, system_x3100_m5, system_x3100_m5_firmware, system_x3250_m4
CVE-2018-9086 (published 2018-11-16)
In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: lenovo
Affected products: thinkserver_rd340, thinkserver_rd340_firmware, thinkserver_rd440, thinkserver_rd440_firmware, thinkserver_rd640, thinkserver_rd640_firmware, thinkserver_td340, thinkserver_td340_firmware
CVE-2018-9090 (published 2019-09-24)
CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured by Tectonic administrators. An attacker can insert an XSS payload into the dashboards.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: redhat
Affected products: tectonic
CVE-2018-9091 (published 2018-05-25)
A critical vulnerability in the KEMP LoadMaster Operating System (LMOS) 6.0.44 through 7.2.41.2 and Long Term Support (LTS) LMOS before 7.1.35.5 related to Session Management could allow an unauthenticated, remote attacker to bypass security protections, gain system privileges, and execute elevated commands such as ls, ps, cat, etc., thereby compromising the system. Through this remote execution, in certain cases, exposure of sensitive system data such as certificates, private keys, and other information may be possible.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: kemptechnologies
Affected products: loadmaster_operating_system
CVE-2018-9092 (published 2018-03-27)
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: 1234n
Affected products: minicms
CVE-2018-9101 (published 2018-04-25)
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the launch_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mitel
Affected products: mivoice_connect, st_14.2
CVE-2018-9102 (published 2018-04-25)
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the signin interface. A successful exploit could allow an attacker to extract sensitive information from the database.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-89
Affected vendors: mitel
Affected products: mivoice_connect, st_14.2
CVE-2018-9103 (published 2018-04-25)
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mitel
Affected products: mivoice_connect, st_14.2
CVE-2018-9104 (published 2018-04-25)
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the api.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mitel
Affected products: mivoice_connect, st_14.2
CVE-2018-9105 (published 2018-03-27)
NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately this XPC service is not protected, which allows arbitrary applications to connect and send it XPC messages. An attacker can send a crafted XPC message to the privileged helper tool requesting it make a new OpenVPN connection. Because he or she controls the contents of the XPC message, the attacker can specify the location of the openvpn executable, which could point to something malicious they control located on disk. Without validation of the openvpn executable, this will give the attacker code execution in the context of the privileged helper tool.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: nordvpn
Affected products: nordvpn
CVE-2018-9106 (published 2018-03-28)
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-1236
Affected vendors: acyba
Affected products: acysms
CVE-2018-9107 (published 2018-03-28)
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-1236
Affected vendors: acyba
Affected products: acymailing
CVE-2018-9108 (published 2018-03-28)
CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: quickappscms
Affected products: quickapps_cms
CVE-2018-9109 (published 2018-03-28)
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-22
Affected vendors: std42
Affected products: elfinder
CVE-2018-9110 (published 2018-03-28)
Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-22
Affected vendors: std42
Affected products: elfinder
CVE-2018-9111 (published 2018-05-10)
Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: foxconn
Affected products: ap-fc4064-t, ap-fc4064-t_firmware
CVE-2018-9112 (published 2018-05-10)
A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges by modifying cookies.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: foxconn
Affected products: ap-fc4064-t, ap-fc4064-t_firmware
CVE-2018-9113 (published 2018-04-26)
Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial '><script type="text/javascript" src=' line. Fix released on 2018-03-29.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: cdc
Affected products: microbetrace
CVE-2018-9115 (published 2018-04-04)
Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG interface. An attacker can freeze the Situational Layer, which means that the Situational Picture is no longer updated. Unfortunately, the user cannot notice until he tries to work with that layer.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-20
Affected vendors: systematicinc
Affected products: sitaware
CVE-2018-9116 (published 2018-03-29)
An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-611
Affected vendors: wiremock
Affected products: wiremock
CVE-2018-9117 (published 2018-03-29)
WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a specially crafted XML request, aka Directory Traversal.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: wiremock
Affected products: wiremock
CVE-2018-9118 (published 2018-04-12)
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: 99robots
Affected products: wp_background_takeover_advertisements
CVE-2018-9119 (published 2018-04-04)
An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-306
Affected vendors: brilliantts
Affected products: fuze_card, fuze_card_ble_firmware, fuze_card_mcu_firmware
CVE-2018-9120 (published 2018-03-29)
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: crea8social
Affected products: crea8social
CVE-2018-9121 (published 2018-03-29)
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: crea8social
Affected products: crea8social
CVE-2018-9122 (published 2018-03-29)
In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: crea8social
Affected products: crea8social
CVE-2018-9123 (published 2018-03-29)
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: crea8social
Affected products: crea8social
CVE-2018-9126 (published 2018-04-04)
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-200
Affected vendors: zldnn
Affected products: dnnarticle
CVE-2018-9127 (published 2018-04-02)
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-295
Affected vendors: botan_project
Affected products: botan
CVE-2018-9128 (published 2018-04-01)
DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: dvd-x-player
Affected products: dvd_x_player
CVE-2018-9129 (published 2018-08-15)
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: zyxel
Affected products: usg_110, usg_1100, usg_1100_firmware, usg_110_firmware, usg_1900, usg_1900_firmware, usg_20w, usg_20w-vpn, usg_20w-vpn_firmware, usg_20w_firmware, usg_2200-vpn, usg_2200-vpn_firmware, usg_310, usg_310_firmware, usg_40, usg_40_firmware, usg_40w, usg_40w_firmware, usg_60, usg_60_firmware, usg_60w, usg_60w_firmware, zywall_110, zywall_1100, zywall_1100_firmware
CVE-2018-9130 (published 2018-03-30)
IBOS 4.4.3 has XSS via a company full name.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ibos
Affected products: ibos
CVE-2018-9132 (published 2018-03-30)
libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: debian, libming
Affected products: debian_linux, libming
CVE-2018-9133 (published 2018-03-30)
ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-834
Affected vendors: canonical, imagemagick
Affected products: imagemagick, ubuntu_linux
CVE-2018-9134 (published 2018-03-30)
file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: dedecms
Affected products: dedecms
CVE-2018-9135 (published 2018-03-30)
In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: imagemagick
Affected products: imagemagick
CVE-2018-9136 (published 2018-03-30)
windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file, a different vulnerability than CVE-2018-8821.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: jungo
Affected products: windriver
CVE-2018-9137 (published 2018-04-19)
Open-AudIT before 2.2 has CSV Injection.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N)
Weakness: CWE-1236
Affected vendors: open-audit
Affected products: open-audit
CVE-2018-9138 (published 2018-03-30)
An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_nested_args, demangle_args, do_arg, and do_type.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-674
Affected vendors: gnu
Affected products: binutils
CVE-2018-9139 (published 2018-03-30)
On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privileged process via a large frame size, aka SVE-2017-11165.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: samsung
Affected products: samsung_mobile
CVE-2018-9140 (published 2018-03-30)
On Samsung mobile devices with M(6.0) software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE-2017-10747.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: samsung
Affected products: samsung_mobile
CVE-2018-9141 (published 2018-03-30)
On Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software, Gallery allows remote attackers to execute arbitrary code via a BMP file with a crafted resolution, aka SVE-2017-11105.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: samsung
Affected products: samsung_mobile
CVE-2018-9142 (published 2018-03-30)
On Samsung mobile devices with N(7.x) software, attackers can install an arbitrary APK in the Secure Folder SD Card area because of faulty validation of a package signature and package name, aka SVE-2017-10932.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: samsung
Affected products: samsung_mobile
CVE-2018-9143 (published 2018-03-30)
On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code execution in a privileged process, aka SVE-2017-10991.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: samsung
Affected products: samsung_mobile
CVE-2018-9144 (published 2018-03-30)
In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: exiv2
Affected products: exiv2
CVE-2018-9145 (published 2018-03-30)
In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the 4-DataBuf-abort-1 PoC file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: exiv2
Affected products: exiv2
CVE-2018-9147 (published 2018-03-30)
Cross-site scripting (XSS) vulnerabilities in version 7.5.7 of Gespage software allow remote attackers to inject arbitrary web script or HTML via the email, passwd, and repasswd parameters to webapp/users/user_reg.jsp.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: gespage
Affected products: gespage
CVE-2018-9148 (published 2018-03-30)
Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a product that uses My Cloud.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: westerndigital
Affected products: my_cloud, my_cloud_firmware
CVE-2018-9149 (published 2018-04-01)
The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: zyxel
Affected products: ac3000, ac3000_firmware
CVE-2018-9151 (published 2018-03-30)
A NULL pointer dereference bug in the function ObReferenceObjectByHandle in the Kingsoft Internet Security 9+ kernel driver KWatch3.sys allows local non-privileged users to crash the system via IOCTL 0x80030030.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: kingsoft
Affected products: internet_security_9_plus
CVE-2018-9153 (published 2018-04-16)
The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directly by an administrator, or through CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: zblogcn
Affected products: z-blogphp
CVE-2018-9154 (published 2018-05-04)
There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value, a different vulnerability than CVE-2017-13745.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: jasper_project
Affected products: jasper
CVE-2018-9155 (published 2018-04-12)
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (via the "Name (display)" field to the attributes/create URI).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: open-audit
Affected products: open-audit
CVE-2018-9156 (published 2018-04-01)
An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: axis
Affected products: p1354, p1354_firmware
CVE-2018-9157 (published 2018-04-01)
An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: axis
Affected products: m1033-w, m1033-w_firmware
CVE-2018-9158 (published 2018-04-01)
An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. They don't employ a suitable mechanism to prevent a DoS attack, which leads to a response time delay. An attacker can use the hping3 tool to perform an IPv4 flood attack, and the services are interrupted from attack start to end.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: axis
Affected products: m1033-w, m1033-w_firmware
CVE-2018-9159 (published 2018-03-31)
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: sparkjava
Affected products: spark