alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2018-7229 (published 2018-03-09)
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and gain administrator privileges because the use of hardcoded credentials.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7230 (published 2018-03-09)
A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-611
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7231 (published 2018-03-09)
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'system.opkg.remove'.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7232 (published 2018-03-09)
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'network.ieee8021x.delete_certs'.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7233 (published 2018-03-09)
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due to lack of validation of the shell meta characters with the value of 'model_name' or 'mac_address'.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7234 (published 2018-03-09)
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-295
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7235 (published 2018-03-09)
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of the shell meta characters with the value of 'system.download.sd_file'
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7236 (published 2018-03-09)
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Weakness: CWE-287
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7237 (published 2018-03-09)
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/set_param to the file name with the value of 'system.delete.sd_file'
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-20
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7238 (published 2018-03-09)
A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to execute arbitrary code.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: schneider-electric
Affected products: ibp1110-1er, ibp1110-1er_firmware, ibp219-1er, ibp219-1er_firmware, ibp319-1er, ibp319-1er_firmware, ibp519-1er, ibp519-1er_firmware, ibps110-1er, ibps110-1er_firmware, imp1110-1, imp1110-1_firmware, imp1110-1e, imp1110-1e_firmware, imp1110-1er, imp1110-1er_firmware, imp219-1, imp219-1_firmware, imp219-1e, imp219-1e_firmware, imp219-1er, imp219-1er_firmware, imp319-1, imp319-1_firmware, imp319-1e
CVE-2018-7239 (published 2018-03-09)
A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-426
Affected vendors: schneider-electric
Affected products: atv12_dtm, atv212_dtm, atv312_dtm, atv31_dtm, atv320_dtm, atv32_dtm, atv340_dtm, atv600_dtm, atv61_dtm, atv71_dtm, atv900_dtm, atv_lift_dtm, somove
CVE-2018-7240 (published 2018-04-18)
A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution. An FTP command used to upgrade the firmware of the module can be misused to cause a denial of service, or in extreme cases, to load a malicious firmware.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: schneider-electric
Affected products: 140cpu31110, 140cpu31110_firmware, 140cpu31110c, 140cpu31110c_firmware, 140cpu43412u, 140cpu43412u_firmware, 140cpu43412uc, 140cpu43412uc_firmware, 140cpu65150, 140cpu65150_firmware, 140cpu65150c, 140cpu65150c_firmware, 140cpu65160, 140cpu65160_firmware, 140cpu65160c, 140cpu65160c_firmware, 140cpu65160s, 140cpu65160s_firmware, 140cpu65260, 140cpu65260_firmware, 140cpu65260c, 140cpu65260c_firmware, 140cpu65860, 140cpu65860_firmware, 140cpu65860c
CVE-2018-7241 (published 2018-04-18)
Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: schneider-electric
Affected products: 140cpu31110, 140cpu31110_firmware, 140cpu31110c, 140cpu31110c_firmware, 140cpu43412u, 140cpu43412u_firmware, 140cpu43412uc, 140cpu43412uc_firmware, 140cpu65150, 140cpu65150_firmware, 140cpu65150c, 140cpu65150c_firmware, 140cpu65160, 140cpu65160_firmware, 140cpu65160c, 140cpu65160c_firmware, 140cpu65160s, 140cpu65160s_firmware, 140cpu65260, 140cpu65260_firmware, 140cpu65260c, 140cpu65260c_firmware, 140cpu65860, 140cpu65860_firmware, 140cpu65860c
CVE-2018-7242 (published 2018-04-18)
Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-326
Affected vendors: schneider-electric
Affected products: 140cpu31110, 140cpu31110_firmware, 140cpu31110c, 140cpu31110c_firmware, 140cpu43412u, 140cpu43412u_firmware, 140cpu43412uc, 140cpu43412uc_firmware, 140cpu65150, 140cpu65150_firmware, 140cpu65150c, 140cpu65150c_firmware, 140cpu65160, 140cpu65160_firmware, 140cpu65160c, 140cpu65160c_firmware, 140cpu65160s, 140cpu65160s_firmware, 140cpu65260, 140cpu65260_firmware, 140cpu65260c, 140cpu65260c_firmware, 140cpu65860, 140cpu65860_firmware, 140cpu65860c
CVE-2018-7243 (published 2018-04-18)
An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to get a full access to device, bypassing the authorization system.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: schneider-electric
Affected products: 66074_mge_network_management_card_transverse, mge_comet_ups, mge_eps_6000, mge_eps_7000, mge_eps_8000, mge_galaxy_3000, mge_galaxy_4000, mge_galaxy_5000, mge_galaxy_6000, mge_galaxy_9000, mge_galaxy_pw
CVE-2018-7244 (published 2018-04-18)
An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to obtain sensitive device information if network access was obtained.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: schneider-electric
Affected products: 66074_mge_network_management_card_transverse, mge_comet_ups, mge_eps_6000, mge_eps_7000, mge_eps_8000, mge_galaxy_3000, mge_galaxy_4000, mge_galaxy_5000, mge_galaxy_6000, mge_galaxy_9000, mge_galaxy_pw
CVE-2018-7245 (published 2018-04-18)
An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to change UPS control and shutdown parameters or other critical settings without authorization.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-863
Affected vendors: schneider-electric
Affected products: 66074_mge_network_management_card_transverse, mge_comet_ups, mge_eps_6000, mge_eps_7000, mge_eps_8000, mge_galaxy_3000, mge_galaxy_4000, mge_galaxy_5000, mge_galaxy_6000, mge_galaxy_9000, mge_galaxy_pw
CVE-2018-7246 (published 2018-04-18)
A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. he integrated web server (Port 80/443/TCP) of the affected devices could allow remote attackers to discover an administrative account. If default on device, it is not using a SSL in settings and if multiple request of the page "Access Control" (IP-address device/ups/pas_cont.htm) account data will be sent in cleartext
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-319
Affected vendors: schneider-electric
Affected products: 66074_mge_network_management_card_transverse, mge_comet_ups, mge_eps_6000, mge_eps_7000, mge_eps_8000, mge_galaxy_3000, mge_galaxy_4000, mge_galaxy_5000, mge_galaxy_6000, mge_galaxy_9000, mge_galaxy_pw
CVE-2018-7247 (published 2018-02-19)
An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potentially to arbitrary code execution or possibly unspecified other impact.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: leptonica
Affected products: leptonica
CVE-2018-7248 (published 2018-05-11)
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it does not.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: zohocorp
Affected products: manageengine_servicedesk_plus
CVE-2018-7249 (published 2018-02-26)
An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls to IOCTL 0xCA002813 can cause a race condition that leads to a use-after-free. When exploited, an unprivileged attacker can run arbitrary code in the kernel.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft, tivo
Affected products: safedisc, windows_7, windows_8, windows_8.1, windows_vista
CVE-2018-7250 (published 2018-02-26)
An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. An uninitialized kernel pool allocation in IOCTL 0xCA002813 allows a local unprivileged attacker to leak 16 bits of uninitialized kernel PagedPool data.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft, tivo
Affected products: safedisc, windows_7, windows_8, windows_8.1, windows_vista
CVE-2018-7251 (published 2018-02-19)
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-200
Affected vendors: anchorcms
Affected products: anchor
CVE-2018-7253 (published 2018-02-19)
The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: canonical, debian, wavpack
Affected products: debian_linux, ubuntu_linux, wavpack
CVE-2018-7254 (published 2018-02-19)
The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, wavpack
Affected products: debian_linux, wavpack
CVE-2018-7259 (published 2018-02-20)
The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ashx if a pirated serial number has been entered, which allows remote attackers to obtain sensitive information, e.g., by sniffing the network for cleartext HTTP traffic. This behavior was removed in 2.0.1.232.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-319
Affected vendors: flightsimlabs
Affected products: a320-x
CVE-2018-7260 (published 2018-02-21)
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: phpmyadmin
Affected products: phpmyadmin
CVE-2018-7261 (published 2018-02-21)
There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: radiantcms
Affected products: radiant_cms
CVE-2018-7262 (published 2018-03-19)
In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: fedoraproject, redhat
Affected products: ceph, fedora
CVE-2018-7263 (published 2018-02-20)
The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: underbit
Affected products: libmad
CVE-2018-7264 (published 2018-02-28)
The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and sign errors, allowing a remote attacker to execute arbitrary code on vulnerable applications using the ActivePDF Toolkit to process untrusted images.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: activepdf
Affected products: activepdf_toolkit
CVE-2018-7265 (published 2018-02-20)
Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: shimmie2_project
Affected products: shimmie2
CVE-2018-7268 (published 2018-05-21)
MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerability in which a local unprivileged user is able to read any root (uid 0) owned file on the system, regardless of the file permissions. Confidential information such as password hashes (/etc/shadow) or other secrets (such as log files or private keys) can be leaked to the attacker. The vulnerability has a confidentiality impact, but has no direct impact on system integrity or availability.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple, linux, magnicomp
Affected products: linux_kernel, mac_os_x, sysinfo
CVE-2018-7269 (published 2018-03-21)
The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: yiiframework
Affected products: yii
CVE-2018-7271 (published 2018-02-21)
An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: metinfo
Affected products: metinfo
CVE-2018-7272 (published 2018-02-21)
The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: forgerock
Affected products: access_management
CVE-2018-7273 (published 2018-02-21)
In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections such as KASLR.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: linux
Affected products: linux_kernel
CVE-2018-7274 (published 2018-02-21)
Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title), Widgets (Name), and Menus (Name).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: quarx_cms_project
Affected products: quarx_cms
CVE-2018-7276 (published 2018-02-21)
An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitive information via a /DbXmlInfo.xml request, as demonstrated by the Latitude/Longitude of the device.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: lutron
Affected products: quantum_bacnet_integration, quantum_bacnet_integration_firmware
CVE-2018-7277 (published 2018-02-21)
An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: rletech
Affected products: fds-wi, fds-wi_firmware, wi-mgr, wi-mgr_firmware
CVE-2018-7278 (published 2018-02-21)
An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: rletech
Affected products: fds-pc, fds-pc-dp, fds-pc-dp_firmware, fds-pc_firmware
CVE-2018-7279 (published 2018-03-14)
A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: alienvault
Affected products: open_source_security_information_management, unified_security_management
CVE-2018-7280 (published 2018-02-21)
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ninjaforms
Affected products: ninja_forms
CVE-2018-7281 (published 2018-02-21)
CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. The binary takes a single command line argument and passes this argument to a system() call, thus allowing low privileged users to execute commands as root.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: cactusvpn
Affected products: cactusvpn
CVE-2018-7282 (published 2019-12-06)
The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: titool
Affected products: printmonitor
CVE-2018-7284 (published 2018-02-22)
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: debian, digium
Affected products: asterisk, certified_asterisk, debian_linux
CVE-2018-7285 (published 2018-02-22)
A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamic codecs and desired payload numbers. While an SDP negotiation may result in a codec using a different payload number, these desired ones are still stored internally. When an RTP packet was received, this registry would be consulted if the payload number was not found in the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payload number resulted in a codec of a different type than the RTP stream (for example, the payload number resulted in a video codec but the stream carried audio), a crash could occur if no stream of that type had been negotiated. This was due to the code incorrectly assuming that a stream of that type would always exist.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: digium
Affected products: asterisk
CVE-2018-7286 (published 2018-02-22)
An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: debian, digium
Affected products: asterisk, certified_asterisk, debian_linux
CVE-2018-7287 (published 2018-02-22)
An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1. If the HTTP server is enabled (default is disabled), WebSocket payloads of size 0 are mishandled (with a busy loop).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: digium
Affected products: asterisk
CVE-2018-7289 (published 2018-02-21)
An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters.
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-172
Affected vendors: teclib-edition
Affected products: armadito_antivirus
CVE-2018-7290 (published 2018-03-09)
Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tiki
Affected products: tikiwiki_cms\/groupware
CVE-2018-7295 (published 2018-05-23)
ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-924
Affected vendors: square-enix
Affected products: final_fantasy_xiv
CVE-2018-7296 (published 2018-02-22)
Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: eq-3
Affected products: homematic_central_control_unit_ccu2, homematic_central_control_unit_ccu2_firmware
CVE-2018-7297 (published 2018-02-22)
Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: eq-3
Affected products: homematic_central_control_unit_ccu2, homematic_central_control_unit_ccu2_firmware
CVE-2018-7298 (published 2018-02-22)
In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which does not provide any cryptographic protection of the downloaded contents. An attacker with a privileged network position (which could be obtained via DNS spoofing of www.meine-homematic.de or other approaches) can exploit this issue in order to provide arbitrary malicious firmware updates to the CCU2. This can result in a full system compromise.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-319
Affected vendors: eq-3
Affected products: homematic_central_control_unit_ccu2, homematic_central_control_unit_ccu2_firmware
CVE-2018-7299 (published 2018-02-22)
Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or install malicious software on the device.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: eq-3
Affected products: homematic_central_control_unit_ccu2, homematic_central_control_unit_ccu2_firmware
CVE-2018-7300 (published 2018-02-22)
Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: eq-3
Affected products: homematic_ccu2, homematic_ccu2_firmware
CVE-2018-7301 (published 2018-02-22)
eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: eq-3
Affected products: homematic_central_control_unit_ccu2, homematic_central_control_unit_ccu2_firmware
CVE-2018-7302 (published 2018-02-21)
Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tiki
Affected products: tiki
CVE-2018-7303 (published 2018-02-21)
The Calendar component in Tiki 17.1 allows HTML injection.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tiki
Affected products: tikiwiki_cms\/groupware
CVE-2018-7304 (published 2018-02-21)
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1236
Affected vendors: tiki
Affected products: tiki
CVE-2018-7305 (published 2018-02-21)
MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: mybb
Affected products: mybb
CVE-2018-7307 (published 2018-03-06)
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: auth0
Affected products: auth0.js
CVE-2018-7308 (published 2018-02-21)
A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any hosting account.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: hosting_project
Affected products: hosting
CVE-2018-7311 (published 2018-02-21)
PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new VPN connection operations via the main PrivateVPN application. The privileged helper tool creates new VPN connections by executing the openvpn binary located in the /Applications/PrivateVPN.app/Contents/Resources directory. The openvpn binary can be overwritten by the default user, which allows an attacker that has already installed malicious software as the default user to replace the binary. When a new VPN connection is established, the privileged helper tool will launch this malicious binary, thus allowing an attacker to execute code as the root user. NOTE: the vendor has reportedly indicated that this behavior is "an acceptable part of their software.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: privatevpn
Affected products: privatevpn
CVE-2018-7312 (published 2018-02-22)
SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: alexandriabooklibrary
Affected products: alexandria_book_library
CVE-2018-7313 (published 2018-02-22)
SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: cwjoomla
Affected products: cw_tags
CVE-2018-7314 (published 2018-02-22)
SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: mlwebtechnologies
Affected products: prayercenter
CVE-2018-7315 (published 2018-02-22)
SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameter.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: harmistechnology
Affected products: ek_rishta
CVE-2018-7316 (published 2018-02-22)
Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: christianwebministries
Affected products: proclaim
CVE-2018-7317 (published 2018-02-22)
Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: christianwebministries
Affected products: proclaim
CVE-2018-7318 (published 2018-02-22)
SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: belitsoft, oracle
Affected products: checklist, data_integrator
CVE-2018-7319 (published 2018-02-22)
SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameter.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: os_property_real_estate_project
Affected products: os_property_real_estate
CVE-2018-7320 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by validating operand offsets.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7321 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thrift.c had a large loop that was addressed by not proceeding with dissection after encountering an unexpected type.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-834
Affected vendors: wireshark
Affected products: wireshark
CVE-2018-7322 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-dcm.c had an infinite loop that was addressed by checking for integer wraparound.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7323 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-wccp.c had a large loop that was addressed by ensuring that a calculated length was monotonically increasing.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-834
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7324 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-sccp.c had an infinite loop that was addressed by using a correct integer data type.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7325 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpki-rtr.c had an infinite loop that was addressed by validating a length field.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7326 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-lltd.c had an infinite loop that was addressed by using a correct integer data type.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: wireshark
Affected products: wireshark
CVE-2018-7327 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-openflow_v6.c had an infinite loop that was addressed by validating property lengths.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: wireshark
Affected products: wireshark
CVE-2018-7328 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-usb.c had an infinite loop that was addressed by rejecting short frame header lengths.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: wireshark
Affected products: wireshark
CVE-2018-7329 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-s7comm.c had an infinite loop that was addressed by correcting off-by-one errors.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-193
Affected vendors: wireshark
Affected products: wireshark
CVE-2018-7330 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thread.c had an infinite loop that was addressed by using a correct integer data type.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: wireshark
Affected products: wireshark
CVE-2018-7331 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-ber.c had an infinite loop that was addressed by validating a length.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7332 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-reload.c had an infinite loop that was addressed by validating a length.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7333 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpcrdma.c had an infinite loop that was addressed by validating a chunk size.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: wireshark
Affected products: wireshark
CVE-2018-7334 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the UMTS MAC dissector could crash. This was addressed in epan/dissectors/packet-umts_mac.c by rejecting a certain reserved value.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7335 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the IEEE 802.11 dissector could crash. This was addressed in epan/crypt/airpdcap.c by rejecting lengths that are too small.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7336 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the FCP protocol dissector could crash. This was addressed in epan/dissectors/packet-fcp.c by checking for a NULL pointer.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7337 (published 2018-02-23)
In Wireshark 2.4.0 to 2.4.4, the DOCSIS protocol dissector could crash. This was addressed in plugins/docsis/packet-docsis.c by removing the recursive algorithm that had been used for concatenated PDUs.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: debian, wireshark
Affected products: debian_linux, wireshark
CVE-2018-7339 (published 2018-02-23)
The MP4Atom class in mp4atom.cpp in MP4v2 through 2.0.0 mishandles Entry Number validation for the MP4 Table Property, which allows remote attackers to cause a denial of service (overflow, insufficient memory allocation, and segmentation fault) or possibly have unspecified other impact via a crafted mp4 file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: mp4v2_project
Affected products: mp4v2
CVE-2018-7340 (published 2019-04-17)
Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-287
Affected vendors: cisco
Affected products: duo_network_gateway
CVE-2018-7355 (published 2018-09-26)
All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation, an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection attacks on the devices.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: zte
Affected products: mf65, mf65_firmware, mf65m1, mf65m1_firmware
CVE-2018-7356 (published 2018-11-01)
All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which can generate easily predictable ISN, and allows remote attackers to spoof connections.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-294
Affected vendors: zte
Affected products: zxr10_8905e, zxr10_8905e_firmware