aswin1906/github-advisory-2018.csv huggingface dataset:
Electron webPreferences vulnerability can be used to perform remote code execution (CVE-2018-15685)
Published: 2018-08-23T19:12:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a webPreferences vulnerability that can be leveraged to perform remote code execution.

More information to determine if you are impacted can be found on the [electron blog](https://electronjs.org/blog/web-preferences-fix).


## Recommendation

Upgrade Electron to >=3.0.0-beta.7, >=2.0.8, >=1.8.8, or >=1.7.16.
Command Injection in git-dummy-commit (CVE-2018-3785)
Published: 2018-08-21T17:03:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
Shadowsock is malware (CVE-2017-16078)
Published: 2018-08-27T19:07:23Z

The `shadowsock` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Hijacked Environment Variables in proxy.js (CVE-2017-16076)
Published: 2018-08-29T23:19:13Z

The `proxy.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
metascraper before v5.2.0 vulnerable to stored cross-site scripting (CVE-2018-3773)
Published: 2018-08-08T22:25:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Versions of `metascraper` prior to 5.2.0 are vulnerable to stored cross-site scripting (XSS).


## Recommendation

Upgrade to version 5.2.0 or later.
coffescript is malware (CVE-2017-16205)
Published: 2018-08-06T20:12:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The `coffescript` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.



## Recommendation

If you have found `coffescript` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
PyCryptodome Integer overflow vulnerability (CVE-2018-15560)
Published: 2018-08-27T19:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.
Moderate severity vulnerability that affects activerecord ()
Published: 2018-08-13T20:49:01Z

Withdrawn, accidental duplicate publish.

Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
crossenv is malware (CVE-2017-16074)
Published: 2018-08-29T23:05:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The `crossenv` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Privilege Escalation due to Blind NoSQL Injection in flintcms (CVE-2018-3783)
Published: 2018-08-21T17:03:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Versions of `flintcms` before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset.


## Recommendation

Update to version 1.1.10 or later.
Cross-Site Scripting in @ckeditor/ckeditor5-link (CVE-2018-11093)
Published: 2018-05-23T20:37:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Versions of `status-board` prior to 10.0.1 are vulnerable to Cross-Site Scripting. The `_createPreviewButton()` function fails to sanitize the `href` attribute of a created `<a>` tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 10.0.1 or later.
Apache NiFi Improper Input Validation vulnerability (CVE-2018-17194)
Published: 2018-12-20T22:02:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Moderate severity vulnerability that affects org.apache.nifi:nifi (CVE-2018-17193)
Published: 2018-12-20T22:02:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Improper Restriction of XML External Entity Reference in bedework:bw-webdav (CVE-2018-20000)
Published: 2018-12-19T19:24:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.
exist-db:exist-core XML External Entity (XXE) vulnerability (CVE-2018-1000823)
Published: 2018-12-20T22:02:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
Buffer Overflow in pycrypto (CVE-2013-7459)
Published: 2018-12-14T18:51:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
aiohttp-session creates non-expiring sessions (CVE-2018-1000814)
Published: 2018-12-20T22:01:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
XML External Entity (XXE) vulnerability in bw-calendar-engine (CVE-2018-1000836)
Published: 2018-12-20T22:02:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.
Improper Privilege Management in Apache Karaf (CVE-2018-11786)
Published: 2018-12-21T17:49:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.
Moderate severity vulnerability that affects org.apache.oozie:oozie-core (CVE-2018-11799)
Published: 2018-12-20T22:01:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.
Improper Authentication in Keycloak (CVE-2018-14637)
Published: 2018-12-21T17:48:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
PyKMIP Denial of service vulnerability (CVE-2018-1000872)
Published: 2018-12-21T17:46:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of the available sockets. This attack appear to be exploitable via A client or clients open sockets with the server and then never close them. This vulnerability appears to have been fixed in 0.8.0.
Code injection in ymlref (CVE-2018-20133)
Published: 2018-12-19T19:25:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ymlref is a library that allows to load Yaml documents and resolve JSON-pointer references inside them. ymlref versions up to 0.1.1 allow code injection.
Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main (CVE-2017-15713)
Published: 2018-12-21T17:50:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.
Unrestricted Upload of File with Dangerous Type in jquery-file-upload (CVE-2018-9207)
Published: 2018-12-19T19:24:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Arbitrary file upload in jQuery Upload File <= 4.0.2
Improper Restriction of XML External Entity Reference in pippo-core (CVE-2018-20059)
Published: 2018-12-19T19:24:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
Directory Traversal vulnerability in Square Retrofit (CVE-2018-1000850)
Published: 2018-12-21T17:48:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Square Retrofit versions from (including) 2.0 to 2.5.0 (excluding) contain a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter. By manipulating the URL an attacker could add or delete resources otherwise unavailable to her. This attack appears to be exploitable via an encoded path parameter on POST, PUT or DELETE request. This vulnerability appears to have been fixed in 2.5.0 and later.
Fat Free CRM vulnerable to Cross-site Scripting (CVE-2018-1000842)
Published: 2018-12-20T22:01:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

FatFreeCRM version `<=0.14.1`, `>=0.15.0 <=0.15.1`, `>=0.16.0 <=0.16.3`, `>=0.17.0 <=0.17.2`, and `==0.18.0` contains a Cross Site Scripting (XSS) vulnerability in [commit 6d60bc8ed010c4eda05d6645c64849f415f68d65](https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa) that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, and 0.14.2.
Arbitrary Command Execution in Hadoop (CVE-2018-11766)
Published: 2018-12-21T17:50:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.
XML External Entity (XXE) vulnerability in Square Retrofit (CVE-2018-1000844)
Published: 2018-12-21T17:48:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Square Open Source Retrofit versions prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contain a XML External Entity (XXE) vulnerability in JAXB. An attacker could use this to remotely read files from the file system or to perform SSRF. This vulnerability appears to have been fixed in commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.
Improper Access Control in activejob (CVE-2018-16476)
Published: 2018-12-05T17:24:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
Cross site scripting in flask-admin (CVE-2018-16516)
Published: 2018-12-19T19:23:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.
High severity vulnerability that affects commons-fileupload:commons-fileupload (CVE-2016-3092)
Published: 2018-12-21T17:47:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Cross-Site Request Forgery (CSRF) in Luigi (CVE-2018-1000843)
Published: 2018-12-20T22:01:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such as task name, id, parameter, etc. will be leaked to unauthorized users. This attack appear to be exploitable via The victim must visit a specially crafted webpage from the network where their Luigi server is accessible.. This vulnerability appears to have been fixed in 2.8.0 and later.
XXL-CONF Path Traversal vulnerability (CVE-2018-20094)
Published: 2018-12-19T19:25:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via `../` in the keys parameter that can download any configuration file, related to `ConfController.java` and `PropUtil.java`.
Commons FileUpload Denial of service vulnerability (CVE-2014-0050)
Published: 2018-12-21T17:51:42Z

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Path Traversal in Hadoop (CVE-2018-8009)
Published: 2018-12-21T17:50:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
Cross Site Scripting (XSS) vulnerability in easymon (CVE-2018-1000855)
Published: 2018-12-21T17:46:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.
Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main (CVE-2017-3166)
Published: 2018-12-21T17:50:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file.
Cleartext Transmission of Sensitive Information in Apache nifi (CVE-2018-17195)
Published: 2018-12-20T22:02:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level. Mitigation: The fix to apply Cross-Origin Resource Sharing (CORS) policy request filtering was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Exposure of Sensitive Information in Hadoop (CVE-2017-15718)
Published: 2018-12-21T17:50:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Improper Restriction of Rendered UI Layers or Frames in Apache nifif (CVE-2018-17192)
Published: 2018-12-20T22:02:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Exposure of Sensitive Information to an Unauthorized Actor in activestorage (CVE-2018-16477)
Published: 2018-12-05T17:17:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path.

Vulnerable apps are those using either GCS or the Disk service in production. Other storage services such as S3 or Azure aren't affected.
Remote Code Execution in esigate-core (CVE-2018-1000854)
Published: 2018-12-21T17:46:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.
Improper Access Control in commons-fileupload (CVE-2016-1000031)
Published: 2018-12-21T17:51:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
OS Command Injection in craftercms:crafter-studio (CVE-2018-19907)
Published: 2018-12-19T19:24:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.