deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-9518
Published: 2018-12-07
Description: In nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-73083945.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-09-01; https://usn.ubuntu.com/3798-1/; https://usn.ubuntu.com/3798-2/
CVE: CVE-2018-9519
Published: 2018-12-07
Description: In easelcomm_hw_build_scatterlist, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System privileges required. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-69808833.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2018-09-01; https://source.android.com/security/bulletin/pixel/2018-09-01
CVE: CVE-2018-9569
Published: 2018-12-07
Description: In impd_init_drc_decode_post_config of impd_drc_gain_decoder.c there is a possible out-of-bound write due to incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113885537.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9570
Published: 2018-12-07
Description: In impd_parse_drc_ext_v1 of impd_drc_dynamic_payload.c there is a possible out-of-bound write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-115375616.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9571
Published: 2018-12-07
Description: In impd_parse_loud_eq_instructions of impd_drc_dynamic_payload.c there is a possible out-of-bound write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116020594.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9572
Published: 2018-12-07
Description: In impd_drc_parse_coeff of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116224432.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9573
Published: 2018-12-07
Description: In impd_parse_filt_block of impd_drc_dynamic_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116467350.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9574
Published: 2018-12-07
Description: In impd_parse_split_drc_characteristic of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116619337.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9575
Published: 2018-12-07
Description: In impd_parse_dwnmix_instructions of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116619387.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9576
Published: 2018-12-07
Description: In impd_parse_parametric_drc_instructions of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116715245.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9577
Published: 2018-12-07
Description: In impd_parametric_drc_parse_gain_set_params of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116715937.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9578
Published: 2018-12-07
Description: In ixheaacd_adts_crc_start_reg of ixheaacd_adts_crc_check.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113261928.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-19961
Published: 2018-12-08
Description: An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-459
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html; http://www.securityfocus.com/bid/106182; https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
CVE: CVE-2018-19962
Published: 2018-12-08
Description: An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html; http://www.securityfocus.com/bid/106182; https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
CVE: CVE-2018-19963
Published: 2018-12-08
Description: An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-617
References: http://www.securityfocus.com/bid/106182; https://xenbits.xen.org/xsa/advisory-276.html; http://www.securityfocus.com/bid/106182
CVE: CVE-2018-19964
Published: 2018-12-08
Description: An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106182; https://xenbits.xen.org/xsa/advisory-277.html; http://www.securityfocus.com/bid/106182
CVE: CVE-2018-19965
Published: 2018-12-08
Description: An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
CVSS Score: 5.6 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html; http://www.securityfocus.com/bid/106182; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
CVE: CVE-2018-19966
Published: 2018-12-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.
CVSS Score: 8.8 (HIGH)
CWE: CWE-436
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html; http://www.securityfocus.com/bid/106182; https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
CVE: CVE-2018-19967
Published: 2018-12-08
Description: An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel's mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00057.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html; http://www.securityfocus.com/bid/106182
CVE: CVE-2018-19980
Published: 2018-12-08
Description: Anker Nebula Capsule Pro NBUI_M1_V2.1.9 devices allow attackers to cause a denial of service (reboot of the underlying Android 7.1.2 operating system) via a crafted application that sends data to WifiService.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/ISCAS-Vulab/PoC_Nebula-Capsule-Pro-Wifi; https://github.com/ISCAS-Vulab/PoC_Nebula-Capsule-Pro-Wifi
CVE: CVE-2018-19653
Published: 2018-12-09
Description: HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310
References: https://github.com/hashicorp/consul/pull/5069; https://groups.google.com/forum/#%21topic/consul-tool/7TCw06oio0I; https://github.com/hashicorp/consul/pull/5069
CVE: CVE-2018-19982
Published: 2018-12-09
Description: An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP > Server > Controller (HUB) > Node (products which are controlled by HUB). The prerequisite is that the attacker is on the same network as the target HUB, and can use IP Changer to change destination IP addresses (of all packets whose destination IP address is Server) to a proxy-server IP address. This allows sniffing of cleartext between Server and Controller. The cleartext command data is transmitted to Controller using the proxy server's fake certificate, and it is able to control each Node of the HUB. Also, by operating HUB in Z-Wave Pairing Mode, it is possible to obtain the Z-Wave network key.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/min1233/CVE/blob/master/1; https://github.com/min1233/CVE/blob/master/1
CVE: CVE-2018-19983
Published: 2018-12-09
Description: An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., Z-Wave PC Controller, OpenZWave, CC1110, etc.). Next, the attacker conducts a DoS attack against the Z-Wave S0 Security version product by continuously sending divided "Nonce Get (0x98 0x81)" frames. The reason for dividing the "Nonce Get" frame is that, in security version S0, when a node receives a "Nonce Get" frame, the node produces a random new nonce and sends it to the Src node of the received "Nonce Get" frame. After the nonce value is generated and transmitted, the node transitions to wait mode. At this time, when "Nonce Get" is received again, the node discards the previous nonce value and generates a random nonce again. Therefore, because the frame is encrypted with previous nonce value, the received normal frame cannot be decrypted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330
References: https://github.com/min1233/CVE/blob/master/2; https://github.com/min1233/CVE/blob/master/2
CVE: CVE-2018-19991
Published: 2018-12-10
Description: VeryNginx 0.3.3 allows remote attackers to bypass the Web Application Firewall feature because there is no error handler (for get_uri_args or get_post_args) to block the API misuse described in CVE-2018-9230.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755
References: https://github.com/alexazhou/VeryNginx/issues/218; https://github.com/alexazhou/VeryNginx/issues/218
CVE: CVE-2018-20000
Published: 2018-12-10
Description: Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/Bedework/bw-webdav/compare/bw-webdav-4.0.2...bw-webdav-4.0.3; https://github.com/Bedework/bw-webdav/pull/1; https://github.com/Bedework/bw-webdav/compare/bw-webdav-4.0.2...bw-webdav-4.0.3
CVE: CVE-2018-20001
Published: 2018-12-10
Description: In Libav 12.3, there is a floating point exception in the range_decode_culshift function (called from range_decode_bits) in libavcodec/apedec.c that will lead to remote denial of service via crafted input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.libav.org/show_bug.cgi?id=1141; https://bugzilla.libav.org/show_bug.cgi?id=1141
CVE: CVE-2018-20002
Published: 2018-12-10
Description: The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/106142; https://security.gentoo.org/glsa/201908-01; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-20004
Published: 2018-12-10
Description: An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxml_write_node in mxml-file.c via vectors involving a double-precision floating point number and the '<order type="real">' substring, as demonstrated by testmxml.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/fouzhe/security/tree/master/mxml#stack-buffer-overflow-in-function-mxml_write_node; https://github.com/michaelrsweet/mxml/issues/233; https://lists.debian.org/debian-lts-announce/2019/01/msg00018.html
CVE: CVE-2018-20005
Published: 2018-12-10
Description: An issue has been found in Mini-XML (aka mxml) 2.12. It is a use-after-free in mxmlWalkNext in mxml-search.c, as demonstrated by mxmldoc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/fouzhe/security/tree/master/mxml#heap-use-after-free-in-function-mxmlwalknext; https://github.com/michaelrsweet/mxml/issues/234; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N53IJHDYR5HVQLKH4J6B27OEQLGKSGY5/
CVE: CVE-2018-20006
Published: 2018-12-10
Description: An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save (reachable via the index.php?id=book URI).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/qinggan/phpok/issues/3; https://github.com/qinggan/phpok/issues/3
CVE: CVE-2018-20009
Published: 2018-12-10
Description: DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/domainmod/domainmod/issues/88; https://www.exploit-db.com/exploits/46372/; https://github.com/domainmod/domainmod/issues/88
CVE: CVE-2018-20010
Published: 2018-12-10
Description: DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/domainmod/domainmod/issues/88; https://www.exploit-db.com/exploits/46373/; https://github.com/domainmod/domainmod/issues/88
CVE: CVE-2018-20011
Published: 2018-12-10
Description: DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/domainmod/domainmod/issues/88; https://www.exploit-db.com/exploits/46374/; https://github.com/domainmod/domainmod/issues/88
CVE: CVE-2018-20012
Published: 2018-12-10
Description: PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.phpcmf.net/version-13.html; https://gitee.com/copy_cat/phpcmf/blob/master/README.md; http://www.phpcmf.net/version-13.html
CVE: CVE-2018-20015
Published: 2018-12-10
Description: YzmCMS v5.2 has admin/role/add.html CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Jxysir/YZM-CSRF-; https://github.com/Jxysir/YZM-CSRF-
CVE: CVE-2018-20017
Published: 2018-12-10
Description: SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/semcms/issues/1; https://github.com/source-trace/semcms/issues/1
CVE: CVE-2018-20018
Published: 2018-12-10
Description: S-CMS V3.0 has SQL injection via the S_id parameter, as demonstrated by the /1/?type=productinfo&S_id=140 URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/QQ704568679/-/blob/master/README.md; https://github.com/QQ704568679/-/blob/master/README.md
CVE: CVE-2016-8489
Published: 2018-12-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10242.  Reason: This candidate is a reservation duplicate of CVE-2016-10242.  Notes: All CVE users should reference CVE-2016-10242 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-10502
Published: 2018-12-10
Description: While generating trusted application id, An integer overflow can occur giving the trusted application an invalid identity in Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835 and SDA660.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.securityfocus.com/bid/105838; https://source.android.com/security/bulletin/2018-11-01#qualcomm-components; http://www.securityfocus.com/bid/105838
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-10
Description: A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html; http://www.securityfocus.com/bid/106176; https://access.redhat.com/errata/RHBA-2019:0024
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-10
Description: An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106176; https://access.redhat.com/errata/RHBA-2019:0024; https://jenkins.io/security/advisory/2018-12-05/#SECURITY-904
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-10
Description: A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/106176; https://access.redhat.com/errata/RHBA-2019:0024; https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-10
Description: A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/106176; https://access.redhat.com/errata/RHBA-2019:0024; https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1193
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-10
Description: A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://access.redhat.com/errata/RHBA-2019:0326; https://access.redhat.com/errata/RHBA-2019:0327; https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-10
Description: A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://access.redhat.com/errata/RHBA-2019:0326; https://access.redhat.com/errata/RHBA-2019:0327; https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186
CVE: CVE-2018-1671
Published: 2018-12-10
Description: IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106202; https://exchange.xforce.ibmcloud.com/vulnerabilities/144951; https://www.ibm.com/support/docview.wss?uid=ibm10739019
CVE: CVE-2018-1957
Published: 2018-12-10
Description: IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequest#authenticate() API when an unprotected URI is accessed. IBM X-Force ID: 153629.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106203; https://exchange.xforce.ibmcloud.com/vulnerabilities/153629; https://www.ibm.com/support/docview.wss?uid=ibm10744247