deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2056
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2057
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2058
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2059
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2060
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2061
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2062
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2063
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2064
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2065
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2066
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2067
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2068
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2069
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2070
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2071
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2072
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2073
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2074
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2075
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2076
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2077
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2078
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2079
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2080
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2081
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2082
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2083
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2084
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2085
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2086
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2087
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2088
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-2089
Published: 2018-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-4945
Published: 2018-01-05
Description: VMware Workstation (14.x and 12.x) and Fusion (10.x and 8.x) contain a guest access control vulnerability. This issue may allow program execution via Unity on locked Windows VMs. VMware Tools must be updated to 10.2.0 for each VM to resolve CVE-2017-4945. VMware Tools 10.2.0 is consumed by Workstation 14.1.0 and Fusion 10.1.0 by default.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/102441; http://www.securitytracker.com/id/1040109; http://www.securitytracker.com/id/1040136
CVE: CVE-2017-4946
Published: 2018-01-05
Description: The VMware V4H and V4PA desktop agents (6.x before 6.5.1) contain a privilege escalation vulnerability. Successful exploitation of this issue could result in a low privileged windows user escalating their privileges to SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: http://gosecure.net/2018/01/10/vmware-horizon-v4h-v4pa-desktop-agent-privilege-escalation-vulnerability-cve-2017-4946/; http://www.securityfocus.com/bid/102441; http://www.securitytracker.com/id/1040136
CVE: CVE-2017-4948
Published: 2018-01-05
Description: VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in TPView.dll. On Workstation, this issue in conjunction with other bugs may allow a guest to leak information from host or may allow for a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this issue in conjunction with other bugs may allow a View desktop to leak information from host or may allow for a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-200
References: http://www.securityfocus.com/bid/102441; http://www.securitytracker.com/id/1040108; http://www.securitytracker.com/id/1040109
CVE: CVE-2014-8335
Published: 2018-01-05
Description: (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.html; http://www.openwall.com/lists/oss-security/2014/10/20/7; http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.html
CVE: CVE-2014-8336
Published: 2018-01-05
Description: The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/10/21/3; http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/97694
CVE: CVE-2014-8540
Published: 2018-01-05
Description: The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/10/31/2; http://www.securityfocus.com/bid/70841; https://about.gitlab.com/2014/10/30/gitlab-7-4-3-released/
CVE: CVE-2014-8579
Published: 2018-01-05
Description: TRENDnet TEW-823DRU devices with firmware before 1.00b36 have a hardcoded password of kcodeskcodes for the root account, which makes it easier for remote attackers to obtain access via an FTP session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://hackingcomtapioca.blogspot.com.br/2014/10/hacking-trendnet-tew-823dru.html; http://hackingcomtapioca.blogspot.com.br/2014/10/hacking-trendnet-tew-823dru.html
CVE: CVE-2017-16666
Published: 2018-01-05
Description: Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file.  NOTE: this issue can be exploited without authentication by leveraging the user registration feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://blog.securityonion.net/2017/11/security-advisory-for-xplico-120.html; http://packetstormsecurity.com/files/145639/Xplico-Remote-Code-Execution.html; http://www.rapid7.com/db/modules/exploit/linux/http/xplico_exec
CVE: CVE-2017-15548
Published: 2018-01-05
Description: An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote unauthenticated malicious user can potentially bypass application authentication and gain unauthorized root access to the affected systems.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2018/Jan/17; http://www.securityfocus.com/bid/102352; http://www.securitytracker.com/id/1040070
CVE: CVE-2017-15549
Published: 2018-01-05
Description: An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could potentially upload arbitrary maliciously crafted files in any location on the server file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://seclists.org/fulldisclosure/2018/Jan/17; http://www.securityfocus.com/bid/102363; http://www.securitytracker.com/id/1040070
CVE: CVE-2017-15550
Published: 2018-01-05
Description: An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could access arbitrary files on the server file system in the context of the running vulnerable application via Path traversal.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/Jan/17; http://www.securityfocus.com/bid/102358; http://www.securitytracker.com/id/1040070
CVE: CVE-2018-5244
Published: 2018-01-05
Description: In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't freed when a vcpu is destroyed. This allows guest OS administrators to cause a denial of service (host OS memory consumption) by rebooting many times.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102433; http://www.securitytracker.com/id/1040774; https://security.gentoo.org/glsa/201810-06
CVE: CVE-2017-18021
Published: 2018-01-05
Description: It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwords. This only applies to the QtPass GUI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-338
References: https://github.com/IJHack/QtPass/issues/338; https://github.com/IJHack/QtPass/releases/tag/v1.2.1; https://lists.zx2c4.com/pipermail/password-store/2018-January/003165.html
CVE: CVE-2017-18022
Published: 2018-01-05
Description: In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/102437; https://github.com/ImageMagick/ImageMagick/issues/904; https://usn.ubuntu.com/3681-1/
CVE: CVE-2018-5246
Published: 2018-01-05
Description: In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/102469; https://github.com/ImageMagick/ImageMagick/issues/929; https://usn.ubuntu.com/3681-1/
CVE: CVE-2018-5247
Published: 2018-01-05
Description: In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/928; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/928
CVE: CVE-2018-5248
Published: 2018-01-05
Description: In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102431; https://github.com/ImageMagick/ImageMagick/issues/927; https://usn.ubuntu.com/3681-1/
CVE: CVE-2018-5249
Published: 2018-01-05
Description: Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/shaarli/Shaarli/pull/1046; https://github.com/shaarli/Shaarli/releases/tag/v0.8.5; https://github.com/shaarli/Shaarli/releases/tag/v0.9.3
CVE: CVE-2018-5251
Published: 2018-01-05
Description: In libming 0.4.8, there is an integer signedness error vulnerability (left shift of a negative value) in the readSBits function (util/read.c). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted swf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-681
References: https://github.com/libming/libming/issues/97; https://lists.debian.org/debian-lts-announce/2018/03/msg00008.html; https://security.gentoo.org/glsa/201904-24
CVE: CVE-2018-5252
Published: 2018-01-05
Description: libimageworsener.a in ImageWorsener 1.3.2, when libjpeg 8d is used, has a large loop in the get_raw_sample_int function in imagew-main.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-834
References: https://github.com/jsummers/imageworsener/issues/34; https://github.com/jsummers/imageworsener/issues/34
CVE: CVE-2018-5253
Published: 2018-01-05
Description: The AP4_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling.
CVSS Score: 7.8 (HIGH)
CWE: CWE-835
References: https://github.com/axiomatic-systems/Bento4/issues/233; https://github.com/axiomatic-systems/Bento4/issues/233
CVE: CVE-2018-5205
Published: 2018-01-06
Description: When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: https://irssi.org/security/irssi_sa_2018_01.txt; https://usn.ubuntu.com/3527-1/; https://www.debian.org/security/2018/dsa-4162
CVE: CVE-2018-5206
Published: 2018-01-06
Description: When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://irssi.org/security/irssi_sa_2018_01.txt; https://www.debian.org/security/2018/dsa-4162; https://irssi.org/security/irssi_sa_2018_01.txt
CVE: CVE-2018-5207
Published: 2018-01-06
Description: When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: https://irssi.org/security/irssi_sa_2018_01.txt; https://www.debian.org/security/2018/dsa-4162; https://irssi.org/security/irssi_sa_2018_01.txt
CVE: CVE-2018-5208
Published: 2018-01-06
Description: In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://irssi.org/security/irssi_sa_2018_01.txt; https://www.debian.org/security/2018/dsa-4162; https://irssi.org/security/irssi_sa_2018_01.txt
CVE: CVE-2014-10069
Published: 2018-01-07
Description: Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for attackers to obtain sensitive information by decrypting a backup configuration file, as demonstrated by a password hash in the um_auth_account_password field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: https://blogger.davidmanouchehri.com/2018/01/hitrons-encryption.html; https://github.com/Manouchehri/hitron-cfg-decrypter; https://github.com/habohitron/habohitron/blob/6add0d002fe553f0924a3bba197994c53ca7d52d/firmwares/3.1.1.21/analyse/hc.c#L17
CVE: CVE-2017-15913
Published: 2018-01-08
Description: The Installer in Whale allows DLL hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://bugbounty.whale.naver.com/en/halloffame; https://cve.naver.com/detail/cve-2017-15913.html; https://bugbounty.whale.naver.com/en/halloffame
CVE: CVE-2018-5071
Published: 2018-01-08
Description: Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inject malicious JavaScript code using the device's TELNET shell built-in commands, as demonstrated by the "set ship name" command. This is similar to a Cross Protocol Injection with SNMP.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-terminales-satelitales.html; http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-terminales-satelitales.html
CVE: CVE-2018-5266
Published: 2018-01-08
Description: Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with password seatel3, SysAdmin with password seatel2, and User with password seatel1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-terminales-satelitales.html; http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-terminales-satelitales.html
CVE: CVE-2018-5267
Published: 2018-01-08
Description: Cobham Sea Tel 121 build 222701 devices allow remote attackers to bypass authentication via a direct request to MenuDealerGx.html, MenuDealer.html, MenuEuNCGx.html, MenuEuNC.html, MenuSysGx.html, or MenuSys.html.
CVSS Score: 9.8 (CRITICAL)
References: http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-terminales-satelitales.html; http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-terminales-satelitales.html
CVE: CVE-2017-5971
Published: 2018-01-08
Description: SQL injection vulnerability in NewsBee CMS allow remote attackers to execute arbitrary SQL commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/41261/; https://www.exploit-db.com/exploits/41261/
CVE: CVE-2018-3815
Published: 2018-01-08
Description: The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol Validation attack that leads to an email spoofing attack, allowing a malicious authenticated attacker to send a message from any source email address. The attack uses an HTTP POST request to a /Session URI, and interchanges the XML From and To elements.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-287
References: https://packetstormsecurity.com/files/145724/communigatepro62-spoof; https://packetstormsecurity.com/files/145724/communigatepro62-spoof
CVE: CVE-2018-5268
Published: 2018-01-08
Description: In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106945; https://github.com/opencv/opencv/issues/10541; https://lists.debian.org/debian-lts-announce/2018/04/msg00019.html
CVE: CVE-2018-5269
Published: 2018-01-08
Description: In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: http://www.securityfocus.com/bid/106945; https://github.com/opencv/opencv/issues/10540; https://lists.debian.org/debian-lts-announce/2018/04/msg00019.html