deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0919
Published: 2018-03-14
Description: Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2010 SP2, Word 2013 SP1 and Microsoft Word 2016 allow an information disclosure vulnerability due to how variables are initialized, aka "Microsoft Office Information Disclosure Vulnerability".
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-908
References: http://www.securityfocus.com/bid/103311; http://www.securitytracker.com/id/1040526; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0919
CVE: CVE-2018-0921
Published: 2018-03-14
Description: Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103302; http://www.securitytracker.com/id/1040513; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0921
CVE: CVE-2018-0922
Published: 2018-03-14
Description: Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft Office Word Viewer, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft Office Compatibility Pack SP2, Microsoft Online Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2007 SP3, Microsoft Word 2010 SP2, Word 2013 and Microsoft Word 2016 allow a remote code execution vulnerability due to how objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103314; http://www.securitytracker.com/id/1040511; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0922
CVE: CVE-2018-0923
Published: 2018-03-14
Description: Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0944 and CVE-2018-0947.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103308; http://www.securitytracker.com/id/1040513; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0923
CVE: CVE-2018-0924
Published: 2018-03-14
Description: Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how URL redirects are handled, aka "Microsoft Exchange Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0941.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/103320; http://www.securitytracker.com/id/1040521; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0924
CVE: CVE-2018-0925
Published: 2018-03-14
Description: ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0876, CVE-2018-0889, CVE-2018-0893, and CVE-2018-0935.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103287; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0925; http://www.securityfocus.com/bid/103287
CVE: CVE-2018-0926
Published: 2018-03-14
Description: The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0811, CVE-2018-0813, CVE-2018-0814, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, and CVE-2018-0901.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: http://www.securityfocus.com/bid/103247; http://www.securitytracker.com/id/1040517; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0926
CVE: CVE-2018-0927
Published: 2018-03-14
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows information disclosure, due to how Microsoft browsers handle objects in memory, aka "Microsoft Browser Information Disclosure Vulnerability".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103310; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0927
CVE: CVE-2018-0929
Published: 2018-03-14
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow information disclosure, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Information Disclosure Vulnerability".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103299; http://www.securitytracker.com/id/1040510; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0929
CVE: CVE-2018-0930
Published: 2018-03-14
Description: ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103272; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0930; http://www.securityfocus.com/bid/103272
CVE: CVE-2018-0931
Published: 2018-03-14
Description: ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103273; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0931; http://www.securityfocus.com/bid/103273
CVE: CVE-2018-0932
Published: 2018-03-14
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows information disclosure, due to how Microsoft browsers handle objects in memory, aka "Microsoft Browser Information Disclosure Vulnerability".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103307; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0932
CVE: CVE-2018-0933
Published: 2018-03-14
Description: ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103274; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0933
CVE: CVE-2018-0934
Published: 2018-03-14
Description: ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0936, and CVE-2018-0937.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-787
References: http://www.securityfocus.com/bid/103275; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0934
CVE: CVE-2018-0935
Published: 2018-03-14
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0876, CVE-2018-0889, CVE-2018-0893, and CVE-2018-0925.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/103298; http://www.securitytracker.com/id/1040510; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0935
CVE: CVE-2018-0936
Published: 2018-03-14
Description: ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, and CVE-2018-0937.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103270; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0936
CVE: CVE-2018-0937
Published: 2018-03-14
Description: ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, and CVE-2018-0936.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103271; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0937
CVE: CVE-2018-0939
Published: 2018-03-14
Description: ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0891.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103305; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0939
CVE: CVE-2018-0940
Published: 2018-03-14
Description: Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allows an elevation of privilege vulnerability due to how links in the body of an email message are rewritten, aka "Microsoft Exchange Elevation of Privilege Vulnerability".
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/103323; http://www.securitytracker.com/id/1040521; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0940
CVE: CVE-2018-0941
Published: 2018-03-14
Description: Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how data is imported, aka "Microsoft Exchange Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0924.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/103318; http://www.securitytracker.com/id/1040521; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0941
CVE: CVE-2018-0942
Published: 2018-03-14
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow elevation of privilege, due to how Internet Explorer handles zone and integrity settings, aka "Internet Explorer Elevation of Privilege Vulnerability".
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/bid/103312; http://www.securitytracker.com/id/1040510; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0942
CVE: CVE-2018-0944
Published: 2018-03-14
Description: Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923 and CVE-2018-0947.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103304; http://www.securitytracker.com/id/1040513; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0944
CVE: CVE-2018-0947
Published: 2018-03-14
Description: Microsoft SharePoint Foundation 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923 and CVE-2018-0944.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103306; http://www.securitytracker.com/id/1040513; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0947
CVE: CVE-2018-0977
Published: 2018-03-14
Description: The Windows kernel mode driver in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how objects are handled in memory, aka "Win32k Elevation of Privilege Vulnerability".
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/103380; http://www.securitytracker.com/id/1040520; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0977
CVE: CVE-2018-0983
Published: 2018-03-14
Description: Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows Storage Services Elevation of Privilege Vulnerability".
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/103381; http://www.securitytracker.com/id/1040520; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0983
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-14
Description: A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/103414
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-14
Description: A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/103415
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-14
Description: A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/103436
CVE: CVE-2018-1077
Published: 2018-03-14
Description: Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://bugzilla.redhat.com/show_bug.cgi?id=1555429; https://bugzilla.redhat.com/show_bug.cgi?id=1555429
CVE: CVE-2018-7496
Published: 2018-03-14
Description: An Information Exposure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The server response header and referrer-policy response header each provide unintended information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/103390; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-03; http://www.securityfocus.com/bid/103390
CVE: CVE-2018-7500
Published: 2018-03-14
Description: A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/103396; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-04; http://www.securityfocus.com/bid/103396
CVE: CVE-2018-7504
Published: 2018-03-14
Description: A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is not set to block, allowing attempts at reflected cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-693, CWE-79
References: http://www.securityfocus.com/bid/103390; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-03; http://www.securityfocus.com/bid/103390
CVE: CVE-2018-7508
Published: 2018-03-14
Description: A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103396; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-04; http://www.securityfocus.com/bid/103396
CVE: CVE-2018-7529
Published: 2018-03-14
Description: A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modify deserialized data to send custom requests that crash the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/103399; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-02; http://www.securityfocus.com/bid/103399
CVE: CVE-2018-7531
Published: 2018-03-14
Description: An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidated custom requests to crash the server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/103399; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-02; http://www.securityfocus.com/bid/103399
CVE: CVE-2018-7533
Published: 2018-03-14
Description: An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may allow escalation of privileges that gives the actor full control over the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: http://www.securityfocus.com/bid/103399; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-02; http://www.securityfocus.com/bid/103399
CVE: CVE-2018-2366
Published: 2018-03-14
Description: SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/103371; https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/; https://launchpad.support.sap.com/#/notes/2555667
CVE: CVE-2018-2397
Published: 2018-03-14
Description: In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controlled inputs which results in Cross-Site Scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103373; https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/; https://launchpad.support.sap.com/#/notes/2550538
CVE: CVE-2018-2398
Published: 2018-03-14
Description: Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103370; https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/; https://launchpad.support.sap.com/#/notes/2580967
CVE: CVE-2018-2399
Published: 2018-03-14
Description: Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103372; https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/; https://launchpad.support.sap.com/#/notes/2592807
CVE: CVE-2018-2400
Published: 2018-03-14
Description: Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access information which would otherwise be restricted.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103375; https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/; https://launchpad.support.sap.com/#/notes/2596535
CVE: CVE-2018-2401
Published: 2018-03-14
Description: SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/103374; https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/; https://launchpad.support.sap.com/#/notes/2596766