deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9391
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the service actions for a normal user to retrieve an image from a camera that is controlled by the controller. It seems that the "URL" parameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to overflow the buffer. The function "LU::Generic_IP_Camera_Manager::REQ_Image" is activated when the lu_request_image is passed as the "id" parameter in query string. This function then calls "LU::Generic_IP_Camera_Manager::GetUrlFromArguments" and passes a "pointer" to the function where it will be allowed to store the value from the URL parameter. This pointer is passed as the second parameter $a2 to the function "LU::Generic_IP_Camera_Manager::GetUrlFromArguments". However, neither the callee or the caller in this case performs a simple length check and as a result an attacker who is able to send more than 1336 characters can easily overflow the values stored on the stack including the $RA value and thus execute code on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-9392
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the service actions for a normal user to retrieve an image from a camera that is controlled by the controller. It seems that the "res" (resolution) parameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to overflow the buffer. The function "LU::Generic_IP_Camera_Manager::REQ_Image" is activated when the lu_request_image is passed as the "id" parameter in the query string. This function then calls "LU::Generic_IP_Camera_Manager::GetUrlFromArguments". This function retrieves all the parameters passed in the query string including "res" and then uses the value passed in it to fill up buffer using the sprintf function. However, the function in this case lacks a simple length check and as a result an attacker who is able to send more than 184 characters can easily overflow the values stored on the stack including the $RA value and thus execute code on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-18958
Published: 2019-06-17
Description: OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://forum.opnsense.org/index.php?board=11.0; https://forum.opnsense.org/index.php?topic=10181.0; https://forum.opnsense.org/index.php?board=11.0
CVE: CVE-2019-5016
Published: 2019-06-17
Description: An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. A specially crafted index value can cause an invalid memory read, resulting in a denial of service or remote information disclosure. An unauthenticated attacker can send a crafted packet on the local network to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/108820; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0775; http://www.securityfocus.com/bid/108820
CVE: CVE-2019-5017
Published: 2019-06-17
Description: An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. An unauthenticated, remote attacker can craft and send a packet containing an opcode that will trigger the kernel module to return several addresses. One of which can be used to calculate the dynamic base address of the module for further exploitation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/108827; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0776; http://www.securityfocus.com/bid/108827
CVE: CVE-2017-10718
Published: 2019-06-17
Description: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user connecting to the device can change the default SSID and password thereby denying the owner an access to his/her own device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-10719
Published: 2019-06-17
Description: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has default Wi-Fi credentials that are exactly the same for every device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-10720
Published: 2019-06-17
Description: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installed on the device and an attacker who can provide the right payload can execute code on the user's system directly. Any breach of this system can allow an attacker to get access to all the data that the user has access too. The application uses a dynamic link library(DLL) called "avilib.dll" which is used by the application to send binary packets to the device that allow to control the device. One such action that the DLL provides is change password in the function "sendchangename" which allows a user to change the Wi-Fi name on the device. This function calls a sub function "sub_75876EA0" at address 0x758784F8. The function determines which action to execute based on the parameters sent to it. The "sendchangename" passes the datastring as the second argument which is the name we enter in the textbox and integer 1 as first argument. The rest of the 3 arguments are set to 0. The function "sub_75876EA0" at address 0x75876F19 uses the first argument received and to determine which block to jump to. Since the argument passed is 1, it jumps to 0x75876F20 and proceeds from there to address 0x75876F56 which calculates the length of the data string passed as the first parameter. This length and the first argument are then passed to the address 0x75877001 which calls the memmove function which uses a stack address as the destination where the password typed by us is passed as the source and length calculated above is passed as the number of bytes to copy which leads to a stack overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-10721
Published: 2019-06-17
Description: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality enabled by default. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-10722
Published: 2019-06-17
Description: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is installed on the device and an attacker who can provide the right payload can execute code on the user's system directly. Any breach of this system can allow an attacker to get access to all the data that the user has access too. The application uses a dynamic link library(DLL) called "avilib.dll" which is used by the application to send binary packets to the device that allow to control the device. One such action that the DLL provides is change password in the function "sendchangepass" which allows a user to change the Wi-Fi password on the device. This function calls a sub function "sub_75876EA0" at address 0x7587857C. The function determines which action to execute based on the parameters sent to it. The "sendchangepass" passes the datastring as the second argument which is the password we enter in the textbox and integer 2 as first argument. The rest of the 3 arguments are set to 0. The function "sub_75876EA0" at address 0x75876F19 uses the first argument received and to determine which block to jump to. Since the argument passed is 2, it jumps to 0x7587718C and proceeds from there to address 0x758771C2 which calculates the length of the data string passed as the first parameter.This length and the first argument are then passed to the address 0x7587726F which calls a memmove function which uses a stack address as the destination where the password typed by us is passed as the source and length calculated above is passed as the number of bytes to copy which leads to a stack overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-10723
Published: 2019-06-17
Description: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries. The firmware contains binary uvc_stream that is the UDP daemon which is responsible for handling all the UDP requests that the device receives. The client application sends a UDP request to change the Wi-Fi name which contains the following format: "SETCMD0001+0001+[2 byte length of wifiname]+[Wifiname]. This request is handled by "control_Dev_thread" function which at address "0x00409AE0" compares the incoming request and determines if the 10th byte is 01 and if it is then it redirects to 0x0040A74C which calls the function "setwifiname". The function "setwifiname" uses a memcpy function but uses the length of the payload obtained by using strlen function as the third parameter which is the number of bytes to copy and this allows an attacker to overflow the function and control the $PC value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-10724
Published: 2019-06-17
Description: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries. The firmware contains binary uvc_stream that is the UDP daemon which is responsible for handling all the UDP requests that the device receives. The client application sends a UDP request to change the Wi-Fi name which contains the following format: "SETCMD0001+0002+[2 byte length of wifipassword]+[Wifipassword]. This request is handled by "control_Dev_thread" function which at address "0x00409AE4" compares the incoming request and determines if the 10th byte is 02 and if it is then it redirects to 0x0040A7D8, which calls the function "setwifipassword". The function "setwifipassword" uses a memcpy function but uses the length of the payload obtained by using strlen function as the third parameter which is the number of bytes to copy and this allows an attacker to overflow the function and control the $PC value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153241/Shekar-Endoscope-Weak-Default-Settings-Memory-Corruption.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Shekar_boriscope_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2019-12865
Published: 2019-06-17
Description: In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/radare/radare2/issues/14334; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IEXZWAMVKGZKHALV4IVWQS2ORJKRH57U/; https://github.com/radare/radare2/issues/14334
CVE: CVE-2019-12868
Published: 2019-06-18
Description: app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c; https://zigrin.com/advisories/misp-command-injection-via-phar-deserialization/; https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c
CVE: CVE-2018-20013
Published: 2019-06-18
Description: In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::ProcessPacket metadata_id!=0 assertion, leading to shutting down the client application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.urbackup.org/client_changelog.html; https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2018-20013; http://www.urbackup.org/client_changelog.html
CVE: CVE-2019-10998
Published: 2019-06-18
Description: An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Unlimited physical access to the PLC may lead to a manipulation of SD cards data. SD card manipulation may lead to an authentication bypass opportunity.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://dam-mdc.phoenixcontact.com/asset/[PII_REDACTED]4/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf; https://dam-mdc.phoenixcontact.com/asset/[PII_REDACTED]4/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf
CVE: CVE-2019-12823
Published: 2019-06-18
Description: Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md; https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f; https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md
CVE: CVE-2019-6965
Published: 2019-06-18
Description: An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.i-doit.org; https://www.i-doit.org
CVE: CVE-2019-7159
Published: 2019-06-18
Description: OX App Suite 7.10.1 and earlier allows Information Exposure.
CVSS Score: 7.5 (HIGH)
References: https://www.open-xchange.com/; https://packetstormsecurity.com/files/152404/Open-Xchange-AppSuite-7.10.1-Information-Disclosure-Improper-Access-Control.html; https://www.open-xchange.com/
CVE: CVE-2018-18879
Published: 2019-06-18
Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://applied-risk.com/labs/advisories; https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02; https://applied-risk.com/labs/advisories
CVE: CVE-2018-18880
Published: 2019-06-18
Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://applied-risk.com/labs/advisories; https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02; https://applied-risk.com/labs/advisories
CVE: CVE-2018-18886
Published: 2019-06-18
Description: Helpy v2.1.0 has Stored XSS via the Ticket title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/helpyio/helpy; https://github.com/helpyio/helpy/releases/tag/2.2.0; https://github.com/helpyio/helpy
CVE: CVE-2018-18944
Published: 2019-06-18
Description: Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/author/?a=8844; https://www.exploit-db.com/exploits/45760; https://www.exploit-db.com/author/?a=8844
CVE: CVE-2019-12872
Published: 2019-06-18
Description: dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://dotcms.com/security/SI-53; https://github.com/dotCMS/core/issues/16624; https://dotcms.com/security/SI-53
CVE: CVE-2019-7588
Published: 2019-06-18
Description: A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows operating system. This issue does not impact any Windows Server OSs, or Linux deployments with permissions that are not inherited from the root directory. Authorized Users have ‘modify’ permission to the ESM folders, which allows a low privilege account to modify files located in these directories. An executable can be renamed and replaced by a malicious file that could connect back to a bad actor providing system level privileges. A low privileged user is not able to restart the service, but a restart of the system would trigger the execution of the malicious file. This issue affects: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) Version 5.12.2 and prior versions; This issue does not affect: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) 19.03 and above.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://exacq.com/kb?crc=31399; https://ics-cert.us-cert.gov/advisories/ICSA-19-164-01; https://packetstormsecurity.com/files/151691/exacqvisionesm5122-escalate.txt
CVE: CVE-2018-18852
Published: 2019-06-18
Description: Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature's use of Save.cgi to execute a ping command, as exploited in the wild in October 2018.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.fortiguard.com/zeroday/FG-VD-18-149; https://www.fortiguard.com/zeroday/FG-VD-18-149
CVE: CVE-2018-18875
Published: 2019-06-18
Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script via changestationname.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://applied-risk.com/labs/advisories; https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02; https://applied-risk.com/labs/advisories
CVE: CVE-2018-18876
Published: 2019-06-18
Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it possible to read any file present on the underlying operating system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://applied-risk.com/labs/advisories; https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02; https://applied-risk.com/labs/advisories
CVE: CVE-2018-18877
Published: 2019-06-18
Description: In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page config_main.php that allows manipulation of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://applied-risk.com/labs/advisories; https://ics-cert.us-cert.gov/advisories/ICSA-19-078-02; https://applied-risk.com/labs/advisories