deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5871
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016, MAC address randomization performed during probe requests (for privacy reasons) is not done properly due to a flawed RNG which produces repeating output much earlier than expected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-338
References: https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components
CVE: CVE-2018-17254
Published: 2018-09-20
Description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/161683/Joomla-JCK-Editor-6.4.4-SQL-Injection.html; https://www.exploit-db.com/exploits/45423/; http://packetstormsecurity.com/files/161683/Joomla-JCK-Editor-6.4.4-SQL-Injection.html
CVE: CVE-2018-17255
Published: 2018-09-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-14014. Reason: This candidate is a reservation duplicate of CVE-2020-14014. Notes: All CVE users should reference CVE-2020-14014 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-1674
Published: 2018-09-20
Description: IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: http://www.securitytracker.com/id/1041717; https://exchange.xforce.ibmcloud.com/vulnerabilities/145109; https://www.ibm.com/support/docview.wss?uid=ibm10720035
CVE: CVE-2018-1800
Published: 2018-09-20
Description: IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a short time period when installation is occurring. IBM X-Force ID: 149607.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/149607; https://www.ibm.com/support/docview.wss?uid=ibm10731379; https://exchange.xforce.ibmcloud.com/vulnerabilities/149607
CVE: CVE-2018-3864
Published: 2018-09-20
Description: An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "password" value in order to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0548; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0548
CVE: CVE-2018-3865
Published: 2018-09-20
Description: An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "cameraIp" value in order to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0548; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0548
CVE: CVE-2018-6500
Published: 2018-09-20
Description: A potential Directory Traversal Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be remotely exploited to allow Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142
CVE: CVE-2018-6501
Published: 2018-09-20
Description: Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center (ArcMC) for versions prior to 2.81. This vulnerability could be exploited to allow for insufficient access controls.
CVSS Score: 6.5 (MEDIUM)
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142
CVE: CVE-2018-14796
Published: 2018-09-20
Description: Tec4Data SmartCooler, all versions prior to firmware 180806, the device responds to a remote unauthenticated reboot command that may be used to perform a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-263-01; https://ics-cert.us-cert.gov/advisories/ICSA-18-263-01
CVE: CVE-2018-14821
Published: 2018-09-20
Description: Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malformed CIP packet to Port 44818, causing the RSLinx Classic application to terminate. The user will need to manually restart the software to regain functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-263-02; https://www.tenable.com/security/research/tra-2018-26; https://ics-cert.us-cert.gov/advisories/ICSA-18-263-02
CVE: CVE-2018-14827
Published: 2018-09-20
Description: Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP packets to Port 44818, causing the software application to stop responding and crash. The user must restart the software to regain functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-263-02; https://ics-cert.us-cert.gov/advisories/ICSA-18-263-02
CVE: CVE-2018-14829
Published: 2018-09-20
Description: Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet to Port 44818, causing the software application to stop responding and crash. This vulnerability also has the potential to exploit a buffer overflow condition, which may allow the threat actor to remotely execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-263-02; https://www.tenable.com/security/research/tra-2018-26; https://ics-cert.us-cert.gov/advisories/ICSA-18-263-02
CVE: CVE-2018-6502
Published: 2018-09-20
Description: A potential Reflected Cross-Site Scripting (XSS) Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Reflected Cross-site Scripting (XSS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142
CVE: CVE-2018-6503
Published: 2018-09-20
Description: A potential Access Control vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for vulnerable Access Controls.
CVSS Score: 6.5 (MEDIUM)
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142
CVE: CVE-2018-6504
Published: 2018-09-20
Description: A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142
CVE: CVE-2018-6505
Published: 2018-09-20
Description: A potential Unauthenticated File Download vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Unauthenticated File Downloads.
CVSS Score: 7.5 (HIGH)
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142
CVE: CVE-2018-14592
Published: 2018-09-20
Description: The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.cwjoomla.com/download-cw-article-attachments; https://www.exploit-db.com/exploits/45447/; http://www.cwjoomla.com/download-cw-article-attachments
CVE: CVE-2018-15832
Published: 2018-09-20
Description: upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://www.exploit-db.com/exploits/45429/; https://www.exploit-db.com/exploits/45429/
CVE: CVE-2018-16282
Published: 2018-09-20
Description: A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/tim124058/5c4babe391a016c771d2cccabead21cb; https://www.moxa.com/support/download.aspx?type=support&id=15851; https://gist.github.com/tim124058/5c4babe391a016c771d2cccabead21cb
CVE: CVE-2018-16752
Published: 2018-09-20
Description: LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-1188
References: http://packetstormsecurity.com/files/149297/LW-N605R-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/45351/; http://packetstormsecurity.com/files/149297/LW-N605R-Remote-Code-Execution.html
CVE: CVE-2018-17282
Published: 2018-09-20
Description: An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html; https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/457
CVE: CVE-2018-17283
Published: 2018-09-21
Description: Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/x-f1v3/ForCve/issues/4; https://www.manageengine.com/network-monitoring/help/read-me.html; https://github.com/x-f1v3/ForCve/issues/4
CVE: CVE-2018-17292
Published: 2018-09-21
Description: An issue was discovered in WAVM before 2018-09-16. The loadModule function in Include/Inline/CLI.h lacks checking of the file length before a file magic comparison, allowing attackers to cause a Denial of Service (application crash caused by out-of-bounds read) by crafting a file that has fewer than 4 bytes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/WAVM/WAVM/commit/2de6cf70c5ef31e22ed119a25ac2daeefd3d18a1; https://github.com/WAVM/WAVM/issues/109; https://github.com/WAVM/WAVM/commit/2de6cf70c5ef31e22ed119a25ac2daeefd3d18a1
CVE: CVE-2018-17293
Published: 2018-09-21
Description: An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/WAVM/WAVM/commit/31d670b6489e6d708c3b04b911cdf14ac43d846d; https://github.com/WAVM/WAVM/issues/110#issuecomment-421764693; https://github.com/WAVM/WAVM/commit/31d670b6489e6d708c3b04b911cdf14ac43d846d
CVE: CVE-2018-17294
Published: 2018-09-21
Description: The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html; http://www.securityfocus.com/bid/105511; https://github.com/liblouis/liblouis/commit/5e4089659bb49b3095fa541fa6387b4c40d7396e
CVE: CVE-2018-17297
Published: 2018-09-21
Description: The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/looly/hutool/issues/162; https://github.com/looly/hutool/issues/162
CVE: CVE-2018-17298
Published: 2018-09-21
Description: An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=4050b0aafd18346d9a6a06967bfb1170824dab17; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b87d3b807f39c00371ebaa50f938cb[PII_REDACTED]; https://tuleap.net/plugins/tracker/?aid=12219
CVE: CVE-2018-17300
Published: 2018-09-21
Description: Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/CuppaCMS/CuppaCMS/issues/4; https://github.com/security-breachlock/CVE-2018-17300/blob/master/cuppa_xss.pdf; https://github.com/CuppaCMS/CuppaCMS/issues/4
CVE: CVE-2018-17301
Published: 2018-09-21
Description: Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/espocrm/espocrm/issues/1038; https://github.com/security-breachlock/CVE-2018-17301/blob/master/Non-persistent%20XSS%20in%20EspoCRM.pdf; https://github.com/espocrm/espocrm/issues/1038
CVE: CVE-2018-17302
Published: 2018-09-21
Description: Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/espocrm/espocrm/issues/1039; https://github.com/security-breachlock/CVE-2018-17302/blob/master/XSS%20%28Stored%29%20in%20EspoCRM.pdf; https://github.com/espocrm/espocrm/issues/1039
CVE: CVE-2018-14643
Published: 2018-09-21
Description: An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-592, CWE-287
References: http://www.securityfocus.com/bid/105375; https://access.redhat.com/errata/RHSA-2018:2733; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643
CVE: CVE-2018-14645
Published: 2018-09-21
Description: A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHBA-2019:0028; https://access.redhat.com/errata/RHSA-2018:2882; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14645
CVE: CVE-2018-1685
Published: 2018-09-21
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in db2cacpy that could allow a local user to read any file on the system. IBM X-Force ID: 145502.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/105395; http://www.securitytracker.com/id/1041671; https://exchange.xforce.ibmcloud.com/vulnerabilities/145502
CVE: CVE-2018-1710
Published: 2018-09-21
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 tool db2licm is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 146364.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105391; https://exchange.xforce.ibmcloud.com/vulnerabilities/146364; https://usn.ubuntu.com/3906-2/
CVE: CVE-2018-1711
Published: 2018-09-21
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to to gain privileges due to allowing modification of columns of existing tasks. IBM X-Force ID: 146369.
CVSS Score: 8.4 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/105390; http://www.securitytracker.com/id/1042175; https://exchange.xforce.ibmcloud.com/vulnerabilities/146369
CVE: CVE-2018-8023
Published: 2018-09-21
Description: Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://lists.apache.org/thread.html/9b9d3f6bd09f3ebd2284b82077033bdc71da550a1c4c010c2494acc3%40%3Cdev.mesos.apache.org%3E; https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a%40%3Cuser.flink.apache.org%3E; https://lists.apache.org/thread.html/9b9d3f6bd09f3ebd2284b82077033bdc71da550a1c4c010c2494acc3%40%3Cdev.mesos.apache.org%3E
CVE: CVE-2018-3873
Published: 2018-09-21
Description: An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 128 bytes. An attacker can send an arbitrarily long "secretKey" value in order to exploit this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555
CVE: CVE-2018-3874
Published: 2018-09-21
Description: An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 32 bytes. An attacker can send an arbitrarily long "accessKey" value in order to exploit this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555
CVE: CVE-2018-3876
Published: 2018-09-21
Description: An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 64 bytes. An attacker can send an arbitrarily long "bucket" value in order to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555
CVE: CVE-2018-3877
Published: 2018-09-21
Description: An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 160 bytes. An attacker can send an arbitrarily long "directory" value in order to exploit this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555
CVE: CVE-2018-11240
Published: 2018-09-21
Description: An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' feature of the T-Router protocol. If the command syntax is correct, there is code execution both on the other modem and on the main servers. This is fixed in production builds as of Spring 2018.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://gist.github.com/neolead/1b90d8df7ef4fd1d3d03c1265e5804ac#file-cve-2018-11240-txt; https://gist.github.com/neolead/1b90d8df7ef4fd1d3d03c1265e5804ac#file-cve-2018-11240-txt
CVE: CVE-2018-11241
Published: 2018-09-21
Description: An issue was discovered on SoftCase T-Router build 20112017 devices. A remote attacker can read and write to arbitrary files on the system as root, as demonstrated by code execution after writing to a crontab file. This is fixed in production builds as of Spring 2018.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/neolead/2b052512f90f75e93b5c465c265322b0#file-cve-2018-11241-txt; https://gist.github.com/neolead/2b052512f90f75e93b5c465c265322b0#file-cve-2018-11241-txt
CVE: CVE-2018-16784
Published: 2018-09-21
Description: DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.
CVSS Score: 7.2 (HIGH)
CWE: CWE-91
References: https://github.com/ky-j/dedecms/issues/3; https://github.com/ky-j/dedecms/issues/3
CVE: CVE-2018-16786
Published: 2018-09-21
Description: DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ky-j/dedecms/issues/2; https://github.com/ky-j/dedecms/issues/2