deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-15326
Published: 2018-03-23
Description: DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using insecure encryption algorithms. If an insecure encryption algorithm is negotiated in the communication, an unauthenticated remote attacker can exploit this vulnerability to crack the encrypted data and cause information leakage.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-327
References: http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180321-01-encryption-en; http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180321-01-encryption-en
CVE: CVE-2018-7502
Published: 2018-03-23
Description: Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-20
References: http://www.securityfocus.com/bid/103487; https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02
CVE: CVE-2018-8948
Published: 2018-03-23
Description: In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/01924cd948dbceb8391be671dab672e9f4a0ffe8; https://github.com/MISP/MISP/commit/01924cd948dbceb8391be671dab672e9f4a0ffe8
CVE: CVE-2018-8949
Published: 2018-03-23
Description: An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-749
References: https://github.com/MISP/MISP/commit/37720c38d6c617439df0a13e9396fcb26345dadd; https://github.com/MISP/MISP/commit/37720c38d6c617439df0a13e9396fcb26345dadd
CVE: CVE-2017-1524
Published: 2018-03-23
Description: IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request that could be used to aid future attacks. IBM X-Force ID: 129970.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22014815; http://www.securityfocus.com/bid/103477; https://exchange.xforce.ibmcloud.com/vulnerabilities/129970
CVE: CVE-2017-1602
Published: 2018-03-23
Description: IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-552
References: http://www.ibm.com/support/docview.wss?uid=swg22014815; http://www.securityfocus.com/bid/103477; https://exchange.xforce.ibmcloud.com/vulnerabilities/132625
CVE: CVE-2017-1629
Published: 2018-03-23
Description: IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133127.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22014815; http://www.securityfocus.com/bid/103477; https://exchange.xforce.ibmcloud.com/vulnerabilities/133127
CVE: CVE-2017-1655
Published: 2018-03-23
Description: IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133379.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22014815; http://www.securityfocus.com/bid/103477; https://exchange.xforce.ibmcloud.com/vulnerabilities/133379
CVE: CVE-2017-1762
Published: 2018-03-23
Description: IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136006.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22014815; http://www.securityfocus.com/bid/103477; https://exchange.xforce.ibmcloud.com/vulnerabilities/136006
CVE: CVE-2017-18245
Published: 2018-03-23
Description: The mpc8_probe function in libavformat/mpc8.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted audio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.libav.org/show_bug.cgi?id=1094; https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html; https://bugzilla.libav.org/show_bug.cgi?id=1094
CVE: CVE-2017-18246
Published: 2018-03-23
Description: The pcm_encode_frame function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted media file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.libav.org/show_bug.cgi?id=1095; https://bugzilla.libav.org/show_bug.cgi?id=1095
CVE: CVE-2017-18247
Published: 2018-03-23
Description: The av_audio_fifo_size function in libavutil/audio_fifo.c in Libav 12.2 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted media file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.libav.org/show_bug.cgi?id=1089; https://bugzilla.libav.org/show_bug.cgi?id=1089
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-23
Description: Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://www.electronjs.org/blog/webview-fix; https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2[PII_REDACTED]---Electron-nodeIntegration-Bypass/; https://www.electronjs.org/blog/webview-fix
CVE: CVE-2018-1429
Published: 2018-03-23
Description: IBM MQ Appliance 9.0.1, 9.0.2, 9.0.3, amd 9.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139077.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22014046; http://www.securityfocus.com/bid/103491; http://www.securitytracker.com/id/1040564
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-23
Description: I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password of the admin being forced to be changed without the administrator's knowledge.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/mkucej/i-librarian/issues/121; https://github.com/mkucej/i-librarian/issues/121
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-23
Description: I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal resources.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/mkucej/i-librarian/blob/9535753a84bc615b210802d4c9542db73368d984/functions.php#L811; https://github.com/mkucej/i-librarian/issues/120; https://github.com/mkucej/i-librarian/blob/9535753a84bc615b210802d4c9542db73368d984/functions.php#L811
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-23
Description: I, Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in "id" parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mkucej/i-librarian/blob/9535753a84bc615b210802d4c9542db73368d984/stable.php#L8; https://github.com/mkucej/i-librarian/issues/119; https://github.com/mkucej/i-librarian/blob/9535753a84bc615b210802d4c9542db73368d984/stable.php#L8
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-23
Description: rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.html; https://access.redhat.com/errata/RHSA-2018:1223; https://access.redhat.com/errata/RHSA-2018:1225
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-23
Description: I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to project discussions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: https://github.com/mkucej/i-librarian/issues/124; https://github.com/mkucej/i-librarian/issues/124
CVE: CVE-2018-8957
Published: 2018-03-23
Description: CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ttylx/Cve_reveal; https://github.com/ttylx/Cve_reveal/blob/master/CoverCMS_01/Covercms_1.md; https://github.com/ttylx/Cve_reveal/blob/master/CoverCMS_01/re.md
CVE: CVE-2018-8960
Published: 2018-03-23
Description: The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-based buffer over-read.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/103523; https://github.com/ImageMagick/ImageMagick/issues/1020; https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE: CVE-2018-8961
Published: 2018-03-23
Description: In libming 0.4.8, the decompilePUSHPARAM function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/libming/libming/issues/130; https://github.com/libming/libming/issues/130
CVE: CVE-2018-8962
Published: 2018-03-23
Description: In libming 0.4.8, the decompileSingleArgBuiltInFunctionCall function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/libming/libming/issues/130; https://github.com/libming/libming/issues/130
CVE: CVE-2018-8963
Published: 2018-03-23
Description: In libming 0.4.8, the decompileGETVARIABLE function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/libming/libming/issues/130; https://github.com/libming/libming/issues/130
CVE: CVE-2018-8964
Published: 2018-03-23
Description: In libming 0.4.8, the decompileDELETE function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/libming/libming/issues/130; https://github.com/libming/libming/issues/130
CVE: CVE-2017-17749
Published: 2018-03-24
Description: Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://aryanitin.com/2017-01-01-CVE-2017-17749/; http://aryanitin.com/2017-01-01-CVE-2017-17749/
CVE: CVE-2017-17750
Published: 2018-03-24
Description: Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://aryanitin.com/2017-12-20-CVE-2017-17750/; http://aryanitin.com/2017-12-20-CVE-2017-17750/
CVE: CVE-2017-17751
Published: 2018-03-24
Description: Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol.
CVSS Score: 8.8 (HIGH)
References: http://aryanitin.com/2017-12-20-CVE-2017-17751/; http://aryanitin.com/2017-12-20-CVE-2017-17751/
CVE: CVE-2018-8965
Published: 2018-03-24
Description: An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/ppsave.php.md; https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/ppsave.php.md
CVE: CVE-2018-8966
Published: 2018-03-24
Description: An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/install.md; https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/install.md
CVE: CVE-2018-8967
Published: 2018-03-24
Description: An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/adv2.php.md; https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/adv2.php.md
CVE: CVE-2018-8968
Published: 2018-03-24
Description: An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/manage.php.md; https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/manage.php.md
CVE: CVE-2018-8969
Published: 2018-03-24
Description: An issue was discovered in zzcms 8.2. user/licence_save.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/licence_save.php.md; https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/licence_save.php.md
CVE: CVE-2015-9257
Published: 2018-03-24
Description: BMC Remedy Action Request (AR) System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.bmc.com/docs/display/public/ars9000/Cross+site+scripting+%28XSS%29+in+Remedy+9.0%2C+9.0+Service+Pack+1; https://docs.bmc.com/docs/display/public/ars9000/Cross+site+scripting+%28XSS%29+in+Remedy+9.0%2C+9.0+Service+Pack+1
CVE: CVE-2018-8970
Published: 2018-03-24
Description: The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes silent omission of hostname verification, and consequently allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: the LibreSSL documentation indicates that this special case is supported, but the BoringSSL documentation does not.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://boringssl.googlesource.com/boringssl/+/e759a9cd[PII_REDACTED]9259dbed401f4951747cff; https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.1-relnotes.txt; https://github.com/libressl-portable/openbsd/commit/0654414afcce51a16d35d05060190a3ec4618d42
CVE: CVE-2018-8971
Published: 2018-03-24
Description: The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/; https://www.debian.org/security/2018/dsa-4206; https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/
CVE: CVE-2018-8972
Published: 2018-03-24
Description: Creditwest Bank CMS Project (aka CWCMS) through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a PHP shell that calls eval on request parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/CREDITWEST/CWCMS/issues/1; https://github.com/CREDITWEST/CWCMS/issues/1
CVE: CVE-2018-8973
Published: 2018-03-24
Description: OTCMS 3.20 allows XSS by adding a keyword or link to an article, as demonstrated by an admin/keyWord_deal.php?mudi=add request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yaxuan404/OTCMS_3.2; https://github.com/yaxuan404/OTCMS_3.2
CVE: CVE-2018-8975
Published: 2018-03-25
Description: The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, as demonstrated by pbmmask.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00056.html; https://github.com/xiaoqx/pocs/blob/master/netpbm; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVMWVVFEADMA7XIPXFHGSBRYKEGGDFGE/
CVE: CVE-2018-8976
Published: 2018-03-25
Description: In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/246; https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE: CVE-2018-8977
Published: 2018-03-25
Description: In Exiv2 0.26, the Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp allows remote attackers to cause a denial of service (invalid memory access) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/247; https://security.gentoo.org/glsa/201811-14
CVE: CVE-2018-8988
Published: 2018-03-25
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002008.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002008; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002008
CVE: CVE-2018-8989
Published: 2018-03-25
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002006.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002006; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002006
CVE: CVE-2018-8990
Published: 2018-03-25
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002010.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002010; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002010
CVE: CVE-2018-8991
Published: 2018-03-25
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002009.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002009; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002009
CVE: CVE-2018-8992
Published: 2018-03-25
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002005.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002005; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002005
CVE: CVE-2018-8993
Published: 2018-03-25
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002001.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002001; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002001
CVE: CVE-2018-8994
Published: 2018-03-25
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002003.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002003; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002003
CVE: CVE-2018-8995
Published: 2018-03-25
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002002.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002002; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002002