deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0577
Published: 2018-05-14
Description: Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN01040170/index.html; https://wordpress.org/plugins/wp-google-map-plugin/#developers; https://wpvulndb.com/vulnerabilities/9610
CVE: CVE-2018-0578
Published: 2018-05-14
Description: Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN61081552/index.html; https://wordpress.org/plugins/pixelyoursite/#developers; http://jvn.jp/en/jp/JVN61081552/index.html
CVE: CVE-2018-0579
Published: 2018-05-14
Description: Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN08386386/index.html; https://wordpress.org/plugins/wonderm00ns-simple-facebook-open-graph-tags/#developers; http://jvn.jp/en/jp/JVN08386386/index.html
CVE: CVE-2018-0580
Published: 2018-05-14
Description: Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (for Windows) Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER (for Windows) Ver.1.6.3 and earlier, with its timestamp prior to April 25, 2018, 17:02:49) allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.clipstudio.net/en/dl; https://jvn.jp/en/jp/JVN68345747/; https://www.clip-studio.com/clip_site/download/clipstudioaction/csaupdater/index_win
CVE: CVE-2018-0581
Published: 2018-05-14
Description: Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN33901663/index.html; https://www.asus.com/Networking/RTAC87U/HelpDesk_BIOS/; http://jvn.jp/en/jp/JVN33901663/index.html
CVE: CVE-2018-0582
Published: 2018-05-14
Description: Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN73742314/index.html; https://www.asus.com/Networking/RTAC68U/HelpDesk_BIOS/; http://jvn.jp/en/jp/JVN73742314/index.html
CVE: CVE-2018-0583
Published: 2018-05-14
Description: Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN34562916/index.html; https://www.asus.com/Networking/RTAC1200HP/HelpDesk_BIOS/; http://jvn.jp/en/jp/JVN34562916/index.html
CVE: CVE-2018-0585
Published: 2018-05-14
Description: Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN28804532/index.html; https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9608
CVE: CVE-2018-0586
Published: 2018-05-14
Description: Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN28804532/index.html; https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9608
CVE: CVE-2018-0587
Published: 2018-05-14
Description: Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: http://jvn.jp/en/jp/JVN28804532/index.html; https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9608
CVE: CVE-2018-0588
Published: 2018-05-14
Description: Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN28804532/index.html; https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9608
CVE: CVE-2018-0589
Published: 2018-05-14
Description: Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN28804532/index.html; https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9608
CVE: CVE-2018-0590
Published: 2018-05-14
Description: Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN28804532/index.html; https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9608
CVE: CVE-2018-0591
Published: 2018-05-14
Description: The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://itunes.apple.com/us/app/kinepasu-apuridekantan-bian/id637453055?mt=8; https://jvn.jp/en/jp/JVN83671755/; https://play.google.com/store/apps/details?id=jp.tjoy.kinepass&hl=en
CVE: CVE-2018-5230
Published: 2018-05-14
Description: The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-67289; https://jira.atlassian.com/browse/JRASERVER-67289
CVE: CVE-2017-6021
Published: 2018-05-14
Description: In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build 77.5882) and prior, an attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server that can cause the ClearSCADA server process and ClearSCADA communications driver processes to terminate. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/96768; https://ics-cert.us-cert.gov/advisories/ICSA-17-068-01; http://www.securityfocus.com/bid/96768
CVE: CVE-2018-10252
Published: 2018-05-14
Description: An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its current time of day in responses, it is possible to step backward through possible session values until a working one is found. Once a working session ID is found, an attacker then has admin control of the device and can add a secondary SSID to create a backdoor to the network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: https://actiontecsupport.zendesk.com/hc/en-us/articles/[PII_REDACTED]3-WCB6200Q-Firmware-Upgrade; https://actiontecsupport.zendesk.com/hc/en-us/articles/[PII_REDACTED]3-WCB6200Q-Firmware-Upgrade
CVE: CVE-2018-10989
Published: 2018-05-14
Description: Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by leveraging access to the local network. NOTE: one or more user's guides distributed by ISPs state "At a minimum, you should set a login password."
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-1188
References: https://medium.com/%40AkshaySharmaUS/comcast-arris-touchstone-gateway-devices-are-vulnerable-heres-the-disclosure-7d603aa9342c; https://medium.com/%40AkshaySharmaUS/comcast-arris-touchstone-gateway-devices-are-vulnerable-heres-the-disclosure-7d603aa9342c
CVE: CVE-2018-10990
Published: 2018-05-14
Description: On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time (e.g., "at least for a few minutes"). NOTE: there is no documentation stating that the web UI's logout feature was supposed to do anything beyond removing the cookie from one instance of a web browser; a client-side logout action is often not intended to address cases where a person has made a copy of a cookie outside of a browser.
CVSS Score: 8.0 (HIGH)
CWE: CWE-613
References: https://medium.com/%40AkshaySharmaUS/comcast-arris-touchstone-gateway-devices-are-vulnerable-heres-the-disclosure-7d603aa9342c; https://medium.com/%40AkshaySharmaUS/comcast-arris-touchstone-gateway-devices-are-vulnerable-heres-the-disclosure-7d603aa9342c
CVE: CVE-2018-10991
Published: 2018-05-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-10990.  Reason: This candidate is a reservation duplicate of CVE-2018-10990.  Notes: All CVE users should reference CVE-2018-10990 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-8843
Published: 2018-05-14
Description: Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software files that may cause the software application to crash, potentially losing any unsaved data..
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: http://www.securityfocus.com/bid/104166; https://ics-cert.us-cert.gov/advisories/ICSA-18-130-02; http://www.securityfocus.com/bid/104166
CVE: CVE-2017-12120
Published: 2018-05-14
Description: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation, resulting in a root shell. An attacker can inject OS commands into the ip= parm in the "/goform/net_WebPingGetValue" URI to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0472; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0472
CVE: CVE-2017-12121
Published: 2018-05-14
Description: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the rsakey\_name= parm in the "/goform/WebRSAKEYGen" uri to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0473; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0473
CVE: CVE-2017-12123
Published: 2018-05-14
Description: An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0475; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0475
CVE: CVE-2017-12124
Published: 2018-05-14
Description: An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in the web server crashing. An attacker can send a crafted URI to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-476
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0476; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0476
CVE: CVE-2017-12125
Published: 2018-05-14
Description: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the CN= parm in the "/goform/net_WebCSRGen" uri to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0477; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0477
CVE: CVE-2017-12126
Published: 2018-05-14
Description: An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP packet can cause cross-site request forgery. An attacker can create malicious HTML to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0478; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0478
CVE: CVE-2017-12127
Published: 2018-05-14
Description: A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract passwords in clear text from the device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0479; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0479
CVE: CVE-2017-12128
Published: 2018-05-14
Description: An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packet can cause information disclosure. An attacker can send a crafted TCP packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0480; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0480
CVE: CVE-2017-12129
Published: 2018-05-14
Description: An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could intercept weakly encrypted passwords and could brute force them.
CVSS Score: 8.0 (HIGH)
CWE: CWE-327
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0481; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0481
CVE: CVE-2017-14432
Published: 2018-05-14
Description: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the openvpnServer0_tmp= parameter in the "/goform/net\_Web\_get_value" uri to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0482; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0482
CVE: CVE-2017-14433
Published: 2018-05-14
Description: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetwork0= parameter in the "/goform/net\_Web\_get_value" uri to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0482; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0482
CVE: CVE-2017-14434
Published: 2018-05-14
Description: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetmask0= parameter in the "/goform/net\_Web\_get_value" uri to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0482; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0482
CVE: CVE-2017-14435
Published: 2018-05-14
Description: An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXA\_CFG.ini" without a cookie header to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0474; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0474
CVE: CVE-2017-14436
Published: 2018-05-14
Description: An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXA\_CFG2.ini" without a cookie header to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0474; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0474
CVE: CVE-2017-14437
Published: 2018-05-14
Description: An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in denial of service. An attacker can send a GET request to "/MOXA\_LOG.ini" without a cookie header to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0474; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0474
CVE: CVE-2017-14438
Published: 2018-05-14
Description: Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4000/tcp to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0487; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0487
CVE: CVE-2017-14439
Published: 2018-05-14
Description: Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4001/tcp to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0487; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0487
CVE: CVE-2018-10994
Published: 2018-05-14
Description: js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/signalapp/Signal-Desktop/commit/bfbd84f5d1308cdfcb08a1727821f7103be151ea; https://github.com/signalapp/Signal-Desktop/releases/tag/v1.10.1; https://twitter.com/bcrypt/status/[PII_REDACTED]04952320
CVE: CVE-2018-11090
Published: 2018-05-14
Description: An XSS issue was discovered in MyBiz MyProcureNet 5.0.0. This vulnerability within "ProxyPage.aspx" allows an attacker to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/May/32; https://www.sec-consult.com/en/blog/advisories/arbitrary-file-upload-cross-site-scripting-in-mybiz-myprocurenet/; http://seclists.org/fulldisclosure/2018/May/32
CVE: CVE-2018-11091
Published: 2018-05-14
Description: An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload a script to issue operating system commands. This vulnerability occurs because an attacker is able to adjust the "HiddenFieldControlCustomWhiteListedExtensions" parameter and add arbitrary extensions to the whitelist during the upload. For instance, if the extension .asp is added to the "HiddenFieldControlCustomWhiteListedExtensions" parameter, the server accepts "secctest.asp" as a legitimate file. Hence malicious files can be uploaded in order to execute arbitrary commands to take over the server.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html; http://seclists.org/fulldisclosure/2018/May/32; https://seclists.org/bugtraq/2019/Nov/16
CVE: CVE-2018-11095
Published: 2018-05-15
Description: The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://docs.google.com/document/d/13xJhiIgDbqYwmR4j7aGEbKUU8KDl195mkw4rcvhT4J8/edit?usp=sharing; https://github.com/libming/libming/issues/141; https://docs.google.com/document/d/13xJhiIgDbqYwmR4j7aGEbKUU8KDl195mkw4rcvhT4J8/edit?usp=sharing
CVE: CVE-2018-11097
Published: 2018-05-15
Description: An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/cloudwu/cstring/issues/6; https://github.com/cloudwu/cstring/issues/6
CVE: CVE-2018-11098
Published: 2018-05-15
Description: An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/philippe/FrogCMS/issues/11; https://github.com/philippe/FrogCMS/issues/11