deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10953
Published: 2018-05-10
Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x0022204C.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x0022204C; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x0022204C
CVE: CVE-2018-10954
Published: 2018-05-10
Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x00222550.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222550; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222550
CVE: CVE-2018-10955
Published: 2018-05-10
Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x00222548.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222548; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222548
CVE: CVE-2018-10957
Published: 2018-05-10
Description: CSRF exists on D-Link DIR-868L devices, leading to (for example) a change to the Admin password. hedwig.cgi and pigwidgeon.cgi are two of the affected components.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://packetstormsecurity.com/files/147525/D-Link-DIR-868L-1.12-Cross-Site-Request-Forgery.html; https://packetstormsecurity.com/files/147525/D-Link-DIR-868L-1.12-Cross-Site-Request-Forgery.html
CVE: CVE-2018-10958
Published: 2018-05-10
Description: In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/302; https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html
CVE: CVE-2018-10962
Published: 2018-05-10
Description: An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe allow local users to bypass intended process protections, and consequently terminate processes, because mouse_event is not properly considered.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/rebol0x6c/2345_mouse_poc; https://github.com/rebol0x6c/2345_mouse_poc
CVE: CVE-2018-10963
Published: 2018-05-10
Description: The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://bugzilla.maptools.org/show_bug.cgi?id=2795; https://access.redhat.com/errata/RHSA-2019:2053; https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html
CVE: CVE-2018-10314
Published: 2018-05-10
Description: Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover -> Audit Scripts -> List Scripts -> Download section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.google.com/document/d/1lUHMAOnbQUfh_yBGdBB1x9n0QdVGeP9Tggu9auqpXNo/edit?usp=sharing; https://www.exploit-db.com/exploits/44613/; https://docs.google.com/document/d/1lUHMAOnbQUfh_yBGdBB1x9n0QdVGeP9Tggu9auqpXNo/edit?usp=sharing
CVE: CVE-2018-10942
Published: 2018-05-10
Description: modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbitrary code by uploading a .phtml file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://ia-informatica.com/it/CVE-2018-10942; https://ia-informatica.com/it/CVE-2018-10942
CVE: CVE-2018-8060
Published: 2018-05-10
Description: HWiNFO AMD64 Kernel driver version 8.98 and lower allows an unprivileged user to send an IOCTL to the device driver. If input and/or output buffer pointers are NULL or if these buffers' data are invalid, a NULL/invalid pointer access occurs, resulting in a Windows kernel panic aka Blue Screen. This affects IOCTLs higher than 0x85FE2600 with the HWiNFO32 symbolic device name.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/otavioarj/SIOCtl; https://github.com/otavioarj/SIOCtl
CVE: CVE-2018-8061
Published: 2018-05-10
Description: HWiNFO AMD64 Kernel driver version 8.98 and lower allows an unprivileged user to send IOCTL 0x85FE2608 to the device driver with the HWiNFO32 symbolic device name, resulting in direct physical memory read or write.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: https://github.com/otavioarj/SIOCtl; https://github.com/otavioarj/SIOCtl
CVE: CVE-2018-8824
Published: 2018-05-10
Description: modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function calls in the code parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://ia-informatica.com/it/CVE-2018-8824; https://ia-informatica.com/it/CVE-2018-8824
CVE: CVE-2018-9111
Published: 2018-05-10
Description: Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/ChuanYuan-Huang/a92b8b32980123d5fa9bf5a8299114bf; https://gist.github.com/ChuanYuan-Huang/a92b8b32980123d5fa9bf5a8299114bf
CVE: CVE-2018-9112
Published: 2018-05-10
Description: A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges by modifying cookies.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://gist.github.com/ChuanYuan-Huang/a92b8b32980123d5fa9bf5a8299114bf; https://gist.github.com/ChuanYuan-Huang/a92b8b32980123d5fa9bf5a8299114bf
CVE: CVE-2017-2601
Published: 2018-05-10
Description: Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2022/04/12/5; http://www.openwall.com/lists/oss-security/2022/05/17/8; http://www.openwall.com/lists/oss-security/2022/06/22/3
CVE: CVE-2018-1130
Published: 2018-05-10
Description: Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2018:1854; https://access.redhat.com/errata/RHSA-2018:3083; https://access.redhat.com/errata/RHSA-2018:3096
CVE: CVE-2018-8910
Published: 2018-05-10
Description: Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/en-global/support/security/Synology_SA_18_05; https://www.synology.com/en-global/support/security/Synology_SA_18_05
CVE: CVE-2018-8914
Published: 2018-05-10
Description: SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.synology.com/en-global/support/security/Synology_SA_18_04; https://www.synology.com/en-global/support/security/Synology_SA_18_04
CVE: CVE-2018-8915
Published: 2018-05-10
Description: Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary web script or HTML via title parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/en-global/support/security/Synology_SA_18_06; https://www.synology.com/en-global/support/security/Synology_SA_18_06
CVE: CVE-2017-18266
Published: 2018-05-10
Description: The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://bugs.freedesktop.org/show_bug.cgi?id=103807; https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2; https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb
CVE: CVE-2017-6289
Published: 2018-05-10
Description: In Android before the 2018-05-05 security patch level, NVIDIA Trusted Execution Environment (TEE) contains a memory corruption (due to unusual root cause) vulnerability, which if run within the speculative execution of the TEE, may lead to local escalation of privileges. This issue is rated as critical. Android: A-72830049. Reference: N-CVE-2017-6289.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/104145; https://source.android.com/security/bulletin/2018-05-01; http://www.securityfocus.com/bid/104145
CVE: CVE-2017-6293
Published: 2018-05-10
Description: In Android before the 2018-05-05 security patch level, NVIDIA Tegra X1 TZ contains a vulnerability in Widevine TA where the software writes data past the end, or before the beginning, of the intended buffer, which may lead to escalation of Privileges. This issue is rated as high. Android: A-69377364. Reference: N-CVE-2017-6293.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104145; https://source.android.com/security/bulletin/2018-05-01; http://www.securityfocus.com/bid/104145
CVE: CVE-2018-10655
Published: 2018-05-10
Description: DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH).
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://hyp3rlinx.altervista.org/advisories/DEVICELOCK-PLUG-PLAY-AUDITOR-v5.72-UNICODE-BUFFER-OVERFLOW.txt; http://packetstormsecurity.com/files/147516/DeviceLock-Plug-And-Play-Auditor-5.72-Buffer-Overflow.html; https://www.exploit-db.com/exploits/44590/
CVE: CVE-2018-10803
Published: 2018-05-10
Description: Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: http://www.securityfocus.com/bid/104251; https://www.manageengine.com/products/netflow/readme.html#123125; http://www.securityfocus.com/bid/104251
CVE: CVE-2018-6246
Published: 2018-05-10
Description: In Android before the 2018-05-05 security patch level, NVIDIA Widevine Trustlet contains a vulnerability in Widevine TA where the software reads data past the end, or before the beginning, of the intended buffer, which may lead to Information Disclosure. This issue is rated as moderate. Android: A-69383916. Reference: N-CVE-2018-6246.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-05-01; https://source.android.com/security/bulletin/pixel/2018-05-01
CVE: CVE-2018-6254
Published: 2018-05-10
Description: In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read (due to improper input validation) vulnerability which could lead to local information disclosure. This issue is rated as moderate. Android: A-64340684. Reference: N-CVE-2018-6254.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-05-01; https://source.android.com/security/bulletin/pixel/2018-05-01
CVE: CVE-2018-7933
Published: 2018-05-10
Description: Huawei home gateway products HiRouter-CD20 and WS5200 with the versions before HiRouter-CD20-10 1.9.6 and the versions before WS5200-10 1.9.6 have a path traversal vulnerability. Due to the lack of validation while these home gateway products install APK plugins, an attacker tricks a user into installing a malicious APK plugin, and plugin can overwrite arbitrary file of devices. Successful exploit may result in arbitrary code execution or privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180502-01-gateway-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180502-01-gateway-en
CVE: CVE-2018-7940
Published: 2018-05-10
Description: Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0.129(SP2C01) have an authentication bypass vulnerability. An attacker with high privilege obtains the smart phone and bypass the activation function by some specific operations.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180509-01-mobile-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180509-01-mobile-en
CVE: CVE-2018-7941
Published: 2018-05-10
Description: Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft specific messages to upload authentication certificate to the affected products. Due to improper validation of the upload authority, successful exploit may cause privilege elevation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180509-01-bypass-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180509-01-bypass-en
CVE: CVE-2018-9849
Published: 2018-05-10
Description: Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104160; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730; http://www.securityfocus.com/bid/104160
CVE: CVE-2017-18267
Published: 2018-05-10
Description: The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3140; https://access.redhat.com/errata/RHSA-2018:3505
CVE: CVE-2018-10971
Published: 2018-05-10
Description: An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The Plane function in image/image.hpp allows remote attackers to cause a denial of service (attempted excessive memory allocation) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/FLIF-hub/FLIF/issues/501; https://github.com/FLIF-hub/FLIF/issues/501
CVE: CVE-2018-10972
Published: 2018-05-10
Description: An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The TransformPaletteC::process function in transform/palette_C.hpp allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/FLIF-hub/FLIF/issues/503; https://github.com/FLIF-hub/FLIF/issues/503
CVE: CVE-2018-10974
Published: 2018-05-10
Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x00222100.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222100; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222100
CVE: CVE-2018-10975
Published: 2018-05-10
Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x00222104.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222104; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222104
CVE: CVE-2018-10976
Published: 2018-05-10
Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x00222050.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222050; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222050
CVE: CVE-2018-10977
Published: 2018-05-10
Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x002220E4.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x002220E4; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x002220E4
CVE: CVE-2018-10706
Published: 2018-05-10
Description: An integer overflow in the transferMulti function of a smart contract implementation for Social Chain (SCA), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets, aka the "multiOverflow" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://peckshield.com/2018/05/10/multiOverflow/; https://peckshield.com/2018/05/10/multiOverflow/
CVE: CVE-2018-10973
Published: 2018-05-10
Description: An integer overflow in the transferMulti function of a smart contract implementation for KoreaShow, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted _value parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://openwall.com/lists/oss-security/2018/05/10/2; http://openwall.com/lists/oss-security/2018/05/10/2
CVE: CVE-2018-1115
Published: 2018-05-10
Description: postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732, CWE-732
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html; http://www.securityfocus.com/bid/104285; https://access.redhat.com/errata/RHSA-2018:2565
CVE: CVE-2018-10981
Published: 2018-05-10
Description: An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://openwall.com/lists/oss-security/2018/05/08/3; http://www.securityfocus.com/bid/104149; https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html
CVE: CVE-2018-1118
Published: 2018-05-10
Description: Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.
CVSS Score: 2.3 (LOW)
CWE: CWE-665, CWE-200
References: https://access.redhat.com/errata/RHSA-2018:2948; https://access.redhat.com/errata/RHSA-2018:3083; https://access.redhat.com/errata/RHSA-2018:3096
CVE: CVE-2018-3612
Published: 2018-05-10
Description: Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Management Mode (SMM).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00110.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00110.html
CVE: CVE-2018-3617
Published: 2018-05-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-3691.  Reason: This candidate is a reservation duplicate of CVE-2018-3691.  Notes: All CVE users should reference CVE-2018-3691 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-3649
Published: 2018-05-10
Description: DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers and related software in Intel Dual Band Wireless-AC, Tri-Band Wireless-AC and Wireless-AC family of products allows a local attacker to cause escalation of privilege via remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00126.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00126.html
CVE: CVE-2018-10982
Published: 2018-05-10
Description: An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection.
CVSS Score: 8.8 (HIGH)
References: http://openwall.com/lists/oss-security/2018/05/08/2; http://www.securityfocus.com/bid/104150; https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html
CVE: CVE-2016-8627
Published: 2018-05-11
Description: admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: http://rhn.redhat.com/errata/RHSA-2017-0170.html; http://rhn.redhat.com/errata/RHSA-2017-0171.html; http://rhn.redhat.com/errata/RHSA-2017-0172.html