deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7264
Published: 2018-02-28
Description: The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and sign errors, allowing a remote attacker to execute arbitrary code on vulnerable applications using the ActivePDF Toolkit to process untrusted images.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2018/Feb/74; https://www.exploit-db.com/exploits/44251/; http://seclists.org/fulldisclosure/2018/Feb/74
CVE: CVE-2018-1286
Published: 2018-02-28
Description: In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://lists.apache.org/thread.html/dc2151baa5301bae773603cede0d62c21ee28588dd06e5e9253c13a8%40%3Cuser.openmeetings.apache.org%3E; https://lists.apache.org/thread.html/dc2151baa5301bae773603cede0d62c21ee28588dd06e5e9253c13a8%40%3Cuser.openmeetings.apache.org%3E
CVE: CVE-2018-1304
Published: 2018-02-28
Description: The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
CVSS Score: 5.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/103170
CVE: CVE-2015-3898
Published: 2018-02-28
Description: Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html; http://www.securityfocus.com/archive/1/535733/100/0/threaded; https://www.htbridge.com/advisory/HTB23259
CVE: CVE-2018-7568
Published: 2018-02-28
Description: The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; https://access.redhat.com/errata/RHBA-2019:0327
CVE: CVE-2018-7569
Published: 2018-02-28
Description: dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-191
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; https://access.redhat.com/errata/RHBA-2019:0327
CVE: CVE-2018-7570
Published: 2018-02-28
Description: The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; https://security.gentoo.org/glsa/201811-17
CVE: CVE-2015-4117
Published: 2018-02-28
Description: Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://vestacp.com/roadmap/#history; https://www.exploit-db.com/exploits/37369/; https://www.htbridge.com/advisory/HTB23261
CVE: CVE-2015-5079
Published: 2018-02-28
Description: Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the dl parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/132541/BlackCat-CMS-1.1.1-Path-Traversal.html; http://www.securityfocus.com/archive/1/535900/100/0/threaded; https://www.htbridge.com/advisory/HTB23263
CVE: CVE-2018-6947
Published: 2018-02-28
Description: An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and earlier allows a local low privileged user to gain elevation of privileges on Windows 7 (32 and 64bit), and denial of service for Windows 8 and 10.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://www.exploit-db.com/exploits/44167/; https://www.exploit-db.com/exploits/44168/; https://www.fidusinfosec.com/nomachine-road-code-execution-without-fuzzing-cve-2018-6947/
CVE: CVE-2018-6653
Published: 2018-03-01
Description: comforte SWAP 1049 through 1069 and 20.0.0 through 21.5.3 (as used in SSLOBJ on HPE NonStop SSL T0910, and in the comforte SecurCS, SecurFTP, SecurLib/SSL-AT, and SecurTN products), after executing the RELOAD CERTIFICATES command, does not ensure that clients use a strong TLS cipher suite, which makes it easier for remote attackers to defeat intended cryptographic protection mechanisms by sniffing the network. This is fixed in 21.6.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326
References: https://comforte.com/cve-2018-6653/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03827en_us; https://comforte.com/cve-2018-6653/
CVE: CVE-2017-18207
Published: 2018-03-01
Description: The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; https://bugs.python.org/issue32056; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
CVE: CVE-2017-18208
Published: 2018-03-01
Description: The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6ea8d958a2c95a1d514015d4e29ba21a8c0a1a91; https://access.redhat.com/errata/RHSA-2018:2948; https://access.redhat.com/errata/RHSA-2018:3083
CVE: CVE-2017-12627
Published: 2018-03-01
Description: In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://seclists.org/oss-sec/2018/q1/203; http://www.securityfocus.com/bid/103219; http://xerces.apache.org/xerces-c/secadv/CVE-2017-12627.txt
CVE: CVE-2018-7561
Published: 2018-03-01
Description: Stack-based Buffer Overflow in httpd on Tenda AC9 devices V15.03.05.14_EN allows remote attackers to cause a denial of service or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/VulDetailsPublication/Poc/tree/master/Tenda/AC9; https://github.com/VulDetailsPublication/Poc/tree/master/Tenda/AC9
CVE: CVE-2017-6150
Published: 2018-03-01
Description: Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default), some specific large fragmented packets may restart the Traffic Management Microkernel (TMM).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103235; https://support.f5.com/csp/article/K62712037; http://www.securityfocus.com/bid/103235
CVE: CVE-2017-6154
Published: 2018-03-01
Description: On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when processing undisclosed types of data on systems with 48 or more CPU cores.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103233; https://support.f5.com/csp/article/K38243073; http://www.securityfocus.com/bid/103233
CVE: CVE-2018-5500
Published: 2018-03-01
Description: On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory. Virtual server using TCP profile with Multipath TCP (MCTCP) feature enabled will be affected by this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/103217; https://support.f5.com/csp/article/K33211839; http://www.securityfocus.com/bid/103217
CVE: CVE-2018-5501
Published: 2018-03-01
Description: In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of flow control.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/103211; https://support.f5.com/csp/article/K44200194; http://www.securityfocus.com/bid/103211
CVE: CVE-2018-2365
Published: 2018-03-01
Description: SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102999; https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/; https://launchpad.support.sap.com/#/notes/2547977
CVE: CVE-2018-2367
Published: 2018-03-01
Description: ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/103006; https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/; https://launchpad.support.sap.com/#/notes/2562089
CVE: CVE-2018-2368
Published: 2018-03-01
Description: SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/103000; https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/; https://launchpad.support.sap.com/#/notes/2565622
CVE: CVE-2018-2380
Published: 2018-03-01
Description: SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/103001; https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/; https://github.com/erpscanteam/CVE-2018-2380
CVE: CVE-2018-5314
Published: 2018-03-01
Description: Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; and the NetScaler Load Balancing instance distributed with NetScaler SD-WAN/CloudBridge 4000, 4100, 5000 and 5100 WAN Optimization Edition 9.3.0 allows remote attackers to execute a system command or read arbitrary files via an SSH login prompt.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/103186; http://www.securitytracker.com/id/1040439; https://support.citrix.com/article/CTX232199
CVE: CVE-2018-7550
Published: 2018-03-01
Description: The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: http://www.securityfocus.com/bid/103181; https://access.redhat.com/errata/RHSA-2018:1369; https://access.redhat.com/errata/RHSA-2018:2462
CVE: CVE-2018-7573
Published: 2018-03-01
Description: An issue was discovered in FTPShell Client 6.7. A remote FTP server can send 400 characters of 'F' in conjunction with the FTP 220 response code to crash the application; after this overflow, one can run arbitrary code on the victim machine. This is similar to CVE-2009-3364 and CVE-2017-6465.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/44596/; https://www.exploit-db.com/exploits/44968/
CVE: CVE-2018-7579
Published: 2018-03-01
Description: \application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/update_category_url.html.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.atksec.com/article/yzmcms-v3.6-sqli/index.html; http://www.atksec.com/article/yzmcms-v3.6-sqli/index.html
CVE: CVE-2018-7584
Published: 2018-03-01
Description: In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/103204; http://www.securitytracker.com/id/1041607
CVE: CVE-2017-14798
Published: 2018-03-01
Description: A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
CVSS Score: 7.3 (HIGH)
CWE: CWE-61, CWE-362
References: http://lists.suse.com/pipermail/sle-security-updates/2017-November/003420.html; https://bugzilla.suse.com/show_bug.cgi?id=1062722; https://www.exploit-db.com/exploits/45184/
CVE: CVE-2017-14799
Published: 2018-03-01
Description: A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.novell.com/support/kb/doc.php?id=7022358; https://www.novell.com/support/kb/doc.php?id=7022358
CVE: CVE-2017-14800
Published: 2018-03-01
Description: A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.novell.com/support/kb/doc.php?id=7022356; https://www.novell.com/support/kb/doc.php?id=7022356
CVE: CVE-2017-14804
Published: 2018-03-01
Description: The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22, CWE-20
References: https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00024.html; https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00025.html; https://lists.opensuse.org/opensuse-security-announce/2018-01/msg00030.html
CVE: CVE-2017-5188
Published: 2018-03-01
Description: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-59, CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=1029824; https://github.com/openSUSE/open-build-service/commit/ba27c91351878bc297ec4baba0bd488a2f3b568d; https://www.suse.com/de-de/security/cve/CVE-2017-5188/
CVE: CVE-2017-7426
Published: 2018-03-01
Description: The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak information or cause denial of service attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-611
References: https://www.novell.com/support/kb/doc.php?id=7021173; https://www.novell.com/support/kb/doc.php?id=7021173
CVE: CVE-2017-7435
Published: 2018-03-01
Description: In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=1009127; https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html; https://www.suse.com/de-de/security/cve/CVE-2017-7435/
CVE: CVE-2017-7436
Published: 2018-03-01
Description: In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=1038984; https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html; https://www.suse.com/de-de/security/cve/CVE-2017-7436/
CVE: CVE-2017-9268
Published: 2018-03-01
Description: In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-285, CWE-732
References: https://bugzilla.suse.com/show_bug.cgi?id=1045519; https://github.com/openSUSE/open-build-service/pull/3267; https://bugzilla.suse.com/show_bug.cgi?id=1045519
CVE: CVE-2017-9269
Published: 2018-03-01
Description: In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
CVSS Score: 7.7 (HIGH)
CWE: CWE-757, CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=1045735; https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00002.html; https://www.suse.com/de-de/security/cve/CVE-2017-9269/
CVE: CVE-2017-9270
Published: 2018-03-01
Description: In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database.
CVSS Score: 8.7 (HIGH)
CWE: CWE-22, CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=1041963; https://lists.opensuse.org/opensuse-security-announce/2017-07/msg00022.html; https://www.suse.com/de-de/security/cve/CVE-2017-9270/
CVE: CVE-2017-9271
Published: 2018-03-01
Description: The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://bugzilla.suse.com/show_bug.cgi?id=1050625; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VP2DNHXEQFHXBCTSREPNR7BU4EX64SQG/; https://www.suse.com/de-de/security/cve/CVE-2017-9271/
CVE: CVE-2017-9274
Published: 2018-03-01
Description: A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://bugzilla.suse.com/show_bug.cgi?id=938556; https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00024.html; https://www.suse.com/de-de/security/cve/CVE-2017-9274/
CVE: CVE-2017-9286
Published: 2018-03-01
Description: The packaging of NextCloud in openSUSE used /srv/www/htdocs in an unsafe manner, which could have allowed scripts running as wwwrun user to escalate privileges to root during nextcloud package upgrade.
CVSS Score: 7.8 (HIGH)
References: https://bugzilla.suse.com/show_bug.cgi?id=1036756; https://lists.opensuse.org/opensuse-updates/2017-10/msg00010.html; https://www.suse.com/de-de/security/cve/CVE-2017-9286/
CVE: CVE-2017-18209
Published: 2018-03-01
Description: In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs because a memory allocation result is not checked, related to GetOpenCLCacheDirectory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103218; https://github.com/ImageMagick/ImageMagick/issues/790; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE: CVE-2017-18210
Published: 2018-03-01
Description: In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function BenchmarkOpenCLDevices in MagickCore/opencl.c because a memory allocation result is not checked.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103212; https://github.com/ImageMagick/ImageMagick/issues/791; http://www.securityfocus.com/bid/103212
CVE: CVE-2017-18211
Published: 2018-03-01
Description: In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked, related to CacheOpenCLKernel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103220; https://github.com/ImageMagick/ImageMagick/issues/792; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE: CVE-2018-7047
Published: 2018-03-01
Description: An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX credentials (remote code execution may be possible as well).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-7047.txt; https://www.wowza.com/docs/wowza-streaming-engine-4-7-1-release-notes; https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-7047.txt
CVE: CVE-2018-7048
Published: 2018-03-01
Description: An issue was discovered in Wowza Streaming Engine before 4.7.1. There is a denial of service (memory consumption) via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-7048.txt; https://www.wowza.com/docs/wowza-streaming-engine-4-7-1-release-notes; https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-7048.txt