deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15668
Published: 2018-08-21
Description: An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary emails from an active account. URL parameters for the "send" command with the "attachment_" prefix designate attachment parameters. If the value of an attachment parameter corresponds to an accessible file path, the file is attached to the outbound message. In addition, relative file paths are acceptable attachment parameter values. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an email with designated attachments from the target account to a target address.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://versprite.com/advisories/airmail-3-for-mac-2/; https://versprite.com/advisories/airmail-3-for-mac-2/
CVE: CVE-2018-15669
Published: 2018-08-21
Description: An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are not forbidden by the policy. An attacker may abuse HTML plug-in elements within an email to trigger frame navigation requests that bypass this filter.
CVSS Score: 5.3 (MEDIUM)
References: https://versprite.com/advisories/airmail-3-for-mac-3/; https://versprite.com/advisories/airmail-3-for-mac-3/
CVE: CVE-2018-15670
Published: 2018-08-21
Description: An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. A navigation request is processed by the default URL handler only if the currentEvent is NX_LMOUSEUP or NX_OMOUSEUP. An attacker may abuse HTML elements with an EventHandler for a chance to validate navigation requests for URLs that are processed during the NX_LMOUSEUP event triggered by clicking an email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://versprite.com/advisories/airmail-3-for-mac-4/; https://versprite.com/advisories/airmail-3-for-mac-4/
CVE: CVE-2018-15671
Published: 2018-08-21
Description: An issue was discovered in the HDF HDF5 1.10.2 library. Excessive stack consumption has been detected in the function H5P__get_cb() in H5Pint.c during an attempted parse of a crafted HDF file. This results in denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5#stack-overflow---stackoverflow_h5p__get_cb; https://github.com/SegfaultMasters/covering360/tree/master/HDF5#stack-overflow---stackoverflow_h5p__get_cb
CVE: CVE-2018-15672
Published: 2018-08-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-11207. Reason: This candidate is a reservation duplicate of CVE-2018-11207. Notes: All CVE users should reference CVE-2018-11207 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-1599
Published: 2018-08-22
Description: IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 143744.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22016672; https://exchange.xforce.ibmcloud.com/vulnerabilities/143744; http://www.ibm.com/support/docview.wss?uid=swg22016672
CVE: CVE-2018-10844
Published: 2018-08-22
Description: It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-385, CWE-327
References: http://www.securityfocus.com/bid/105138; https://access.redhat.com/errata/RHSA-2018:3050; https://access.redhat.com/errata/RHSA-2018:3505
CVE: CVE-2018-10845
Published: 2018-08-22
Description: It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-385, CWE-327
References: http://www.securityfocus.com/bid/105138; https://access.redhat.com/errata/RHSA-2018:3050; https://access.redhat.com/errata/RHSA-2018:3505
CVE: CVE-2018-10846
Published: 2018-08-22
Description: A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-385, CWE-327
References: http://www.securityfocus.com/bid/105138; https://access.redhat.com/errata/RHSA-2018:3050; https://access.redhat.com/errata/RHSA-2018:3505
CVE: CVE-2018-11776
Published: 2018-08-22
Description: Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
CVSS Score: 8.1 (HIGH)
References: http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt; http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-1[PII_REDACTED].html
CVE: CVE-2018-10884
Published: 2018-08-22
Description: Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/105136; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10884; http://www.securityfocus.com/bid/105136
CVE: CVE-2018-1139
Published: 2018-08-22
Description: A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-522
References: http://www.securityfocus.com/bid/105084; https://access.redhat.com/errata/RHSA-2018:2612; https://access.redhat.com/errata/RHSA-2018:2613
CVE: CVE-2018-1140
Published: 2018-08-22
Description: A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server, used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105082; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1140; https://bugzilla.samba.org/show_bug.cgi?id=13374
CVE: CVE-2017-7513
Published: 2018-08-22
Description: It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a PostgreSQL server using a specially crafted X.509 certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7513; https://access.redhat.com/security/cve/cve-2017-7513; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7513
CVE: CVE-2017-2662
Published: 2018-08-22
Description: A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662; https://projects.theforeman.org/issues/18838; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662
CVE: CVE-2017-7528
Published: 2018-08-22
Description: Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback).
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-113, CWE-93
References: http://www.securityfocus.com/bid/105143; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7528; http://www.securityfocus.com/bid/105143
CVE: CVE-2017-2627
Published: 2018-08-22
Description: A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. The sudoers file as installed with OSP's openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal with '..' and it grants full passwordless root access to the validations user.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2627; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2627
CVE: CVE-2018-10858
Published: 2018-08-22
Description: A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-119
References: http://www.securityfocus.com/bid/105085; http://www.securitytracker.com/id/1042002; https://access.redhat.com/errata/RHSA-2018:2612
CVE: CVE-2018-10918
Published: 2018-08-22
Description: A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.securityfocus.com/bid/105083; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10918; https://security.gentoo.org/glsa/202003-52
CVE: CVE-2018-10919
Published: 2018-08-22
Description: The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203, CWE-200
References: http://www.securityfocus.com/bid/105081; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10919; https://security.gentoo.org/glsa/202003-52
CVE: CVE-2018-5235
Published: 2018-08-22
Description: Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-427
References: http://www.securityfocus.com/bid/105099; https://support.symantec.com/en_US/article.SYMSA1459.html; http://www.securityfocus.com/bid/105099
CVE: CVE-2018-5238
Published: 2018-08-22
Description: Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/105100; https://support.symantec.com/en_US/article.SYMSA1459.html; http://www.securityfocus.com/bid/105100
CVE: CVE-2018-14787
Published: 2018-08-22
Description: In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 2.x or prior and Xcelera Version 4.1 or prior), an attacker with escalated privileges could access folders which contain executables where authenticated users have write permissions, and could then execute arbitrary code with local administrative permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01; https://www.usa.philips.com/healthcare/about/customer-support/product-security; https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01
CVE: CVE-2018-14789
Published: 2018-08-22
Description: In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior), an unquoted search path or element vulnerability has been identified, which may allow an attacker to execute arbitrary code and escalate their level of privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01; https://www.usa.philips.com/healthcare/about/customer-support/product-security; https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01
CVE: CVE-2018-14799
Published: 2018-08-22
Description: In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user. This can lead to buffer overflow or format string vulnerabilities.
CVSS Score: 3.7 (LOW)
CWE: CWE-20, CWE-119, CWE-134
References: http://www.securityfocus.com/bid/105103; https://ics-cert.us-cert.gov/advisories/ICSMA-18-228-01; https://www.usa.philips.com/healthcare/about/customer-support/product-security
CVE: CVE-2018-14801
Published: 2018-08-22
Description: In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset existing passwords.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/105103; https://ics-cert.us-cert.gov/advisories/ICSMA-18-228-01; https://www.usa.philips.com/healthcare/about/customer-support/product-security
CVE: CVE-2018-11758
Published: 2018-08-22
Description: This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a malicious XML file, the attacker will be able to instruct the XML parser built into CayenneModeler to transfer files from a local machine to a remote machine controlled by the attacker. The cause of the issue is XML parser processing XML External Entity (XXE) declarations included in XML. The vulnerability is addressed in Cayenne by disabling XXE processing in all operations that require XML parsing.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/105142; https://lists.apache.org/thread.html/ed60a4d329be3c722f105317ca883986dfcd17615c70d1df87f4528c%40%3Cuser.cayenne.apache.org%3E; http://www.securityfocus.com/bid/105142
CVE: CVE-2016-9605
Published: 2018-08-22
Description: A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9605; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9605
CVE: CVE-2017-2575
Published: 2018-08-22
Description: A vulnerability was found while fuzzing libbpg 0.9.7. It is a NULL pointer dereference issue due to missing check of the return value of function malloc in the BPG encoder. This vulnerability appeared while converting a malicious JPEG file to BPG.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-476
References: http://seclists.org/oss-sec/2017/q2/100; http://www.securityfocus.com/bid/97963; https://exchange.xforce.ibmcloud.com/vulnerabilities/148857
CVE: CVE-2017-2635
Published: 2018-08-22
Description: A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service.
CVSS Score: 7.7 (HIGH)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2635; https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=c3de387380f6057ee0e46cd9f2f0a092e8070875; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2635
CVE: CVE-2018-15685
Published: 2018-08-23
Description: GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1188
References: https://electronjs.org/blog/web-preferences-fix; https://www.exploit-db.com/exploits/45272/; https://electronjs.org/blog/web-preferences-fix
CVE: CVE-2017-16348
Published: 2018-08-23
Description: An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebooting the device without authentication. An attacker can send a UDP packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0485; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0485
CVE: CVE-2018-3832
Published: 2018-08-23
Description: An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger this vulnerability, an attacker can upload an MPFS binary via the '/mpfsupload' HTTP form and later on upload the firmware via a POST request to 'firmware.htm'.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0511; https://exchange.xforce.ibmcloud.com/vulnerabilities/144976; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0511
CVE: CVE-2018-3833
Published: 2018-08-23
Description: An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed and thus allows for flashing older firmware images. To trigger this vulnerability, an attacker needs to impersonate the remote server 'cache.insteon.com' and serve any signed firmware image.
CVSS Score: 7.5 (HIGH)
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512
CVE: CVE-2017-14453
Published: 2018-08-23
Description: On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. A strcpy overflows the buffer insteon_pubnub.channel_ad_r, which has a size of 16 bytes. An attacker can send an arbitrarily long "ad_r" parameter in order to exploit this vulnerability.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0502; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0502
CVE: CVE-2017-14455
Published: 2018-08-23
Description: On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. A strcpy overflows the buffer insteon_pubnub.channel_ak, which has a size of 16 bytes. An attacker can send an arbitrarily long "ak" parameter in order to exploit this vulnerability.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0502; https://exchange.xforce.ibmcloud.com/vulnerabilities/144975; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0502
CVE: CVE-2017-16337
Published: 2018-08-23
Description: On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. At 0x9d01ef24 the value for the s_offset key is copied using strcpy to the buffer at $sp+0x2b0. This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0483; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0483
CVE: CVE-2018-15748
Published: 2018-08-23
Description: On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(2335dn MFP) 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the HTML source code of the Email Settings webpage. In some cases, authentication can be achieved with the blank default password for the admin account. NOTE: the vendor indicates that this is an "End Of Support Life" product.
CVSS Score: 8.8 (HIGH)
CWE: CWE-521
References: https://www.gerrenmurphy.com/dell-2335dn-password-disclosure/; https://www.gerrenmurphy.com/dell-2335dn-password-disclosure/
CVE: CVE-2018-3863
Published: 2018-08-23
Description: On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. A strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "user" value in order to exploit this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0548; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0548