deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10515
Published: 2018-04-27
Description: In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2018-10516
Published: 2018-04-27
Description: In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2018-10517
Published: 2018-04-27
Description: In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://www.exploit-db.com/exploits/45793/; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2018-10518
Published: 2018-04-27
Description: In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2018-10519
Published: 2018-04-27
Description: CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2018-10520
Published: 2018-04-27
Description: In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2018-10521
Published: 2018-04-27
Description: In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.
CVSS Score: 2.7 (LOW)
CWE: CWE-434
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2018-10522
Published: 2018-04-27
Description: In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2018-10523
Published: 2018-04-27
Description: CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/itodaro/cmsms_cve/blob/master/README.md; https://github.com/itodaro/cmsms_cve/blob/master/README.md
CVE: CVE-2017-18263
Published: 2018-04-28
Description: Seagate Media Server in Seagate Personal Cloud before 4.3.18.4 has directory traversal in getPhotoPlaylistPhotos.psp via a parameter named url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://packetstormsecurity.com/files/147274/Seagate-Media-Server-Path-Traversal.html; https://sumofpwn.nl/advisory/2017/seagate-media-server-path-traversal-vulnerability.html; https://packetstormsecurity.com/files/147274/Seagate-Media-Server-Path-Traversal.html
CVE: CVE-2018-10468
Published: 2018-04-28
Description: The transferFrom function of a smart contract implementation for Useless Ethereum Token (UET), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all victims' balances into their account) because certain computations involving _value are incorrect, as exploited in the wild starting in December 2017, aka the "transferFlaw" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://medium.com/%40jonghyk.song/uselessethereumtoken-uet-erc20-token-allows-attackers-to-steal-all-victims-balances-543d42ac808e; https://peckshield.com/2018/04/28/transferFlaw/; https://medium.com/%40jonghyk.song/uselessethereumtoken-uet-erc20-token-allows-attackers-to-steal-all-victims-balances-543d42ac808e
CVE: CVE-2018-10527
Published: 2018-04-28
Description: EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.html#listarticle URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/teameasy/EasyCMS/issues/2; https://github.com/teameasy/EasyCMS/issues/2
CVE: CVE-2018-10528
Published: 2018-04-29
Description: An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function in libraw_cxx.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibRaw/LibRaw/commit/efd8cfabb93fd0396266a[PII_REDACTED]657c082e3; https://github.com/LibRaw/LibRaw/issues/144; https://usn.ubuntu.com/3639-1/
CVE: CVE-2018-10529
Published: 2018-04-29
Description: An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in libraw_x3f.cpp and libraw_cxx.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/LibRaw/LibRaw/commit/f0c505a3e5d47989a5f69be2d0d4f250af6b1a6c; https://github.com/LibRaw/LibRaw/issues/144; https://usn.ubuntu.com/3639-1/
CVE: CVE-2018-10534
Published: 2018-04-29
Description: The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104025; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3032
CVE: CVE-2018-10535
Published: 2018-04-29
Description: The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/104021; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3032
CVE: CVE-2018-10536
Published: 2018-04-29
Description: An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html; https://github.com/dbry/WavPack/commit/26cb47f99d481ad9b93eeff80d26e6b63bbd7e15; https://github.com/dbry/WavPack/issues/30
CVE: CVE-2018-10537
Published: 2018-04-29
Description: An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html; https://github.com/dbry/WavPack/commit/26cb47f99d481ad9b93eeff80d26e6b63bbd7e15; https://github.com/dbry/WavPack/issues/30
CVE: CVE-2018-10538
Published: 2018-04-29
Description: An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html; https://github.com/dbry/WavPack/commit/6f8bb34c2993a48ab9afbe353e6d0cff7c8d821d; https://github.com/dbry/WavPack/issues/33
CVE: CVE-2018-10539
Published: 2018-04-29
Description: An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html; https://github.com/dbry/WavPack/commit/6f8bb34c2993a48ab9afbe353e6d0cff7c8d821d; https://github.com/dbry/WavPack/issues/33
CVE: CVE-2018-10540
Published: 2018-04-29
Description: An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html; https://github.com/dbry/WavPack/commit/6f8bb34c2993a48ab9afbe353e6d0cff7c8d821d; https://github.com/dbry/WavPack/issues/33
CVE: CVE-2018-9845
Published: 2018-04-29
Description: Etherpad Lite before 1.6.4 is exploitable for admin access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-178
References: https://github.com/ether/etherpad-lite/blob/develop/CHANGELOG.md; https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511b; https://github.com/ether/etherpad-lite/blob/develop/CHANGELOG.md
CVE: CVE-2018-10545
Published: 2018-04-29
Description: An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/104022
CVE: CVE-2018-10546
Published: 2018-04-29
Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/104019
CVE: CVE-2018-10547
Published: 2018-04-29
Description: An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.securitytracker.com/id/1040807
CVE: CVE-2018-10548
Published: 2018-04-29
Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/104019
CVE: CVE-2018-10549
Published: 2018-04-29
Description: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\0' character.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/104019
CVE: CVE-2018-10553
Published: 2018-04-30
Description: An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://code610.blogspot.com/2018/04/few-bugs-in-latest-nagios-xi-5413.html; http://code610.blogspot.com/2018/04/few-bugs-in-latest-nagios-xi-5413.html
CVE: CVE-2018-10554
Published: 2018-04-30
Description: An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelper.php opts or background parameter; (4) the i[] array parameter to ajax_handler.php; or (5) the deploynotification.php title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352
References: http://code610.blogspot.com/2018/04/few-bugs-in-latest-nagios-xi-5413.html; http://code610.blogspot.com/2018/04/few-bugs-in-latest-nagios-xi-5413.html
CVE: CVE-2018-10550
Published: 2018-04-30
Description: In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://github.com/OctopusDeploy/Issues/issues/4454; https://github.com/OctopusDeploy/Issues/issues/4454
CVE: CVE-2017-2591
Published: 2018-04-30
Description: 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.
CVSS Score: 3.7 (LOW)
CWE: CWE-122, CWE-125
References: http://www.securityfocus.com/bid/95670; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591; https://pagure.io/389-ds-base/issue/48986
CVE: CVE-2017-18262
Published: 2018-04-30
Description: Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-601
References: http://seclists.org/fulldisclosure/2018/Apr/57; http://www.securitytracker.com/id/1040767; https://ethan.pm/blackboard.txt
CVE: CVE-2018-0711
Published: 2018-04-30
Description: Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1040779; https://www.qnap.com/zh-tw/security-advisory/nas-201804-27; http://www.securitytracker.com/id/1040779
CVE: CVE-2017-17314
Published: 2018-04-30
Description: Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C10, V500R002C00, V600R006C00 have an invalid memory access vulnerability. An unauthenticated attacker has to find a way to send malformed SCCP messages to the affected products. Due to insufficient input validation of some values in the messages, successful exploit may cause buffer error and some service abnormal.
CVSS Score: 3.7 (LOW)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180425-02-buffer-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180425-02-buffer-en
CVE: CVE-2017-17318
Published: 2018-04-30
Description: Huawei MBB (Mobile Broadband) products E5771h-937 with the versions before E5771h-937TCPU-V200R001B328D62SP00C1133 and the versions before E5771h-937TCPU-V200R001B329D05SP00C1308 have a Denial of Service (DoS) vulnerability. When an attacker accessing device sends special http request to device, the webserver process will try to apply too much memory which can cause the device to become unable to respond. An attacker can launch a DoS attack by exploiting this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180428-01-mbb-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180428-01-mbb-en
CVE: CVE-2018-1389
Published: 2018-04-30
Description: IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing unauthorized modification of information. IBM X-Force ID: 138213.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22013531; http://www.securityfocus.com/bid/104026; https://exchange.xforce.ibmcloud.com/vulnerabilities/138213
CVE: CVE-2018-1430
Published: 2018-04-30
Description: IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139226.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22013058; http://www.securityfocus.com/bid/104027; https://exchange.xforce.ibmcloud.com/vulnerabilities/139226
CVE: CVE-2018-7901
Published: 2018-04-30
Description: RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the key that RCS uses to authenticate the application. Successful exploitation may cause the attacker to control keyboard remotely.
CVSS Score: 4.4 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180425-01-rcs-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180425-01-rcs-en
CVE: CVE-2017-9657
Published: 2018-04-30
Description: Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring station is possible. In this state, the central monitoring station can indicate the MX40 is not connected or associated to the central monitor, and thus should be operating in local monitoring mode (local audio-on, screen-on), but the MX40 WLAN itself can instead still be operating in telemetry mode (local audio-off, screen-off). If a patient experiences an alarm event and clinical staff expects the MX40 to provide local alarming when it is not available from the local device, a delay of treatment can occur. CVSS v3 base score: 6.5, CVSS vector string: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Philips has released software update, Version B.06.18, to fix the improper cleanup on thrown exception vulnerability, and implement mitigations to reduce the risk associated with the improper handling of exceptional conditions vulnerability. The software update implements messaging and alarming on the MX40 and at the central monitoring station, when the MX40 disconnects from the access point.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-460, CWE-755
References: http://www.securityfocus.com/bid/100813; https://ics-cert.us-cert.gov/advisories/ICSMA-17-255-01; https://www.usa.philips.com/healthcare/about/customer-support/product-security
CVE: CVE-2017-9658
Published: 2018-04-30
Description: Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not required, which can necessitate intervention by hospital staff to reset the device and reestablish a network connection to the Wi-Fi access point. During this state, the Philips IntelliVue MX40 Version B.06.18 can either connect to an alternative access point within signal range for association to a central monitoring station, or it can remain in local monitoring mode until the device is reset by hospital staff. CVSS v3 base score: 6.5, CVSS vector string: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Philips has released software update, Version B.06.18, to fix the improper cleanup on thrown exception vulnerability, and implement mitigations to reduce the risk associated with the improper handling of exceptional conditions vulnerability. The software update implements messaging and alarming on the MX40 and at the central monitoring station, when the MX40 disconnects from the access point.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: http://www.securityfocus.com/bid/100813; https://ics-cert.us-cert.gov/advisories/ICSMA-17-255-01; https://www.usa.philips.com/healthcare/about/customer-support/product-security
CVE: CVE-2018-7891
Published: 2018-04-30
Description: The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a) contains .NET Remoting endpoints that are vulnerable to deserialization attacks resulting in remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/104120; https://cert-portal.siemens.com/productcert/pdf/ssa-457058.pdf; https://supportcommunity.milestonesys.com/s/article/XProtect-VMS-NET-security-vulnerability-hotfixes-for-2016-R1-2018-R1?language=en_US