deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-6115
Published: 2018-12-04
Description: Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103917; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html; https://crbug.com/819809
CVE: CVE-2018-6116
Published: 2018-12-04
Description: A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103917; https://access.redhat.com/errata/RHSA-2018:1195; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6152
Published: 2018-12-04
Description: The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-0468
Published: 2018-12-04
Description: A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database. The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations. Users are required to manually change the password, as documented in the Workarounds section of this advisory. There are workarounds that address this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/bid/106124; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181204-ems-sql-passwrd; https://www.tenable.com/security/research/tra-2018-42
CVE: CVE-2018-7956
Published: 2018-12-04
Description: Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions before 4.0.5 that attackers can conduct bruteforce to the VIP App Web Services to get user information.
CVSS Score: 5.3 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en
CVE: CVE-2018-7987
Published: 2018-12-04
Description: There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00). The software does not handle the response message properly when the user doing certain inquiry operation, an attacker could send crafted message to the device, successful exploit could cause a denial of service condition.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181128-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181128-02-smartphone-en
CVE: CVE-2018-5496
Published: 2018-12-04
Description: Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unauthorized user.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-17160
Published: 2018-12-04
Description: In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models provided by bhyve can permit a guest operating system to overwrite memory in the bhyve host possibly permitting arbitrary code execution. A guest OS using a firmware image can cause the bhyve process to crash, or possibly execute arbitrary code on the host as root.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106210; https://security.freebsd.org/advisories/FreeBSD-SA-18:14.bhyve.asc; http://www.securityfocus.com/bid/106210
CVE: CVE-2018-18991
Published: 2018-12-04
Description: Reflected cross-site scripting (non-persistent) in SCADA WebServer (Versions prior to 2.03.0001) could allow an attacker to send a crafted URL that contains JavaScript, which can be reflected off the web application to the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106105; https://ics-cert.us-cert.gov/advisories/ICSA-18-338-02; http://www.securityfocus.com/bid/106105
CVE: CVE-2018-18989
Published: 2018-12-04
Description: In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.securityfocus.com/bid/106106; https://ics-cert.us-cert.gov/advisories/ICSA-18-338-01; http://www.securityfocus.com/bid/106106
CVE: CVE-2018-18993
Published: 2018-12-04
Description: Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior). When processing project files, the application allows input data to exceed the buffer. An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/106106; https://ics-cert.us-cert.gov/advisories/ICSA-18-338-01; http://www.securityfocus.com/bid/106106
CVE: CVE-2018-17939
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the merge request JSON endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51956; https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/
CVE: CVE-2018-17975
Published: 2018-12-04
Description: An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/; https://gitlab.com/gitlab-org/gitlab-ce/issues/50744; https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/
CVE: CVE-2018-17976
Published: 2018-12-04
Description: An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic change descriptions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51581; https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/
CVE: CVE-2018-18640
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through Browser Caching.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51423; https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE: CVE-2018-18641
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of Sensitive Information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-312
References: https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51113; https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE: CVE-2018-18642
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/52551; https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE: CVE-2018-18644
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows Information Exposure via a Gitlab Prometheus integration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/7528; https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE: CVE-2018-18645
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exposure via unsubscribe links in email replies.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/24498; https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE: CVE-2018-18646
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51142; https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE: CVE-2018-18647
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/7538; https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE: CVE-2018-18648
Published: 2018-12-04
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through an Error Message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/50975; https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/
CVE: CVE-2018-18843
Published: 2018-12-04
Description: The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/53158; https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/
CVE: CVE-2018-19786
Published: 2018-12-05
Description: HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.
CVSS Score: 8.1 (HIGH)
CWE: CWE-532
References: https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#100-december-3rd-2018; https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#100-december-3rd-2018
CVE: CVE-2018-19857
Published: 2018-12-05
Description: The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-824
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html
CVE: CVE-2018-19859
Published: 2018-12-05
Description: OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/OpenRefine/OpenRefine/issues/1840; https://github.com/OpenRefine/OpenRefine/pull/1901; https://github.com/OpenRefine/OpenRefine/issues/1840
CVE: CVE-2018-19864
Published: 2018-12-05
Description: NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow), resulting in ability to read camera feeds or reconfigure the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-119
References: http://packetstormsecurity.com/files/153162/NUUO-NVRMini-2-3.9.1-Stack-Overflow.html; https://www.digitaldefense.com/blog/zero-day-alerts/nuuo-firmware-disclosure/; https://www.nuuo.com/DownloadMainpage.php
CVE: CVE-2018-19865
Published: 2018-12-05
Description: A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00085.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00086.html
CVE: CVE-2017-1622
Published: 2018-12-05
Description: IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrectly validates, a certificate. This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-force ID: 133120.
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/133120; https://www.ibm.com/support/docview.wss?uid=ibm10742713; https://exchange.xforce.ibmcloud.com/vulnerabilities/133120
CVE: CVE-2018-1568
Published: 2018-12-05
Description: IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 143118.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10737023; https://exchange.xforce.ibmcloud.com/vulnerabilities/143118; http://www.ibm.com/support/docview.wss?uid=ibm10737023
CVE: CVE-2018-1648
Published: 2018-12-05
Description: IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144653.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=ibm10737027; https://exchange.xforce.ibmcloud.com/vulnerabilities/144653; http://www.ibm.com/support/docview.wss?uid=ibm10737027
CVE: CVE-2018-1650
Published: 2018-12-05
Description: IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the administrator. IBM X-Force ID: 144656.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: http://www.ibm.com/support/docview.wss?uid=ibm10737025; https://exchange.xforce.ibmcloud.com/vulnerabilities/144656; http://www.ibm.com/support/docview.wss?uid=ibm10737025
CVE: CVE-2018-1697
Published: 2018-12-05
Description: IBM Maximo Asset Management 7.6 could allow an authenticated user to enumerate usernames using a specially crafted HTTP request. IBM X-Force ID: 145966.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/145966; https://www.ibm.com/support/docview.wss?uid=ibm10737457; https://exchange.xforce.ibmcloud.com/vulnerabilities/145966
CVE: CVE-2018-1728
Published: 2018-12-05
Description: IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147707.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/147707; https://www.ibm.com/support/docview.wss?uid=ibm10742723; https://exchange.xforce.ibmcloud.com/vulnerabilities/147707
CVE: CVE-2018-1730
Published: 2018-12-05
Description: IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147709.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/147709; https://www.ibm.com/support/docview.wss?uid=ibm10742741&myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E; https://exchange.xforce.ibmcloud.com/vulnerabilities/147709
CVE: CVE-2018-1732
Published: 2018-12-05
Description: IBM QRadar Advisor with Watson 1.14.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 147810.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10736009; https://exchange.xforce.ibmcloud.com/vulnerabilities/147810; http://www.ibm.com/support/docview.wss?uid=ibm10736009
CVE: CVE-2018-1941
Published: 2018-12-05
Description: IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. IBM X-Force ID: 153382.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153382; https://www.ibm.com/support/docview.wss?uid=ibm10743115; https://exchange.xforce.ibmcloud.com/vulnerabilities/153382
CVE: CVE-2018-15773
Published: 2018-12-05
Description: Dell Encryption (formerly Dell Data Protection | Encryption) v10.1.0 and earlier contain an information disclosure vulnerability. A malicious user with physical access to the machine could potentially exploit this vulnerability to access the unencrypted RegBack folder that contains back-ups of sensitive system files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.dell.com/support/article/us/en/04/sln314963/dell-encryption-enterprise-dell-data-protection-encryption-information-disclosure-vulnerability?lang=en; https://www.dell.com/support/article/us/en/04/sln314963/dell-encryption-enterprise-dell-data-protection-encryption-information-disclosure-vulnerability?lang=en
CVE: CVE-2018-15797
Published: 2018-12-05
Description: Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nfsbrokerpush BOSH deploy errand. A remote authenticated user with access to BOSH can obtain the admin credentials for the Cloud Foundry Platform through the logs of the NFS volume deploy errand.
CVSS Score: 8.4 (HIGH)
CWE: CWE-532
References: https://www.cloudfoundry.org/blog/cve-2018-15797; https://www.cloudfoundry.org/blog/cve-2018-15797
CVE: CVE-2018-19876
Published: 2018-12-05
Description: cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid pointer" error.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://bugs.webkit.org/show_bug.cgi?id=191595; https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5; https://bugs.webkit.org/show_bug.cgi?id=191595
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-05
Description: In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/106238; https://github.com/kubernetes/kubernetes/issues/65750; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-05
Description: In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/kubernetes/minikube/issues/3208; https://github.com/kubernetes/minikube/issues/3208
CVE: CVE-2[PII_REDACTED]
Published: 2018-12-05
Description: In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-388
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html; http://www.openwall.com/lists/oss-security/2019/06/28/2; http://www.openwall.com/lists/oss-security/2019/07/06/3
CVE: CVE-2018-12155
Published: 2018-12-05
Description: Data leakage in cryptographic libraries for Intel IPP before 2019 update1 release may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://support.lenovo.com/us/en/solutions/LEN-25662; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00202.html; http://support.lenovo.com/us/en/solutions/LEN-25662
CVE: CVE-2018-19877
Published: 2018-12-05
Description: login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://loganalyzer.adiscon.com/news/loganalyzer-v4-1-7-v4-stable-released/; https://www.exploit-db.com/exploits/45958/; https://loganalyzer.adiscon.com/news/loganalyzer-v4-1-7-v4-stable-released/
CVE: CVE-2018-16791
Published: 2018-12-05
Description: In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://seclists.org/fulldisclosure/2018/Dec/0; https://seclists.org/fulldisclosure/2018/Dec/0