deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-12073
Published: 2018-06-17
Description: An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore, it is possible to exploit this issue (e.g., in combination with a successful XSS, or at an unattended workstation) to change the admin password to an attacker-chosen value without knowing the current password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/freetom/2a446a226d0e98807c8b0c1111ef2def; https://gist.github.com/freetom/2a446a226d0e98807c8b0c1111ef2def
CVE: CVE-2018-12104
Published: 2018-06-17
Description: Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/new_report.kp URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104487; https://github.com/airbnb/knowledge-repo/issues/431; http://www.securityfocus.com/bid/104487
CVE: CVE-2018-12522
Published: 2018-06-18
Description: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ provides a directory listing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://pastebin.com/eA5tGKf0; https://www.exploit-db.com/exploits/44910/; https://pastebin.com/eA5tGKf0
CVE: CVE-2018-12523
Published: 2018-06-18
Description: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /etc/ provides a directory listing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://pastebin.com/eA5tGKf0; https://www.exploit-db.com/exploits/44910/; https://pastebin.com/eA5tGKf0
CVE: CVE-2018-12524
Published: 2018-06-18
Description: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provides a directory listing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://pastebin.com/eA5tGKf0; https://www.exploit-db.com/exploits/44910/; https://pastebin.com/eA5tGKf0
CVE: CVE-2018-12525
Published: 2018-06-18
Description: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /images/ provides a directory listing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://pastebin.com/eA5tGKf0; https://www.exploit-db.com/exploits/44910/; https://pastebin.com/eA5tGKf0
CVE: CVE-2018-12532
Published: 2018-06-18
Description: JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917
References: http://seclists.org/fulldisclosure/2020/Mar/21; http://www.securityfocus.com/bid/104503; https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html
CVE: CVE-2018-12533
Published: 2018-06-18
Description: JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917
References: http://seclists.org/fulldisclosure/2020/Mar/21; http://www.securityfocus.com/bid/104502; http://www.securitytracker.com/id/1041617
CVE: CVE-2018-1060
Published: 2018-06-18
Description: python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; http://www.securitytracker.com/id/1042001; https://access.redhat.com/errata/RHBA-2019:0327
CVE: CVE-2018-1090
Published: 2018-06-18
Description: In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://access.redhat.com/errata/RHSA-2018:2927; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1090; https://pulp.plan.io/issues/3521
CVE: CVE-2018-1152
Published: 2018-06-18
Description: libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html; http://www.securityfocus.com/bid/104543
CVE: CVE-2018-1153
Published: 2018-06-18
Description: Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://releases.portswigger.net/2018/06/1734.html; https://www.tenable.com/security/research/tra-2018-18; http://releases.portswigger.net/2018/06/1734.html
CVE: CVE-2018-12530
Published: 2018-06-18
Description: An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/summ3rf/Vulner/blob/master/Metinfo.md; https://github.com/summ3rf/Vulner/blob/master/Metinfo.md
CVE: CVE-2018-12531
Published: 2018-06-18
Description: An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/summ3rf/Vulner/blob/master/Metinfo.md; https://github.com/summ3rf/Vulner/blob/master/Metinfo.md
CVE: CVE-2018-12534
Published: 2018-06-18
Description: A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/quick-chat/#developers; https://wordpress.org/plugins/quick-chat/#developers
CVE: CVE-2015-4664
Published: 2018-06-18
Description: An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html; http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html
CVE: CVE-2018-1333
Published: 2018-06-18
Description: By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securitytracker.com/id/1041402; https://access.redhat.com/errata/RHSA-2018:3558; https://access.redhat.com/errata/RHSA-2019:0366
CVE: CVE-2018-9021
Published: 2018-06-18
Description: An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/155576/Broadcom-CA-Privileged-Access-Manager-2.8.2-Remote-Command-Execution.html; http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html
CVE: CVE-2018-9022
Published: 2018-06-18
Description: An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/155576/Broadcom-CA-Privileged-Access-Manager-2.8.2-Remote-Command-Execution.html; http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html
CVE: CVE-2018-9023
Published: 2018-06-18
Description: An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing specially crafted arguments to the update_crld script.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html; http://www.securityfocus.com/bid/104496
CVE: CVE-2018-9024
Published: 2018-06-18
Description: An improper authentication vulnerability in CA Privileged Access Manager 2.x allows attackers to spoof IP addresses in a log file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html; http://www.securityfocus.com/bid/104496
CVE: CVE-2018-9025
Published: 2018-06-18
Description: An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html; http://www.securityfocus.com/bid/104496
CVE: CVE-2018-9026
Published: 2018-06-18
Description: A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html; http://www.securityfocus.com/bid/104496
CVE: CVE-2018-9027
Published: 2018-06-18
Description: A reflected cross-site scripting vulnerability in CA Privileged Access Manager 2.x allows remote attackers to execute malicious script with a specially crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html; http://www.securityfocus.com/bid/104496
CVE: CVE-2018-9028
Published: 2018-06-18
Description: Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html; http://www.securityfocus.com/bid/104496
CVE: CVE-2018-9029
Published: 2018-06-18
Description: An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/104496; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html; http://www.securityfocus.com/bid/104496
CVE: CVE-2018-10617
Published: 2018-06-18
Description: Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length heap buffer where a value larger than the buffer can be read from a .dpa file into the buffer, causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-119
References: http://www.securityfocus.com/bid/104375; https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01; http://www.securityfocus.com/bid/104375
CVE: CVE-2018-10621
Published: 2018-06-18
Description: Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length stack buffer where a value larger than the buffer can be read from a .dpa file into the buffer, causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/104375; https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01; http://www.securityfocus.com/bid/104375
CVE: CVE-2018-10623
Published: 2018-06-18
Description: Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the position can be determined by a value read from a .dpa file. This may cause improper restriction of operations within the bounds of the memory buffer, allow remote code execution, alter the intended control flow, allow reading of sensitive information, or cause the application to crash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://www.securityfocus.com/bid/104375; https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01; http://www.securityfocus.com/bid/104375
CVE: CVE-2018-12557
Published: 2018-06-19
Description: An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://lists.zuul-ci.org/pipermail/zuul-announce/2018-June/000015.html; https://git.zuul-ci.org/cgit/zuul/commit/?id=ffe7278c08e6e36bf8b18f732c764e00ff51551e; https://storyboard.openstack.org/#%21/story/2002177
CVE: CVE-2018-12559
Published: 2018-06-19
Description: An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequences such as a home/../usr substring.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2018/06/18/1; https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3; http://www.openwall.com/lists/oss-security/2018/06/18/1
CVE: CVE-2018-12560
Published: 2018-06-19
Description: An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2018/06/18/1; http://www.openwall.com/lists/oss-security/2018/06/18/1
CVE: CVE-2018-12561
Published: 2018-06-19
Description: An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2018/06/18/1; https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3; http://www.openwall.com/lists/oss-security/2018/06/18/1
CVE: CVE-2018-12562
Published: 2018-06-19
Description: An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2018/06/18/1; https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3; http://www.openwall.com/lists/oss-security/2018/06/18/1
CVE: CVE-2018-12563
Published: 2018-06-19
Description: An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://git.linaro.org/lava/lava.git/commit/?id=e24ec39599bc07562ad8bc2a581144b8448cb214; https://git.linaro.org/lava/lava.git/commit/?id=e24ec39599bc07562ad8bc2a581144b8448cb214
CVE: CVE-2018-12564
Published: 2018-06-19
Description: An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for URLs in the submit page, a user can forge an HTTP request that will force lava-server-gunicorn to return any file on the server that is readable by lavaserver and valid yaml.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://git.linaro.org/lava/lava.git/commit/?id=95a9a77b144ced24d7425d6544ab03ca7f6c75d3; https://lists.debian.org/debian-lts-announce/2018/06/msg00011.html; https://www.debian.org/security/2018/dsa-4234
CVE: CVE-2018-12565
Published: 2018-06-19
Description: An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data, remote code execution can occur.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://git.linaro.org/lava/lava.git/commit/?id=583666c84ea2f12797a3eb71392bcb05782f5b14; https://www.debian.org/security/2018/dsa-4234; https://git.linaro.org/lava/lava.git/commit/?id=583666c84ea2f12797a3eb71392bcb05782f5b14
CVE: CVE-2018-1061
Published: 2018-06-19
Description: python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; http://www.securitytracker.com/id/1042001; https://access.redhat.com/errata/RHBA-2019:0327
CVE: CVE-2018-1073
Published: 2018-06-19
Description: The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-200
References: http://www.securityfocus.com/bid/104189; https://access.redhat.com/errata/RHSA-2018:1525; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1073
CVE: CVE-2018-12578
Published: 2018-06-19
Description: There is a heap-based buffer overflow in bmp_compress1_row in appliers.cpp in sam2p 0.49.4 that leads to a denial of service or possibly unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/pts/sam2p/issues/39; https://lists.debian.org/debian-lts-announce/2018/08/msg00010.html; https://github.com/pts/sam2p/issues/39
CVE: CVE-2018-12580
Published: 2018-06-19
Description: library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session['user_agent'] in the "Login Sessions" feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.dragonbyte-tech.com/threads/security-bulletin-low-vbsecurity-for-vbulletin-3-vbulletin-4-partial-xss.22534/; https://www.dragonbyte-tech.com/threads/security-bulletin-low-vbsecurity-for-vbulletin-3-vbulletin-4-partial-xss.22534/
CVE: CVE-2018-12582
Published: 2018-06-19
Description: An issue was discovered in AKCMS 6.1. CSRF can add an admin account via a /index.php?file=account&action=manageaccounts&job=newaccount URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/chenrui1896/issue/blob/master/add_admin; https://github.com/p8w/akcms/issues/1; https://github.com/chenrui1896/issue/blob/master/add_admin
CVE: CVE-2018-12583
Published: 2018-06-19
Description: An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/chenrui1896/issue/blob/master/del_article; https://github.com/p8w/akcms/issues/2; https://github.com/chenrui1896/issue/blob/master/del_article
CVE: CVE-2015-4043
Published: 2018-06-19
Description: SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogin.aspx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://labs.asteriskinfosec.com.au/cve/ConnX_ESP_HR.pdf; https://labs.asteriskinfosec.com.au/cve/ConnX_ESP_HR.pdf
CVE: CVE-2018-11525
Published: 2018-06-19
Description: The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://wordpress.org/plugins/woo-order-export-lite/#developers; https://wpvulndb.com/vulnerabilities/9096; https://www.exploit-db.com/exploits/44931/
CVE: CVE-2018-11526
Published: 2018-06-19
Description: The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://wordpress.org/plugins/comments-import-export-woocommerce/#developers; https://wpvulndb.com/vulnerabilities/9097; https://www.exploit-db.com/exploits/44940/
CVE: CVE-2018-11537
Published: 2018-06-19
Description: Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://auth0.com/docs/security/bulletins/cve-2018-11537; https://auth0.com/docs/security/bulletins/cve-2018-11537
CVE: CVE-2018-6210
Published: 2018-06-19
Description: D-Link DIR-620 devices, with a certain Rostelekom variant of firmware 1.0.37, have a hardcoded rostel account, which makes it easier for remote attackers to obtain access via a TELNET session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://securelist.com/backdoors-in-d-links-backyard/85530/; https://securelist.com/backdoors-in-d-links-backyard/85530/
CVE: CVE-2018-8727
Published: 2018-06-19
Description: Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows an attacker to traverse the file system to access files or directories via the Web Client webserver.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.onvio.nl/nieuws/cve-mirasys-vulnerability; https://www.onvio.nl/nieuws/cve-mirasys-vulnerability
CVE: CVE-2018-10811
Published: 2018-06-19
Description: strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-909
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html
CVE: CVE-2018-10945
Published: 2018-06-19
Description: The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash, or NULL pointer dereference) via an HTTP request, related to the mbuf_insert function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-476
References: http://blog.hac425.top/2018/05/16/CVE-2018-10945-mongoose.html; http://blog.hac425.top/2018/05/16/CVE-2018-10945-mongoose.html