deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9585
Published: 2018-03-09
Description: Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacker could exploit this vulnerability resulting in a denial of service attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/94932; https://bugzilla.redhat.com/show_bug.cgi?id=1404528; http://www.securityfocus.com/bid/94932
CVE: CVE-2018-1071
Published: 2018-03-09
Description: zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/103359; https://access.redhat.com/errata/RHSA-2018:3073; https://bugzilla.redhat.com/show_bug.cgi?id=1553531
CVE: CVE-2018-6916
Published: 2018-03-09
Description: In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p7, 10.4-STABLE, 10.4-RELEASE-p7, and 10.3-RELEASE-p28, the kernel does not properly validate IPsec packets coming from a trusted host. Additionally, a use-after-free vulnerability exists in the IPsec AH handling code. This issue could cause a system crash or other unpredictable results.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securitytracker.com/id/1040460; https://www.freebsd.org/security/advisories/FreeBSD-SA-18:01.ipsec.asc; http://www.securitytracker.com/id/1040460
CVE: CVE-2018-7894
Published: 2018-03-09
Description: Eramba e1.0.6.033 has Reflected XSS in reviews/filterIndex/ThirdPartyRiskReview via the advanced_filter parameter (aka the Search Parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/stolabs/security-issues-on-eramba-cf887bc0a069; https://medium.com/stolabs/security-issues-on-eramba-cf887bc0a069
CVE: CVE-2018-7995
Published: 2018-03-09
Description: Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory. NOTE: a third party has indicated that this report is not security relevant
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://www.securityfocus.com/bid/103356; https://bugzilla.suse.com/show_bug.cgi?id=1084755; https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=b3b7c4795ccab5be71f080774c45bbbcc75c2aaf
CVE: CVE-2017-10852
Published: 2018-03-09
Description: Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://corega.jp/support/security/20180309_wgr1200.htm; https://jvn.jp/en/jp/JVN15201064/index.html; http://corega.jp/support/security/20180309_wgr1200.htm
CVE: CVE-2017-10853
Published: 2018-03-09
Description: Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://corega.jp/support/security/20180309_wgr1200.htm; https://jvn.jp/en/jp/JVN15201064/index.html; http://corega.jp/support/security/20180309_wgr1200.htm
CVE: CVE-2017-10854
Published: 2018-03-09
Description: Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to bypass authentication and change the login password via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: http://corega.jp/support/security/20180309_wgr1200.htm; https://jvn.jp/en/jp/JVN15201064/index.html; http://corega.jp/support/security/20180309_wgr1200.htm
CVE: CVE-2018-0521
Published: 2018-03-09
Description: Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: http://buffalo.jp/support_s/s20180223.html; https://jvn.jp/en/jp/JVN97144273/index.html; http://buffalo.jp/support_s/s20180223.html
CVE: CVE-2018-0522
Published: 2018-03-09
Description: Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://buffalo.jp/support_s/s20180223.html; https://jvn.jp/en/jp/JVN97144273/index.html; http://buffalo.jp/support_s/s20180223.html
CVE: CVE-2018-0523
Published: 2018-03-09
Description: Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://buffalo.jp/support_s/s20180223.html; https://jvn.jp/en/jp/JVN97144273/index.html; http://buffalo.jp/support_s/s20180223.html
CVE: CVE-2018-0524
Published: 2018-03-09
Description: Jubatus 1.0.2 and earlier allows remote code execution via unspecified vectors.
CVSS Score: 7.3 (HIGH)
References: https://github.com/jubatus/jubatus/blob/master/ChangeLog.rst; https://jvn.jp/en/jp/JVN56132776/index.html; https://github.com/jubatus/jubatus/blob/master/ChangeLog.rst
CVE: CVE-2018-0525
Published: 2018-03-09
Description: Directory traversal vulnerability in Jubatus 1.0.2 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/jubatus/jubatus/blob/master/ChangeLog.rst; https://jvn.jp/en/jp/JVN56132776/index.html; https://github.com/jubatus/jubatus/blob/master/ChangeLog.rst
CVE: CVE-2018-0543
Published: 2018-03-09
Description: Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://woodybells.com/jtrim.html; https://jvn.jp/en/jp/JVN71816327/index.html; http://woodybells.com/jtrim.html
CVE: CVE-2018-0544
Published: 2018-03-09
Description: Untrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://woodybells.com/winshot.html; https://jvn.jp/en/jp/JVN01837169/index.html; http://woodybells.com/winshot.html
CVE: CVE-2018-0546
Published: 2018-03-09
Description: Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN33527174/index.html; https://plugins.trac.wordpress.org/changeset/1742744/; https://wordpress.org/plugins/wp-all-import/#developers
CVE: CVE-2018-0547
Published: 2018-03-09
Description: Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN60032768/index.html; https://plugins.trac.wordpress.org/changeset/1827741/; https://wordpress.org/plugins/wp-all-import/#developers
CVE: CVE-2018-7996
Published: 2018-03-09
Description: Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/stolabs/security-issues-on-eramba-cf887bc0a069; https://medium.com/stolabs/security-issues-on-eramba-cf887bc0a069
CVE: CVE-2018-7997
Published: 2018-03-09
Description: Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI, with a CSV file polluted with malicious JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/stolabs/security-issues-on-eramba-cf887bc0a069; https://medium.com/stolabs/security-issues-on-eramba-cf887bc0a069
CVE: CVE-2017-17145
Published: 2018-03-09
Description: Huawei Honor V9 Play smart phones with the versions before Jimmy-AL00AC00B135 have an authentication bypass vulnerability due to the improper design of a component. An attacker who get a user's smart phone can execute specific operation, and delete the fingerprint of the phone without authentication.
CVSS Score: 4.6 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171213-03-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171213-03-smartphone-en
CVE: CVE-2017-17146
Published: 2018-03-09
Description: Huawei DP300 V500R002C00 have a buffer overflow vulnerability due to the lack of validation. An authenticated local attacker can craft specific XML files to the affected products and parse this file, which result in DoS attacks or remote code execution on the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en
CVE: CVE-2017-17147
Published: 2018-03-09
Description: Huawei DP300 V500R002C00 have an integer overflow vulnerability due to the lack of validation. An authenticated local attacker can craft specific XML files to the affected products and parse this file, which result in DoS attacks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en
CVE: CVE-2017-17148
Published: 2018-03-09
Description: Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called. An authenticated local attacker can craft specific XML files to the affected products and parse this file, which result in DoS attacks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en
CVE: CVE-2017-17149
Published: 2018-03-09
Description: Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerability. It needs to verify the user's Huawei ID during lock pattern change. An attacker with root privilege who gets a user's smart phone may bypass Huawei ID verification by special operation. Successful exploit of this vulnerability can allow an attacker to change the lock pattern of HiWallet.
CVSS Score: 3.9 (LOW)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-hiwallet-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-hiwallet-en
CVE: CVE-2017-17150
Published: 2018-03-09
Description: Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter, which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to launch DOS attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en
CVE: CVE-2017-17167
Published: 2018-03-09
Description: Huawei DP300 V500R002C00; TP3206 V100R002C00; ViewPoint 9030 V100R011C02; V100R011C03 have a use of a broken or risky cryptographic algorithm vulnerability. The software uses risky cryptographic algorithm in SSL. This is dangerous because a remote unauthenticated attacker could use well-known techniques to break the algorithm. Successful exploit could result in the exposure of sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-ssl-en; http://www.securityfocus.com/bid/103513; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-ssl-en
CVE: CVE-2017-17168
Published: 2018-03-09
Description: The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. An authenticated remote attacker could send a malicious message to a target system. Successful exploit could allow the attacker to tamper with business and make the system abnormal. Affected Huawei Products are: DP300 versions V500R002C00, V500R002C00B010, V500R002C00B011, V500R002C00B012, V500R002C00B013, V500R002C00B014, V500R002C00B017, V500R002C00B018, V500R002C00SPC100, V500R002C00SPC200, V500R002C00SPC300, V500R002C00SPC400, V500R002C00SPC500, V500R002C00SPC600, V500R002C00SPC800, V500R002C00SPC900, V500R002C00SPCa00; RP200 versions V500R002C00SPC200, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE30 versions V100R001C10SPC300, V100R001C10SPC500, V100R001C10SPC600, V100R001C10SPC700B010, V500R002C00SPC200, V500R002C00SPC500, V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC900, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE40 versions V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC900, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE50 versions V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE60 versions V100R001C10, V100R001C10B001, V100R001C10B002, V100R001C10B010, V100R001C10B011, V100R001C10B012, V100R001C10B013, V100R001C10B014, V100R001C10B016, V100R001C10B017, V100R001C10B018, V100R001C10B019, V100R001C10SPC400, V100R001C10SPC500, V100R001C10SPC600, V100R001C10SPC700, V100R001C10SPC800B011, V100R001C10SPC900, V500R002C00, V500R002C00B010, V500R002C00B011, V500R002C00SPC100, V500R002C00SPC200, V500R002C00SPC300, V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC800, V500R002C00SPC900, V500R002C00SPCa00, V500R002C00SPCb00, V500R002C00SPCd00, V500R002C00SPCe00, V600R006C00, V600R006C00SPC100, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; eSpace U1981 version V200R003C20SPC900.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-cidam-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-cidam-en
CVE: CVE-2017-17169
Published: 2018-03-09
Description: The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. An authenticated remote attacker could send a malicious message to a target system. Successful exploit could allow the attacker to tamper with business and make the system abnormal. Affected Huawei Products are: DP300 versions V500R002C00, V500R002C00B010, V500R002C00B011, V500R002C00B012, V500R002C00B013, V500R002C00B014, V500R002C00B017, V500R002C00B018, V500R002C00SPC100, V500R002C00SPC200, V500R002C00SPC300, V500R002C00SPC400, V500R002C00SPC500, V500R002C00SPC600, V500R002C00SPC800, V500R002C00SPC900, V500R002C00SPCa00; RP200 versions V500R002C00SPC200, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE30 versions V100R001C10SPC300, V100R001C10SPC500, V100R001C10SPC600, V100R001C10SPC700B010, V500R002C00SPC200, V500R002C00SPC500, V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC900, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE40 versions V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC900, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE50 versions V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE60 versions V100R001C10, V100R001C10B001, V100R001C10B002, V100R001C10B010, V100R001C10B011, V100R001C10B012, V100R001C10B013, V100R001C10B014, V100R001C10B016, V100R001C10B017, V100R001C10B018, V100R001C10B019, V100R001C10SPC400, V100R001C10SPC500, V100R001C10SPC600, V100R001C10SPC700, V100R001C10SPC800B011, V100R001C10SPC900, V500R002C00, V500R002C00B010, V500R002C00B011, V500R002C00SPC100, V500R002C00SPC200, V500R002C00SPC300, V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC800, V500R002C00SPC900, V500R002C00SPCa00, V500R002C00SPCb00, V500R002C00SPCd00, V500R002C00SPCe00, V600R006C00, V600R006C00SPC100, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; eSpace U1981 version V200R003C20SPC900.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-cidam-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-cidam-en
CVE: CVE-2017-17170
Published: 2018-03-09
Description: The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. An authenticated remote attacker could send a malicious message to a target system. Successful exploit could allow the attacker to tamper with business and make the system abnormal. Affected Huawei Products are: DP300 versions V500R002C00, V500R002C00B010, V500R002C00B011, V500R002C00B012, V500R002C00B013, V500R002C00B014, V500R002C00B017, V500R002C00B018, V500R002C00SPC100, V500R002C00SPC200, V500R002C00SPC300, V500R002C00SPC400, V500R002C00SPC500, V500R002C00SPC600, V500R002C00SPC800, V500R002C00SPC900, V500R002C00SPCa00; RP200 versions V500R002C00SPC200, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE30 versions V100R001C10SPC300, V100R001C10SPC500, V100R001C10SPC600, V100R001C10SPC700B010, V500R002C00SPC200, V500R002C00SPC500, V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC900, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE40 versions V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC900, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE50 versions V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPCb00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; TE60 versions V100R001C10, V100R001C10B001, V100R001C10B002, V100R001C10B010, V100R001C10B011, V100R001C10B012, V100R001C10B013, V100R001C10B014, V100R001C10B016, V100R001C10B017, V100R001C10B018, V100R001C10B019, V100R001C10SPC400, V100R001C10SPC500, V100R001C10SPC600, V100R001C10SPC700, V100R001C10SPC800B011, V100R001C10SPC900, V500R002C00, V500R002C00B010, V500R002C00B011, V500R002C00SPC100, V500R002C00SPC200, V500R002C00SPC300, V500R002C00SPC600, V500R002C00SPC700, V500R002C00SPC800, V500R002C00SPC900, V500R002C00SPCa00, V500R002C00SPCb00, V500R002C00SPCd00, V500R002C00SPCe00, V600R006C00, V600R006C00SPC100, V600R006C00SPC200, V600R006C00SPC300, V600R006C00SPC400, V600R006C00SPC500; eSpace U1981 version V200R003C20SPC900.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-cidam-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-cidam-en
CVE: CVE-2017-17199
Published: 2018-03-09
Description: Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an out-of-bounds read vulnerability due to the improper processing of malformed H323 messages. A remote attacker that controls a server could exploit this vulnerability by sending malformed H323 reply messages to a target device. Successful exploit could make the device read out of bounds and probably make a service unavailable.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-03-h323-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-03-h323-en
CVE: CVE-2017-17200
Published: 2018-03-09
Description: Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an out-of-bounds read vulnerability due to the improper processing of malformed H323 messages. A remote attacker that controls a server could exploit this vulnerability by sending malformed H323 reply messages to a target device. Successful exploit could make the device read out of bounds and probably make a service unavailable.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-03-h323-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-03-h323-en
CVE: CVE-2017-17216
Published: 2018-03-09
Description: Media Gateway Control Protocol (MGCP) in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an out-of-bounds read vulnerability. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may cause process reboot.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180124-01-mgcp-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180124-01-mgcp-en
CVE: CVE-2017-17217
Published: 2018-03-09
Description: Media Gateway Control Protocol (MGCP) in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an out-of-bounds write vulnerability. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may impact availability of product service.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180124-01-mgcp-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180124-01-mgcp-en
CVE: CVE-2017-17218
Published: 2018-03-09
Description: SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an out-of-bounds read vulnerability. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may impact availability of product service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-01-sccpx-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-01-sccpx-en
CVE: CVE-2017-17219
Published: 2018-03-09
Description: SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 has an invalid memory access vulnerabilities. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may impact availability of product service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-01-sccpx-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-01-sccpx-en