deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5710
Published: 2018-01-16
Description: An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29; https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29
CVE: CVE-2018-5711
Published: 2018-01-16
Description: gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-681, CWE-835
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; https://access.redhat.com/errata/RHSA-2018:1296
CVE: CVE-2018-5712
Published: 2018-01-16
Description: An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/102742
CVE: CVE-2018-5706
Published: 2018-01-16
Description: An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permissions even if they didn't have them, as demonstrated by use of the RoleEdit or TeamEdit permission.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/OctopusDeploy/Issues/issues/4167; https://github.com/OctopusDeploy/Issues/issues/4167
CVE: CVE-2017-11072
Published: 2018-01-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while calculating CRC for GPT header fields with partition entries greater than 16384 buffer overflow occurs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2018-01-01
CVE: CVE-2014-6027
Published: 2018-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in TorrentFlux 2.4 allow (1) remote attackers to inject arbitrary web script or HTML by leveraging failure to encode file contents when downloading a torrent file or (2) remote authenticated users to inject arbitrary web script or HTML via vectors involving a link to torrent details.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/09/02/3; http://www.securitytracker.com/id/1030791; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759574
CVE: CVE-2014-6071
Published: 2018-01-16
Description: jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Sep/10; https://bugzilla.redhat.com/show_bug.cgi?id=1136683; https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
CVE: CVE-2014-9482
Published: 2018-01-16
Description: Use-after-free vulnerability in dwarfdump in libdwarf 20130126 through 20140805 might allow remote attackers to cause a denial of service (program crash) via a crafted ELF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2014/12/31/3; http://www.openwall.com/lists/oss-security/2015/01/03/14; http://www.securityfocus.com/bid/71839
CVE: CVE-2014-9485
Published: 2018-01-16
Description: Directory traversal vulnerability in the do_extract_currentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2014/12/31/11; http://www.openwall.com/lists/oss-security/2015/01/03/16; http://www.openwall.com/lists/oss-security/2024/01/24/10
CVE: CVE-2015-7474
Published: 2018-01-16
Description: Cross-site scripting (XSS) vulnerability in Jazz Foundation in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108501.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983720; https://exchange.xforce.ibmcloud.com/vulnerabilities/108501; http://www-01.ibm.com/support/docview.wss?uid=swg21983720
CVE: CVE-2015-7484
Published: 2018-01-16
Description: IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated users with access to lifecycle projects to obtain sensitive information by sending a crafted URL to the Lifecycle Query Engine. IBM X-Force ID: 108619.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983720; https://exchange.xforce.ibmcloud.com/vulnerabilities/108619; http://www-01.ibm.com/support/docview.wss?uid=swg21983720
CVE: CVE-2015-7485
Published: 2018-01-16
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108626.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983720; https://exchange.xforce.ibmcloud.com/vulnerabilities/108626; http://www-01.ibm.com/support/docview.wss?uid=swg21983720
CVE: CVE-2015-7486
Published: 2018-01-16
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108633.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983720; https://exchange.xforce.ibmcloud.com/vulnerabilities/108633; http://www-01.ibm.com/support/docview.wss?uid=swg21983720
CVE: CVE-2016-0207
Published: 2018-01-16
Description: IBM Algorithmics One-Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. IBM X-Force ID: 109399.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21981322; https://exchange.xforce.ibmcloud.com/vulnerabilities/109399; http://www-01.ibm.com/support/docview.wss?uid=swg21981322
CVE: CVE-2016-0215
Published: 2018-01-16
Description: IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21979986; http://www-01.ibm.com/support/docview.wss?uid=swg21979986
CVE: CVE-2016-0219
Published: 2018-01-16
Description: XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www-01.ibm.com/support/docview.wss?uid=swg21983720; https://exchange.xforce.ibmcloud.com/vulnerabilities/109693; http://www-01.ibm.com/support/docview.wss?uid=swg21983720
CVE: CVE-2017-16549
Published: 2018-01-16
Description: K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/Knowledgebase/Article/View/173/41/advisory-issued-on-6th-november-2017; https://support.k7computing.com/index.php?/Knowledgebase/Article/View/173/41/advisory-issued-on-6th-november-2017
CVE: CVE-2017-16550
Published: 2018-01-16
Description: K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls.
CVSS Score: 7.8 (HIGH)
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017
CVE: CVE-2017-16551
Published: 2018-01-16
Description: K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017
CVE: CVE-2017-16552
Published: 2018-01-16
Description: K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017
CVE: CVE-2017-16553
Published: 2018-01-16
Description: K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017
CVE: CVE-2017-16554
Published: 2018-01-16
Description: K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017
CVE: CVE-2017-16555
Published: 2018-01-16
Description: K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017
CVE: CVE-2017-16556
Published: 2018-01-16
Description: In K7 Antivirus Premium before 15.1.0.53, user-controlled input can be used to allow local users to write to arbitrary memory locations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.k7computing.com/index.php?/selfhelp/view-article/2nd-Advisory-issued-on-6th-November-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/2nd-Advisory-issued-on-6th-November-2017
CVE: CVE-2017-16557
Published: 2018-01-16
Description: K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017
CVE: CVE-2017-17429
Published: 2018-01-16
Description: In K7 Antivirus Premium before 15.1.0.53, user-controlled input to the K7Sentry device is not sufficiently authenticated: a local user with a LOW integrity process can access a raw hard disk by sending a specific IOCTL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-5th-December-2017; https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-5th-December-2017
CVE: CVE-2017-8802
Published: 2018-01-16
Description: Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/541661/100/0/threaded; https://bugzilla.zimbra.com/show_bug.cgi?id=107925; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2018-5330
Published: 2018-01-16
Description: ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (router unreachable/unresponsive) via a flood of fragmented UDP packets.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/145863/ZyXEL-P-660HW-UDP-Denial-Of-Service.html; http://packetstormsecurity.com/files/145863/ZyXEL-P-660HW-UDP-Denial-Of-Service.html
CVE: CVE-2018-5370
Published: 2018-01-16
Description: BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/145872/Xnami-Image-Sharing-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/43535/; http://packetstormsecurity.com/files/145872/Xnami-Image-Sharing-1.0-Cross-Site-Scripting.html
CVE: CVE-2018-5713
Published: 2018-01-16
Description: In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002010.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/whiteHat001/DRIVER_POC/tree/master/malwarefox/0x80002010; https://github.com/whiteHat001/DRIVER_POC/tree/master/malwarefox/0x80002010
CVE: CVE-2018-5714
Published: 2018-01-16
Description: In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/whiteHat001/DRIVER_POC/tree/master/malwarefox/0x80002054; https://github.com/whiteHat001/DRIVER_POC/tree/master/malwarefox/0x80002054
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-16
Description: In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://seclists.org/oss-sec/2018/q1/51; http://www.securityfocus.com/bid/104606; https://access.redhat.com/errata/RHSA-2018:0654
CVE: CVE-2018-5715
Published: 2018-01-16
Description: phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://m4k4br0.github.io/sugarcrm-xss/; https://www.exploit-db.com/exploits/43683/; https://m4k4br0.github.io/sugarcrm-xss/
CVE: CVE-2017-17947
Published: 2018-01-16
Description: A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL parameters not being sanitized. Exploitation does require the user to be logged in as administrator; the issue is not applicable to the end user portal.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43018; http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43018
CVE: CVE-2018-5299
Published: 2018-01-16
Description: A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4, leading to memory corruption and possibly remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43604; http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43604
CVE: CVE-2018-5723
Published: 2018-01-16
Description: MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://syrion.me/blog/master-ipcam/; https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html; https://www.exploit-db.com/exploits/43693/
CVE: CVE-2018-5724
Published: 2018-01-16
Description: MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://syrion.me/blog/master-ipcam/; https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html; https://www.exploit-db.com/exploits/43693/
CVE: CVE-2018-5725
Published: 2018-01-16
Description: MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Change, as demonstrated by the port number of the web server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://syrion.me/blog/master-ipcam/; https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html; https://www.exploit-db.com/exploits/43693/
CVE: CVE-2018-5726
Published: 2018-01-16
Description: MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request, as demonstrated by the username, password, and configuration settings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://syrion.me/blog/master-ipcam/; https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html; https://www.exploit-db.com/exploits/43693/
CVE: CVE-2018-5727
Published: 2018-01-16
Description: In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/uclouvain/openjpeg/issues/1053; https://github.com/uclouvain/openjpeg/issues/1053
CVE: CVE-2018-5728
Published: 2018-01-16
Description: Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated by the Latitude/Longitude of the ship, or satellite details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-donde-esta-mi-barco.html; http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-donde-esta-mi-barco.html
CVE: CVE-2018-5721
Published: 2018-01-17
Description: Stack-based buffer overflow in the ej_update_variables function in router/httpd/web.c on ASUS routers (when using software from https://github.com/RMerl/asuswrt-merlin) allows web authenticated attackers to execute code via a request that updates a setting. In ej_update_variables, the length of the variable action_script is not checked, as long as it includes a "_wan_if" substring.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.w0lfzhang.com/2018/01/17/ASUS-router-stack-overflow-in-http-server/; http://www.w0lfzhang.com/2018/01/17/ASUS-router-stack-overflow-in-http-server/
CVE: CVE-2017-16865
Published: 2018-01-17
Description: The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF). When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access credentials and other potentially confidential information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://jira.atlassian.com/browse/JRASERVER-66642; https://jira.atlassian.com/browse/JRASERVER-66642
CVE: CVE-2018-5195
Published: 2018-01-17
Description: Hancom NEO versions 9.6.1.5183 and earlier have a buffer Overflow vulnerability that leads remote attackers to execute arbitrary commands when performing the hyperlink Attributes in document.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://help.hancom.com/cve/hoffice/en-US/CVE_en_050_01.htm; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=26983; http://help.hancom.com/cve/hoffice/en-US/CVE_en_050_01.htm
CVE: CVE-2018-5258
Published: 2018-01-17
Description: The Neon app 1.6.14 iOS does not verify X.509 certificates from SSL servers, which allows remote attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://gist.github.com/rlaneth/d2203c206d5d5acbdaf6069e78b1d07f; https://radialle.com/cve-2018-5258-writeup-aplicativo-do-banco-neon-para-ios-n%C3%A3o-valida-certificados-ssl-84bed0b0cecb; https://www.tecmundo.com.br/seguranca/126192-banco-neon-falha-permite-hacker-acesse-conta-roube-dados-clientes.htm
CVE: CVE-2018-5747
Published: 2018-01-17
Description: In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/ckolivas/lrzip/issues/90; https://lists.debian.org/debian-lts-announce/2021/08/msg00001.html; https://github.com/ckolivas/lrzip/issues/90
CVE: CVE-2018-5764
Published: 2018-01-17
Description: The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/102803; http://www.securitytracker.com/id/1040276; https://download.samba.org/pub/rsync/src-previews/rsync-3.1.3pre1-NEWS
CVE: CVE-2017-5696
Published: 2018-01-18
Description: Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00080&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00080&languageid=en-fr