deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-16184
Published: 2019-01-09
Description: RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive Whiteboard Controller Type1 V1.6 to V2.2 attached (D5520, D6500, D6510, D7500, D8400) allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN55263945/index.html; https://www.ricoh.com/info/2018/1127_1.html; https://jvn.jp/en/jp/JVN55263945/index.html
CVE: CVE-2018-16185
Published: 2019-01-09
Description: RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) allows remote attackers to execute a malicious program.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN55263945/index.html; https://www.ricoh.com/info/2018/1127_1.html; https://jvn.jp/en/jp/JVN55263945/index.html
CVE: CVE-2018-16186
Published: 2019-01-09
Description: RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) uses hard-coded credentials, which may allow an attacker on the same network segments to login to the administrators settings screen and change the configuration.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://jvn.jp/en/jp/JVN55263945/index.html; https://www.ricoh.com/info/2018/1127_1.html; https://jvn.jp/en/jp/JVN55263945/index.html
CVE: CVE-2018-16187
Published: 2019-01-09
Description: The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) does not verify its server certificates, which allows man-in-the-middle attackers to eversdrop on encrypted communication.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://jvn.jp/en/jp/JVN55263945/index.html; https://www.ricoh.com/info/2018/1127_1.html; https://jvn.jp/en/jp/JVN55263945/index.html
CVE: CVE-2018-16188
Published: 2019-01-09
Description: SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN55263945/index.html; https://www.ricoh.com/info/2018/1127_1.html; https://jvn.jp/en/jp/JVN55263945/index.html
CVE: CVE-2018-16191
Published: 2019-01-09
Description: Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15, EC-CUBE 3.0.16) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/106545; https://jvn.jp/en/jp/JVN25359688/index.html; https://www.ec-cube.net/info/weakness/20181113/
CVE: CVE-2018-16192
Published: 2019-01-09
Description: Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://jpn.nec.com/security-info/secinfo/nv18-021.html; https://jvn.jp/en/jp/JVN87535892/index.html; https://jpn.nec.com/security-info/secinfo/nv18-021.html
CVE: CVE-2018-16193
Published: 2019-01-09
Description: Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jpn.nec.com/security-info/secinfo/nv18-021.html; https://jvn.jp/en/jp/JVN87535892/index.html; https://jpn.nec.com/security-info/secinfo/nv18-021.html
CVE: CVE-2018-16194
Published: 2019-01-09
Description: Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-021.html; https://jvn.jp/en/jp/JVN87535892/index.html; https://jpn.nec.com/security-info/secinfo/nv18-021.html
CVE: CVE-2018-16195
Published: 2019-01-09
Description: Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands via SOAP interface of UPnP.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-021.html; https://jvn.jp/en/jp/JVN87535892/index.html; https://jpn.nec.com/security-info/secinfo/nv18-021.html
CVE: CVE-2018-16196
Published: 2019-01-09
Description: Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00 - R6.03.10), CENTUM VP Entry Class(R4.01.00 - R6.03.10), Exaopc(R3.10.00 - R3.75.00), PRM(R2.06.00 - R3.31.00), ProSafe-RS(R1.02.00 - R4.02.00), FAST/TOOLS(R9.02.00 - R10.02.00), B/M9000 VP(R6.03.01 - R8.01.90)) allows remote attackers to cause a denial of service attack that may result in stopping Vnet/IP Open Communication Driver's communication via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106442; https://jvn.jp/vu/JVNVU93652047/index.html; https://web-material3.yokogawa.com/YSAR-18-0008-E.pdf
CVE: CVE-2018-16197
Published: 2019-01-09
Description: Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to bypass access restriction to access the information and files stored on the affected device.
CVSS Score: 6.5 (MEDIUM)
References: http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm; https://jvn.jp/en/jp/JVN99810718/index.html; http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm
CVE: CVE-2018-16198
Published: 2019-01-09
Description: Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same network segment to access a non-documented developer screen to perform operations on the affected device.
CVSS Score: 8.8 (HIGH)
References: http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm; https://jvn.jp/en/jp/JVN99810718/index.html; http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm
CVE: CVE-2018-16199
Published: 2019-01-09
Description: Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an remote attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm; https://jvn.jp/en/jp/JVN99810718/index.html; http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm
CVE: CVE-2018-16200
Published: 2019-01-09
Description: Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute arbitrary OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm; https://jvn.jp/en/jp/JVN99810718/index.html; http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm
CVE: CVE-2018-16201
Published: 2019-01-09
Description: Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on the same network segment to login to the administrators settings screen and change the configuration or execute arbitrary OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm; https://jvn.jp/en/jp/JVN99810718/index.html; http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm
CVE: CVE-2018-16202
Published: 2019-01-09
Description: Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN60497148/index.html; https://github.com/ionic-team/cordova-plugin-ionic-webview; https://jvn.jp/en/jp/JVN69812763/index.html
CVE: CVE-2018-16203
Published: 2019-01-09
Description: PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: https://jvn.jp/en/jp/JVN13199224/index.html; https://pgpool.net/mediawiki/index.php/Main_Page; https://jvn.jp/en/jp/JVN13199224/index.html
CVE: CVE-2018-16204
Published: 2019-01-09
Description: Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN27052429/index.html; https://wordpress.org/plugins/google-sitemap-generator/#developers; https://jvn.jp/en/jp/JVN27052429/index.html
CVE: CVE-2018-16205
Published: 2019-01-09
Description: Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN96493183/index.html; https://weseek.co.jp/security/2018/12/25/growi-prevent-xss2/; https://jvn.jp/en/jp/JVN96493183/index.html
CVE: CVE-2018-20681
Published: 2019-01-09
Description: mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By unplugging and re-plugging or power-cycling external output devices (such as additionally attached graphical outputs via HDMI, VGA, DVI, etc.) the content of a screensaver-locked session can be revealed. In some scenarios, the attacker can execute applications, such as by clicking with a mouse.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200
References: https://github.com/mate-desktop/mate-screensaver/issues/152; https://github.com/mate-desktop/mate-screensaver/issues/155; https://github.com/mate-desktop/mate-screensaver/issues/170
CVE: CVE-2018-20682
Published: 2019-01-09
Description: Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-18-032-stored-cross-site-scripting-in-forkcms/; https://www.netsparker.com/web-applications-advisories/ns-18-032-stored-cross-site-scripting-in-forkcms/
CVE: CVE-2019-3498
Published: 2019-01-09
Description: In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: http://www.securityfocus.com/bid/106453; https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21topic/django-announce/VYU7xQQTEPQ
CVE: CVE-2019-5882
Published: 2019-01-09
Description: Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/irssi/irssi/pull/948; https://irssi.org/NEWS/#v1-1-2; https://irssi.org/security/irssi_sa_2019_01.txt
CVE: CVE-2018-0181
Published: 2019-01-10
Description: A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an unauthenticated, remote attacker to modify key-value pairs for short-lived events stored by the Redis server. The vulnerability is due to improper authentication when accessing the Redis server. An unauthenticated attacker could exploit this vulnerability by modifying key-value pairs stored within the Redis server database. An exploit could allow the attacker to reduce the efficiency of the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software.
CVSS Score: 7.3 (HIGH)
CWE: CWE-306, CWE-306
References: http://www.securityfocus.com/bid/106547; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-cps-redis; http://www.securityfocus.com/bid/106547
CVE: CVE-2018-0282
Published: 2019-01-10
Description: A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a state condition between the socket state and the transmission control block (TCB) state. While this vulnerability potentially affects all TCP applications, the only affected application observed so far is the HTTP server. An attacker could exploit this vulnerability by sending specific HTTP requests at a sustained rate to a reachable IP address of the affected software. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition on an affected device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-371
References: http://www.securityfocus.com/bid/106510; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-tcp; http://www.securityfocus.com/bid/106510
CVE: CVE-2018-20683
Published: 2019-01-10
Description: commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://bugs.debian.org/918849; https://github.com/sitaramc/gitolite/blob/master/CHANGELOG; https://github.com/sitaramc/gitolite/commit/5df2b817255ee919991da6c310239e08c8fcc1ae
CVE: CVE-2019-5884
Published: 2019-01-10
Description: php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/Studio-42/elFinder/commit/f133163f2d754584de65d718b2fde[PII_REDACTED]6; https://github.com/Studio-42/elFinder/releases/tag/2.1.45; https://github.com/Studio-42/elFinder/commit/f133163f2d754584de65d718b2fde[PII_REDACTED]6
CVE: CVE-2019-5886
Published: 2019-01-10
Description: An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-667, CWE-862
References: https://github.com/gongfuxiang/shopxo/issues/1; https://github.com/gongfuxiang/shopxo/issues/1
CVE: CVE-2019-5887
Published: 2019-01-10
Description: An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling by the rmdir method. Attackers can delete arbitrary files by using "../" directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/gongfuxiang/shopxo/issues/2; https://github.com/gongfuxiang/shopxo/issues/2
CVE: CVE-2018-4032
Published: 2019-01-10
Description: An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inputs. An attacker with local access could use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful exploit.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0705; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0705
CVE: CVE-2018-4033
Published: 2019-01-10
Description: The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0706; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0706
CVE: CVE-2018-4034
Published: 2019-01-10
Description: The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0707; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0707
CVE: CVE-2018-4035
Published: 2019-01-10
Description: The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0708; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0708
CVE: CVE-2018-4036
Published: 2019-01-10
Description: The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use this vulnerability to modify the running kernel extensions on the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0709; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0709
CVE: CVE-2018-4037
Published: 2019-01-10
Description: The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access can use this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0710; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0710
CVE: CVE-2018-4041
Published: 2019-01-10
Description: An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0715; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0715
CVE: CVE-2018-4042
Published: 2019-01-10
Description: An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0716; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0716
CVE: CVE-2018-4043
Published: 2019-01-10
Description: An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validation. A user with local access can use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful exploit.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0717; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0717
CVE: CVE-2018-4044
Published: 2019-01-10
Description: An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0718; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0718
CVE: CVE-2018-4045
Published: 2019-01-10
Description: An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0719; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0719
CVE: CVE-2018-4046
Published: 2019-01-10
Description: An exploitable denial-of-service vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. A user with local access can use this vulnerability to terminate a privileged helper application. An attacker would need local access to the machine for a successful exploit.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0720; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0720
CVE: CVE-2018-4047
Published: 2019-01-10
Description: An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0721; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0721