deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6015
Published: 2018-05-11
Description: Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code with elevated privileges on the system. CVSS v3 base score: 8.8, CVSS vector string: (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Rockwell Automation has released a new version of FactoryTalk Activation, Version 4.01, which addresses the identified vulnerability. Rockwell Automation recommends upgrading to the latest version of FactoryTalk Activation, Version 4.01 or later.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-74
References: http://www.securityfocus.com/bid/96996; https://ics-cert.us-cert.gov/advisories/ICSA-17-047-02; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/939382
CVE: CVE-2018-10580
Published: 2018-05-11
Description: The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/147575/MyBB-Latest-Posts-On-Profile-1.1-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/44608/; http://packetstormsecurity.com/files/147575/MyBB-Latest-Posts-On-Profile-1.1-Cross-Site-Scripting.html
CVE: CVE-2018-7248
Published: 2018-05-11
Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it does not.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/104287; https://gitlab.com/e-sterling/cve-2018-7248; https://medium.com/%40esterling_/cve-2018-7248-enumerating-active-directory-users-via-unauthenticated-manageengine-servicedesk-a1eda2942eb0
CVE: CVE-2009-5150
Published: 2018-05-11
Description: Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication with a web site other than the intended search.namequery.com site by modifying data within a disk's inter-partition space. This allows a privileged local user to execute arbitrary code even after that user loses access and all disk partitions are reformatted.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.coresecurity.com/system/files/publications/2016/05/Paper-Deactivate-the-Rootkit-AOrtega-ASacco.pdf; https://www.coresecurity.com/system/files/publications/2016/05/Paper-Deactivate-the-Rootkit-AOrtega-ASacco.pdf
CVE: CVE-2009-5151
Published: 2018-05-11
Description: The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior, independent of later disk changes.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://www.coresecurity.com/system/files/publications/2016/05/Paper-Deactivate-the-Rootkit-AOrtega-ASacco.pdf; https://www.coresecurity.com/system/files/publications/2016/05/Paper-Deactivate-the-Rootkit-AOrtega-ASacco.pdf
CVE: CVE-2009-5152
Published: 2018-05-11
Description: Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility (DCCU), which allows privileged local users to change Computrace Agent's activation/deactivation status to the factory default via a crafted TaskResult.xml file.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-362
References: https://www.coresecurity.com/system/files/publications/2016/05/Paper-Deactivate-the-Rootkit-AOrtega-ASacco.pdf; https://www.coresecurity.com/system/files/publications/2016/05/Paper-Deactivate-the-Rootkit-AOrtega-ASacco.pdf
CVE: CVE-2018-1257
Published: 2018-05-11
Description: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/104260; https://access.redhat.com/errata/RHSA-2018:1809
CVE: CVE-2018-1258
Published: 2018-05-11
Description: Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/104222
CVE: CVE-2018-1259
Published: 2018-05-11
Description: Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://access.redhat.com/errata/RHSA-2018:1809; https://access.redhat.com/errata/RHSA-2018:3768; https://pivotal.io/security/cve-2018-1259
CVE: CVE-2018-1260
Published: 2018-05-11
Description: Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/104158; https://access.redhat.com/errata/RHSA-2018:1809; https://access.redhat.com/errata/RHSA-2018:2939
CVE: CVE-2018-1261
Published: 2018-05-11
Description: Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/104178; https://pivotal.io/security/cve-2018-1261; http://www.securityfocus.com/bid/104178
CVE: CVE-2018-1278
Published: 2018-05-11
Description: Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered. Accepting this invitation gives unauthorized access to view the member list, domains, quotas and other information about the org.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://www.securityfocus.com/bid/104227; https://pivotal.io/security/cve-2018-1278; http://www.securityfocus.com/bid/104227
CVE: CVE-2018-1280
Published: 2018-05-11
Description: Pivotal Greenplum Command Center versions 2.x prior to 2.5.1 contains a blind SQL injection vulnerability. An unauthenticated user can perform a SQL injection in the command center which results in disclosure of database contents.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/104153; https://pivotal.io/security/cve-2018-1280; http://www.securityfocus.com/bid/104153
CVE: CVE-2018-10832
Published: 2018-05-11
Description: ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will return the contents of any local files to a remote attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html; https://www.exploit-db.com/exploits/44607/; http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html
CVE: CVE-2018-5303
Published: 2018-05-11
Description: An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The license key parameter of the web application is vulnerable to Cross Site Scripting; this vulnerability allows an attacker to send malicious code to another user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://blog.isecurion.com/2018/05/09/impinj-speedway-r420-rfid-reader/; http://blog.isecurion.com/2018/05/09/impinj-speedway-r420-rfid-reader/
CVE: CVE-2018-5304
Published: 2018-05-11
Description: An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vulnerable to ClickJacking or UI Redressing: it is possible to access the web application in an iframe, and clicking on the iframe will redirect to a third-party application or perform other malicious actions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: http://blog.isecurion.com/2018/05/09/impinj-speedway-r420-rfid-reader/; http://blog.isecurion.com/2018/05/09/impinj-speedway-r420-rfid-reader/
CVE: CVE-2018-6023
Published: 2018-05-11
Description: Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi activating, etc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/147571/Fastweb-FASTGate-0.00.47-Cross-Site-Request-Forgery.html; https://www.exploit-db.com/exploits/44606/; http://packetstormsecurity.com/files/147571/Fastweb-FASTGate-0.00.47-Cross-Site-Request-Forgery.html
CVE: CVE-2018-6361
Published: 2018-05-11
Description: Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-XSS-FTP-BACKDOOR-ACCOUNT.txt; http://packetstormsecurity.com/files/147553/Easy-Hosting-Control-Panel-0.37.12.b-Cross-Site-Scripting-Add-FTP-Account.html; http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-XSS-FTP-BACKDOOR-ACCOUNT.txt
CVE: CVE-2018-6362
Published: 2018-05-11
Description: Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-XSS-COOKIE-THEFT.txt; http://packetstormsecurity.com/files/147554/Easy-Hosting-Control-Panel-0.37.12.b-Cross-Site-Scripting-Cookie-Theft.html; http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-XSS-COOKIE-THEFT.txt
CVE: CVE-2018-6458
Published: 2018-05-11
Description: Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-MULTIPLE-CSRF.txt; http://packetstormsecurity.com/files/147555/Easy-Hosting-Control-Panel-0.37.12.b-Cross-Site-Request-Forgery.html; http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-MULTIPLE-CSRF.txt
CVE: CVE-2018-6617
Published: 2018-05-11
Description: Easy Hosting Control Panel (EHCP) v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-UNVERIFIED-PASSWORD-CHANGE.txt; http://packetstormsecurity.com/files/147558/Easy-Hosting-Control-Panel-0.37.12.b-Unverified-Password-Change.html; http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-UNVERIFIED-PASSWORD-CHANGE.txt
CVE: CVE-2018-6618
Published: 2018-05-11
Description: Easy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-CLEARTEXT-PASSWORD-STORAGE.txt; http://packetstormsecurity.com/files/147557/Easy-Hosting-Control-Panel-0.37.12.b-Clear-Text-Password-Storage.html; http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-CLEARTEXT-PASSWORD-STORAGE.txt
CVE: CVE-2018-6619
Published: 2018-05-11
Description: Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a salt.
CVSS Score: 7.8 (HIGH)
CWE: CWE-327
References: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-INSECURE-CRYPTO.txt; http://packetstormsecurity.com/files/147556/Easy-Hosting-Control-Panel-0.37.12.b-Insecure-Cryptography.html; http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-INSECURE-CRYPTO.txt
CVE: CVE-2018-10992
Published: 2018-05-11
Description: lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU Guile code uses the system Scheme procedure instead of the system* Scheme procedure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-17523.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://bugs.debian.org/898373; https://bugs.debian.org/898373
CVE: CVE-2018-10996
Published: 2018-05-12
Description: The weblogin_log function in /htdocs/cgibin on D-Link DIR-629-B1 devices allows attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a session.cgi?ACTION=logout request involving a long REMOTE_ADDR environment variable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/104277; https://github.com/kgsdy/D-Link-DIR-629/blob/master/D-Link-DIR-629-B1.md; http://www.securityfocus.com/bid/104277
CVE: CVE-2018-10998
Published: 2018-05-12
Description: An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call.
CVSS Score: 6.5 (MEDIUM)
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/303; https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html
CVE: CVE-2018-10999
Published: 2018-05-12
Description: An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap-based buffer over-read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Exiv2/exiv2/issues/306; https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html; https://lists.debian.org/debian-lts-announce/2018/10/msg00012.html
CVE: CVE-2018-11003
Published: 2018-05-12
Description: An issue was discovered in YXcms 1.4.7. Cross-site request forgery (CSRF) vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/TekerFue/YXcms-Code-Audit/blob/master/1.4.7%20csrf; https://github.com/TekerFue/YXcms-Code-Audit/blob/master/1.4.7%20csrf
CVE: CVE-2018-11004
Published: 2018-05-12
Description: An issue was discovered in SDcms v1.5. Cross-site request forgery (CSRF) vulnerability in /WWW//app/admin/controller/admincontroller.php allows remote attackers to add administrator accounts via m=admin&c=admin&a=add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/TekerFue/SDcms-Code-Audit/blob/master/1.5%20csrf; https://github.com/TekerFue/SDcms-Code-Audit/blob/master/1.5%20csrf
CVE: CVE-2018-11011
Published: 2018-05-12
Description: ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ruibaby/halo/issues/9; https://github.com/ruibaby/halo/issues/9
CVE: CVE-2018-11012
Published: 2018-05-12
Description: ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ruibaby/halo/issues/9; https://github.com/ruibaby/halo/issues/9
CVE: CVE-2018-11013
Published: 2018-05-13
Description: Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with firmware version 1.10B05 allows unauthenticated remote attackers to execute arbitrary code via a request with a long HTTP Host header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://0x3f97.github.io/exploit/2018/05/13/D-Link-DIR-816-A2-CN-router-stack-based-buffer-overflow/; https://0x3f97.github.io/exploit/2018/05/13/D-Link-DIR-816-A2-CN-router-stack-based-buffer-overflow/
CVE: CVE-2018-10678
Published: 2018-05-13
Description: MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/104187; https://gist.github.com/MayurUdiniya/7aaa50b878d82b6aab6ed0b3e2b080bc; http://www.securityfocus.com/bid/104187
CVE: CVE-2018-11017
Published: 2018-05-13
Description: The newVar_N function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://docs.google.com/document/d/18lJc_F5p3HPaMwsUAIwP0zMMhwJs-Snhuj05nhMIgAw/edit; https://docs.google.com/document/d/18lJc_F5p3HPaMwsUAIwP0zMMhwJs-Snhuj05nhMIgAw/edit
CVE: CVE-2018-11018
Published: 2018-05-13
Description: An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/zhaoheng521/PbootCMS/blob/master/V1.0.7%20csrf; https://github.com/zhaoheng521/PbootCMS/blob/master/V1.0.7%20csrf
CVE: CVE-2018-11031
Published: 2018-05-14
Description: application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an api[url]=file:////etc/passwd&api[method]=get POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/gouguoyin/phprap/issues/89; https://github.com/gouguoyin/phprap/issues/89
CVE: CVE-2018-11032
Published: 2018-05-14
Description: PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search() function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/gouguoyin/phprap/issues/89; https://github.com/gouguoyin/phprap/issues/89
CVE: CVE-2018-11033
Published: 2018-05-14
Description: The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JPEG data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=40842; https://forum.xpdfreader.com/viewtopic.php?f=3&t=40842
CVE: CVE-2018-10944
Published: 2018-05-14
Description: The request_dividend function of a smart contract implementation for ROC (aka Rasputin Online Coin), an Ethereum ERC20 token, allows attackers to steal all of the contract's Ether.
CVSS Score: 5.9 (MEDIUM)
References: https://medium.com/%40jonghyk.song/attackers-can-steal-all-of-ether-in-roc-rasputin-online-coin-token-smart-contract-ae928b4a935a; https://medium.com/%40jonghyk.song/attackers-can-steal-all-of-ether-in-roc-rasputin-online-coin-token-smart-contract-ae928b4a935a
CVE: CVE-2018-11034
Published: 2018-05-14
Description: In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x8000200D.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345NsProtect.sys-x64-0x8000200D; https://www.exploit-db.com/exploits/44619/; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345NsProtect.sys-x64-0x8000200D
CVE: CVE-2018-11035
Published: 2018-05-14
Description: In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x80002019.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345NsProtect.sys-x64-0x80002019; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345NsProtect.sys-x64-0x80002019
CVE: CVE-2018-11037
Published: 2018-05-14
Description: In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/307; https://security.gentoo.org/glsa/201811-14
CVE: CVE-2017-16860
Published: 2018-05-14
Description: The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the redirectUrl parameter link in the redirect warning message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104188; https://ecosystem.atlassian.net/browse/APL-1363; http://www.securityfocus.com/bid/104188
CVE: CVE-2018-0568
Published: 2018-05-14
Description: Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://jvn.jp/en/jp/JVN95589314/index.html; https://github.com/joruri/joruri-gw/blob/master/doc/INSTALL.txt; http://jvn.jp/en/jp/JVN95589314/index.html
CVE: CVE-2018-0576
Published: 2018-05-14
Description: Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN85531148/index.html; https://wordpress.org/plugins/events-manager/#developers; https://wpvulndb.com/vulnerabilities/9609