deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-17434
Published: 2017-12-06
Description: The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.
CVSS Score: 9.8 (CRITICAL)
References: http://security.cucumberlinux.com/security/details.php?id=170; https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=5509597decdbd7b91994210f700329d8a35e70a1; https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=70aeb5fddd1b2f8e143276f8d5a085db16c593b9
CVE: CVE-2017-17069
Published: 2017-12-06
Description: ActiveSetupN.exe in Amazon Audible for Windows before November 2017 allows attackers to execute arbitrary DLL code if ActiveSetupN.exe is launched from a directory where an attacker has already created a Trojan horse dwmapi.dll file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/102044; https://packetstormsecurity.com/files/145202/Amazon-Audible-DLL-Hijacking.html; https://twitter.com/LionHeartRoxx/status/[PII_REDACTED]14540032
CVE: CVE-2017-17383
Published: 2017-12-06
Description: Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://vsintelli.com/portal/blog/23-security-advisory-2017-12-04; http://www.securityfocus.com/bid/102130; https://jenkins.io/security/advisory/2017-12-05/
CVE: CVE-2017-0837
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the Android media framework (libaudiopolicymanager). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64340921.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-0870
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the Android framework (libminikin). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62134807.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102131; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102131
CVE: CVE-2017-0871
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the Android framework (framework base). Product: Android. Versions: 8.0. Android ID A-65281159.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102131; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102131
CVE: CVE-2017-0872
Published: 2017-12-06
Description: A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-0873
Published: 2017-12-06
Description: A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63316255.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-0874
Published: 2017-12-06
Description: A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63315932.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-0876
Published: 2017-12-06
Description: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-0877
Published: 2017-12-06
Description: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-0878
Published: 2017-12-06
Description: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-0879
Published: 2017-12-06
Description: An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65025028.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-0880
Published: 2017-12-06
Description: A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID A-65646012.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-13148
Published: 2017-12-06
Description: A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65717533.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-13149
Published: 2017-12-06
Description: An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65719872.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13150
Published: 2017-12-06
Description: An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-38328132.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13151
Published: 2017-12-06
Description: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-13152
Published: 2017-12-06
Description: An information disclosure vulnerability in the Android media framework (libmedia drm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62872384.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13153
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the Android media framework (libaudioservice). Product: Android. Versions: 8.0. Android ID A-65280854.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: http://www.securityfocus.com/bid/102126; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102126
CVE: CVE-2017-13154
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63666573.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13156
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155189/Android-Janus-APK-Signature-Bypass.html; http://www.securityfocus.com/bid/102109; https://source.android.com/security/bulletin/2017-12-01
CVE: CVE-2017-13157
Published: 2017-12-06
Description: An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32990341.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102109; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102109
CVE: CVE-2017-13158
Published: 2017-12-06
Description: An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32879915.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102109; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102109
CVE: CVE-2017-13159
Published: 2017-12-06
Description: An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32879772.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102109; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102109
CVE: CVE-2017-13160
Published: 2017-12-06
Description: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-37160362.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102109; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102109
CVE: CVE-2017-13161
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the Broadcom wireless driver. Product: Android. Versions: Android kernel. Android ID A-63930471. References: BC-V[PII_REDACTED].
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13162
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the kernel binder. Product: Android. Versions: Android kernel. Android ID A-64216036.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102107; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102107
CVE: CVE-2017-13163
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the kernel mtp usb driver. Product: Android. Versions: Android kernel. Android ID A-37429972.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13164
Published: 2017-12-06
Description: An information disclosure vulnerability in the kernel binder driver. Product: Android. Versions: Android kernel. Android ID A-36007193.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13165
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13166
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2018:0676; https://access.redhat.com/errata/RHSA-2018:1062; https://access.redhat.com/errata/RHSA-2018:1130
CVE: CVE-2017-13167
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the kernel sound timer. Product: Android. Versions: Android kernel. Android ID A-37240993.
CVSS Score: 7.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html; https://source.android.com/security/bulletin/pixel/2017-12-01; http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
CVE: CVE-2017-13168
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions: Android kernel. Android ID A-65023233.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://usn.ubuntu.com/3753-1/; https://usn.ubuntu.com/3753-2/
CVE: CVE-2017-13169
Published: 2017-12-06
Description: An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13170
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the MediaTek display driver. Product: Android. Versions: Android kernel. Android ID A-36102397. References: M-ALPS03359280.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102108; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102108
CVE: CVE-2017-13171
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the MediaTek performance service. Product: Android. Versions: Android kernel. Android ID A-64316572. References: M-ALPS03479086.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102108; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102108
CVE: CVE-2017-13172
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the MediaTek bluetooth driver. Product: Android. Versions: Android kernel. Android ID A-36493287. References: M-ALPS03495791.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-13173
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the MediaTek system server. Product: Android. Versions: Android kernel. Android ID A-28067350. References: M-ALPS02672361.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102108; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102108
CVE: CVE-2017-13174
Published: 2017-12-06
Description: An elevation of privilege vulnerability in the kernel edl. Product: Android. Versions: Android kernel. Android ID A-63100473.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102107; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102107
CVE: CVE-2017-13175
Published: 2017-12-06
Description: An information disclosure vulnerability in the NVIDIA libwilhelm. Product: Android. Versions: Android kernel. Android ID A-64339309. References: N-CVE-2017-13175.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2016-5713
Published: 2017-12-06
Description: Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://puppet.com/security/cve/cve-2016-5713; https://puppet.com/security/cve/cve-2016-5713
CVE: CVE-2017-17439
Published: 2017-12-06
Description: In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://h5l.org/advisories.html?show=2017-12-08; http://www.h5l.org/pipermail/heimdal-announce/2017-December/000008.html; http://www.h5l.org/pipermail/heimdal-discuss/2017-August/000259.html
CVE: CVE-2017-17440
Published: 2017-12-06
Description: GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, as demonstrated by the EXTRACTOR_xm_extract_method function in plugins/xm_extractor.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/102116; https://bugs.debian.org/883528#35; https://gnunet.org/git/libextractor.git/commit/?id=7cc63b001ceaf[PII_REDACTED]1379c835486d0c92e
CVE: CVE-2017-6262
Published: 2017-12-06
Description: NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to a race condition which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as high. Product: Android. Version: N/A. Android ID: A-38045794. References: N-CVE-2017-6262.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102106; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102106
CVE: CVE-2017-6263
Published: 2017-12-06
Description: NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to improper usage of the list_for_each kernel macro which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as high. Product: Android. Version: N/A. Android ID: A-38046353. References: N-CVE-2017-6263.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102106; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102106
CVE: CVE-2017-6276
Published: 2017-12-06
Description: NVIDIA mediaserver contains a vulnerability where it is possible a use after free malfunction can occur due to an incorrect bounds check which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as high. Product: Android. Version: N/A. Android: A-63802421. References: N-CVE-2017-6276.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102106; https://source.android.com/security/bulletin/2017-12-01; http://www.securityfocus.com/bid/102106
CVE: CVE-2017-17068
Published: 2017-12-06
Description: A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://appcheck-ng.com/appcheck-discovers-vulnerability-auth0-library-cve-2017-17068/; https://auth0.com/docs/security/bulletins/cve-2017-17068; https://appcheck-ng.com/appcheck-discovers-vulnerability-auth0-library-cve-2017-17068/
CVE: CVE-2017-17446
Published: 2017-12-06
Description: The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-681
References: https://bitbucket.org/mpyne/game-music-emu/issues/14/addresssanitizer-negative-size-param-size; https://bugs.debian.org/883691; https://bitbucket.org/mpyne/game-music-emu/issues/14/addresssanitizer-negative-size-param-size
CVE: CVE-2017-17435
Published: 2017-12-07
Description: An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request, the safe does not check the PIN code, so an attacker can obtain authorization using any value. Once an attacker sees the Bluetooth Low Energy (BLE) advertisement for the safe, they need only to write a BLE characteristic to enable notifications, and send a crafted getAuthor packet that returns a temporary key, and an unlock packet including that temporary key. The safe then opens after the unlock packet is processed, with no verification of PIN or other credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://vaulteksafe.com/index.php/cve-2017-17435/; https://www.twosixlabs.com/bluesteal-popping-gatt-safes/; https://vaulteksafe.com/index.php/cve-2017-17435/
CVE: CVE-2017-17436
Published: 2017-12-07
Description: An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and "Data transmissions are secure via AES256 bit encryption." These claims, however, are not true. Moreover, AES256 bit encryption is not supported in the Bluetooth Low Energy (BLE) standard, so it would have to be at the application level. This lack of encryption allows an individual to learn the passcode by eavesdropping on the communications between the application and the safe.
CVSS Score: 8.8 (HIGH)
CWE: CWE-326
References: https://vaulteksafe.com/index.php/cve-2017-17435/; https://www.twosixlabs.com/bluesteal-popping-gatt-safes/; https://vaulteksafe.com/index.php/cve-2017-17435/
CVE: CVE-2017-17448
Published: 2017-12-07
Description: net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/102117; https://access.redhat.com/errata/RHSA-2018:0654; https://access.redhat.com/errata/RHSA-2018:0676