deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-1608
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132928.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/132928; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/132928
CVE: CVE-2017-1621
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133088.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/133088; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/133088
CVE: CVE-2017-1651
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133261.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/133261; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/133261
CVE: CVE-2017-1652
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133263.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/133263; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/133263
CVE: CVE-2017-1690
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134065.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/134065; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/134065
CVE: CVE-2017-1691
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134066.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/134066; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/134066
CVE: CVE-2017-1715
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134637.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/134637; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/134637
CVE: CVE-2017-1717
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134796.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/134796; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/134796
CVE: CVE-2018-13116
Published: 2018-07-03
Description: /user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms_ask table.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/actionyz/ZZCMS/blob/master/SQL/1/del.php.md; https://github.com/actionyz/ZZCMS/blob/master/SQL/1/del.php.md
CVE: CVE-2018-8036
Published: 2018-07-03
Description: In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://access.redhat.com/errata/RHSA-2018:2669; https://lists.apache.org/thread.html/9f62f742fd4fcd81654a9533b8a71349b[PII_REDACTED]92bcd502dcfb6%40%3Cusers.pdfbox.apache.org%3E; https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540%40%3Cdev.syncope.apache.org%3E
CVE: CVE-2017-0912
Published: 2018-07-03
Description: Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization, it is possible to inject arbitrary HTML code by manipulating the uploaded filename. Successful exploitation requires valid credentials to an account with "Edit" access to "Scheduling".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814; https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814
CVE: CVE-2017-0913
Published: 2018-07-03
Description: Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with "Edit" access to "System Customization".
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-732
References: https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814; https://hackerone.com/reports/301406; https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814
CVE: CVE-2017-0919
Published: 2018-07-03
Description: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://hackerone.com/reports/301137; https://hackerone.com/reports/301137
CVE: CVE-2017-0921
Published: 2018-07-03
Description: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/; https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/
CVE: CVE-2017-0929
Published: 2018-07-03
Description: DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/dnnsoftware/Dnn.Platform/commit/d3953db85fee77bb5e[PII_REDACTED]c507ef8b94c3; https://github.com/dnnsoftware/Dnn.Platform/commit/d3953db85fee77bb5e[PII_REDACTED]c507ef8b94c3
CVE: CVE-2018-3747
Published: 2018-07-03
Description: The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/316346; https://hackerone.com/reports/316346
CVE: CVE-2018-3748
Published: 2018-07-03
Description: There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in <a> element) allows to execute JavaScript code against any user who opens a directory listing containing such crafted file name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/310133; https://hackerone.com/reports/310133
CVE: CVE-2018-3749
Published: 2018-07-03
Description: The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://hackerone.com/reports/310446; https://hackerone.com/reports/310446
CVE: CVE-2018-3750
Published: 2018-07-03
Description: The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://hackerone.com/reports/311333; https://hackerone.com/reports/311333
CVE: CVE-2018-3751
Published: 2018-07-03
Description: The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://hackerone.com/reports/311337; https://hackerone.com/reports/311337
CVE: CVE-2018-3752
Published: 2018-07-03
Description: The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://hackerone.com/reports/311336; https://hackerone.com/reports/311336
CVE: CVE-2018-3753
Published: 2018-07-03
Description: The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://hackerone.com/reports/310706; https://hackerone.com/reports/310706
CVE: CVE-2018-3754
Published: 2018-07-03
Description: Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user input sanitization. This may allow an attacker to run arbitrary SQL queries when fetching data from database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://hackerone.com/reports/311244; https://hackerone.com/reports/311244
CVE: CVE-2018-7636
Published: 2018-07-03
Description: The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104673; http://www.securitytracker.com/id/1041207; https://security.paloaltonetworks.com/CVE-2018-7636
CVE: CVE-2018-9242
Published: 2018-07-03
Description: The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104676; http://www.securitytracker.com/id/1041242; https://security.paloaltonetworks.com/CVE-2018-9242
CVE: CVE-2018-9334
Published: 2018-07-03
Description: The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 may allow an attacker to access the GlobalProtect password hashes of local users via manipulation of the HTML markup.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/104677; http://www.securitytracker.com/id/1041243; https://security.paloaltonetworks.com/CVE-2018-9334
CVE: CVE-2018-9335
Published: 2018-07-03
Description: The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104658; http://www.securitytracker.com/id/1041241; https://security.paloaltonetworks.com/CVE-2018-9335
CVE: CVE-2018-9337
Published: 2018-07-03
Description: The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104657; http://www.securitytracker.com/id/1041240; https://security.paloaltonetworks.com/CVE-2018-9337
CVE: CVE-2018-13121
Published: 2018-07-03
Description: RealOne Player 2.0 Build 6.0.11.872 allows remote attackers to cause a denial of service (array out-of-bounds access and application crash) via a crafted .aiff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/921580451/RealOnePlayer-sBug/issues/1; https://github.com/921580451/RealOnePlayer-sBug/issues/1
CVE: CVE-2018-13122
Published: 2018-07-03
Description: onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete File(s) screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/Self-Evident/OneFileCMS/issues/49; https://github.com/Self-Evident/OneFileCMS/issues/49
CVE: CVE-2018-13123
Published: 2018-07-03
Description: onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=raw_view for the /etc/passwd file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://github.com/Self-Evident/OneFileCMS/issues/50; https://github.com/Self-Evident/OneFileCMS/issues/50
CVE: CVE-2018-11335
Published: 2018-07-04
Description: GVToken Genesis Vision (GVT) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/tree/master/GVT; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-11429
Published: 2018-07-04
Description: ATLANT (ATL) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/tree/master/ATLANT; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-13126
Published: 2018-07-04
Description: MoxyOnePresale is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/tree/master/MoxyOnePresale; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-13127
Published: 2018-07-04
Description: SP8DE PreSale Token (DSPX) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/tree/master/DSPX; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-13128
Published: 2018-07-04
Description: Etherty Token (ETY) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/tree/master/ETY; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-13129
Published: 2018-07-04
Description: SP8DE Token (SPX) is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-13130
Published: 2018-07-04
Description: Bitotal (TFUND) is a smart contract running on Ethereum. The mintTokens function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/tree/master/Bitotal; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-13131
Published: 2018-07-04
Description: SpadePreSale is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/tree/master/SpadePreSale; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-13132
Published: 2018-07-04
Description: Spadeico is a smart contract running on Ethereum. The mint function has an integer overflow that allows minted tokens to be arbitrarily retrieved by the contract owner.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md; https://github.com/dwfault/AirTokens/tree/master/SpadeICO; https://github.com/dwfault/AirTokens/blob/master/SPXToken/mint%20interger%20overflow.md
CVE: CVE-2018-13133
Published: 2018-07-04
Description: Golden Frog VyprVPN before 2018-06-21 has a vulnerability associated with the installation process on Windows.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://fortiguard.com/zeroday/FG-VD-18-049; https://www.goldenfrog.com/blog/vyprvpn-secured-installation-vulnerability; https://fortiguard.com/zeroday/FG-VD-18-049
CVE: CVE-2018-13134
Published: 2018-07-04
Description: TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATH_INFO to the /webpages/data URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/45970/; https://www.xc0re.net/2018/05/25/tp-link-wireless-router-archer-c1200-cross-site-scripting/; https://www.exploit-db.com/exploits/45970/
CVE: CVE-2018-13136
Published: 2018-07-04
Description: The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ultimatemember/ultimatemember/issues/456; https://github.com/ultimatemember/ultimatemember/releases/tag/2.0.18; https://wpvulndb.com/vulnerabilities/9708
CVE: CVE-2018-13139
Published: 2018-07-04
Description: A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. The vulnerability can be triggered by the executable sndfile-deinterleave.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/erikd/libsndfile/issues/397; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://security.gentoo.org/glsa/201811-23
CVE: CVE-2018-13144
Published: 2018-07-04
Description: The transfer and transferFrom functions of a smart contract implementation for Pandora (PDX), an Ethereum token, have an integer overflow. NOTE: this has been disputed by a third party.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/safecomet/EtherTokens/blob/master/Pandora%20%28PDX%29/Pandora%20%28PDX%29.md; https://github.com/soohoio/VeriSmartBench/wiki/CVE-False-Reported-Case; https://github.com/safecomet/EtherTokens/blob/master/Pandora%20%28PDX%29/Pandora%20%28PDX%29.md
CVE: CVE-2018-13145
Published: 2018-07-04
Description: The mintToken function of a smart contract implementation for JavaSwapTest (JST), an Ethereum token, has an integer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/safecomet/EtherTokens/blob/master/JavaSwapTest%20%28JST%29/JavaSwapTest%20%28JST%29.md; https://github.com/safecomet/EtherTokens/blob/master/JavaSwapTest%20%28JST%29/JavaSwapTest%20%28JST%29.md
CVE: CVE-2018-13146
Published: 2018-07-04
Description: The mintToken, buy, and sell functions of a smart contract implementation for LEF, an Ethereum token, have an integer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/safecomet/EtherTokens/blob/master/LEF%20%28LEF%29/LEF%20%28LEF%29.md; https://github.com/safecomet/EtherTokens/blob/master/LEF%20%28LEF%29/LEF%20%28LEF%29.md
CVE: CVE-2015-9260
Published: 2018-07-05
Description: An issue was discovered in BEdita before 3.7.0. A cross-site scripting (XSS) attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2015-9260-bedita.html; https://github.com/bedita/bedita/issues/755#issuecomment-148036760; https://github.com/bedita/bedita/releases/tag/v3.7.0