deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/104896; https://github.com/FFmpeg/FFmpeg/commit/2b46ebdbff1d8dec7a3d8ea280a612b91a582869; https://seclists.org/bugtraq/2019/May/60
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/104896; https://github.com/FFmpeg/FFmpeg/commit/9807d3976be0e92e4ece3b4b1701be894cd7c2e1; https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: FFmpeg before commit a7e032a[PII_REDACTED]71951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a[PII_REDACTED]71951e29fd0bf2bd5c029f0 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://www.securityfocus.com/bid/104896; https://github.com/FFmpeg/FFmpeg/commit/a7e032a[PII_REDACTED]71951e29fd0bf2bd5c029f0; http://www.securityfocus.com/bid/104896
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104896; https://github.com/FFmpeg/FFmpeg/commit/bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75; http://www.securityfocus.com/bid/104896
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104896; https://github.com/FFmpeg/FFmpeg/commit/5aba5b89d0b1d73164d3b81764828bb8b20ff32a; http://www.securityfocus.com/bid/104896
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating the web client via XSS code injection. This attack appear to be exploitable via the victim openning a specially crafted URL. This vulnerability appears to have been fixed in version 8.2.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pydio.com/en/community/releases/pydio-core/pydio-821-security-release; https://www.mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt; https://pydio.com/en/community/releases/pydio-core/pydio-821-security-release
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath($url) that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appears to be exploitable via the attacker gaining access to an administrative account, enters a URL into Upgrade Engine, and reloads the page or presses "Check Now". This vulnerability appears to have been fixed in 8.2.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://pydio.com/en/community/releases/pydio-core/pydio-821-security-release; https://www.mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt; https://pydio.com/en/community/releases/pydio-core/pydio-821-security-release
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow($nodeObject) that can result in An attacker gaining admin access and can then execute arbitrary commands on the underlying OS. This attack appear to be exploitable via The attacker edits the Antivirus Command in the antivirus plugin, and executes the payload by uploading any file within Pydio.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: https://www.mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt; https://www.mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/chamilo/chamilo-lms/commit/0de84700648f098c1fbf6b807dee28ec640efe62; https://ibb.co/jBxe6y; https://github.com/chamilo/chamilo-lms/commit/0de84700648f098c1fbf6b807dee28ec640efe62
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java line 35 that can result in arbitrary file deletion (overwrite). This attack appear to be exploitable via a specially crafted zip file should be uploaded.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://gms.cl0udz.com/ONOS_app_overwrite.pdf; https://gerrit.onosproject.org/#/c/19043/; http://gms.cl0udz.com/ONOS_app_overwrite.pdf
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary web script or HTML via the profile page editor. This attack appear to be exploitable via The victim must navigate to the attacker's profile page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/gleez/cms/issues/797; https://github.com/gleez/cms/issues/797
CVE: CVE-2018-5013
Published: 2018-07-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-5103.  Reason: This candidate is a duplicate of CVE-2018-5103.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2018-5103 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-6683
Published: 2018-07-23
Description: Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and 11.0.405 allows local users to bypass DLP policy via editing of local policy files when offline.
CVSS Score: 7.4 (HIGH)
CWE: CWE-276
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10246; https://kc.mcafee.com/corporate/index?page=content&id=SB10246
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform/; https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform; http://blog.pear.php.net/2018/07/19/security-vulnerability-announcement-html_quickform/
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380; https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.bentkowski.info/2018/06/xss-in-google-colaboratory-csp-bypass.html; https://github.com/mathjax/MathJax/commit/a55da396c18cafb767a26aa9ad96f6f4199852f1; https://blog.bentkowski.info/2018/06/xss-in-google-colaboratory-csp-bypass.html
CVE: CVE-2018-11756
Published: 2018-07-23
Description: In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/104915; https://github.com/apache/incubator-openwhisk-runtime-php/commit/6caf902f527250ee4b7b695929b628d560e0dad1; https://lists.apache.org/thread.html/439bd5ff5822708c645a0d816ed9914b88c97eda32eae6ea211bc0dc%40%3Cdev.openwhisk.apache.org%3E
CVE: CVE-2018-11757
Published: 2018-07-23
Description: In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/104913; https://github.com/apache/incubator-openwhisk-runtime-docker/commit/891896f25c39bc336ef6dda53f80f466ac4ca3c8; https://lists.apache.org/thread.html/0b6d8a677f1c063ed32eb3638ef4d1a47dfba8907de4b222ddd24b05%40%3Cdev.openwhisk.apache.org%3E
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.
CVSS Score: 8.8 (HIGH)
References: https://jenkins.io/security/advisory/2018-07-18/#SECURITY-897; https://www.oracle.com/security-alerts/cpuapr2022.html; https://jenkins.io/security/advisory/2018-07-18/#SECURITY-897
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
CVSS Score: 7.5 (HIGH)
References: https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914; https://www.exploit-db.com/exploits/46453/; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://jenkins.io/security/advisory/2018-07-18/#SECURITY-891; https://www.oracle.com/security-alerts/cpuapr2022.html; https://jenkins.io/security/advisory/2018-07-18/#SECURITY-891
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://jenkins.io/security/advisory/2018-07-18/#SECURITY-892; https://www.oracle.com/security-alerts/cpuapr2022.html; https://jenkins.io/security/advisory/2018-07-18/#SECURITY-892
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jenkins.io/security/advisory/2018-07-18/#SECURITY-944; https://www.oracle.com/security-alerts/cpuapr2022.html; https://jenkins.io/security/advisory/2018-07-18/#SECURITY-944
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the date of the most recent installation/upgrade.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-07-18/#SECURITY-925; https://jenkins.io/security/advisory/2018-07-18/#SECURITY-925
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jenkins.io/security/advisory/2018-07-18/#SECURITY-390; https://www.oracle.com/security-alerts/cpuapr2022.html; https://jenkins.io/security/advisory/2018-07-18/#SECURITY-390
CVE: CVE-2016-10728
Published: 2018-07-23
Description: An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/kirillwow/ids_bypass; https://lists.debian.org/debian-lts-announce/2018/09/msg00019.html; https://redmine.openinfosecfoundation.org/issues/1880
CVE: CVE-2018-14328
Published: 2018-07-23
Description: Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for /dashboard/addplan, /dashboard/paywithcard/charge, /dashboard/withdrawal, or /privacy&terms, as demonstrated by reading database username, database password, database_name, and IP address fields, related to CVE-2018-12908.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/45094/; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2018-14568
Published: 2018-07-23
Description: Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).
CVSS Score: 7.5 (HIGH)
References: https://github.com/OISF/suricata/pull/3428/commits/843d0b7a10bb45627f94764a6c5d468a24143345; https://github.com/kirillwow/ids_bypass; https://redmine.openinfosecfoundation.org/issues/2501
CVE: CVE-2018-14570
Published: 2018-07-23
Description: A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type (e.g., image/jpeg) with a modified filename and file content. This results in arbitrary code execution by requesting that .php file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/GitHaaH/issue/blob/master/Niushop.md; https://github.com/GitHaaH/issue/blob/master/Niushop.md
CVE: CVE-2018-11451
Published: 2018-07-23
Description: A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethernet module (All versions), Firmware variant Modbus TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions < V1.22), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.80), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-325546.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-635129.pdf; https://www.securityfocus.com/bid/106221
CVE: CVE-2018-11452
Published: 2018-07-23
Description: A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethernet module (All versions), Firmware variant Modbus TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions < V1.22). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the EN100 communication module if oscillographs are running. A manual restart is required to recover the EN100 module functionality. Successful exploitation requires an attacker with network access to send multiple packets to the EN100 module. As a precondition the IEC 61850-MMS communication needs to be activated on the affected EN100 modules. No user interaction or privileges are required to exploit the security vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-325546.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-635129.pdf; https://www.securityfocus.com/bid/106221
CVE: CVE-2018-10912
Published: 2018-07-23
Description: keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://access.redhat.com/errata/RHSA-2018:2428; https://access.redhat.com/errata/RHSA-2019:0877; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10912
CVE: CVE-2018-8031
Published: 2018-07-23
Description: The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This issue can be mitigated by removing the application after TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upgrading to TomEE 7.0.5. This issue is resolve in this commit: b8bbf50c23ce97dd64f3a5d77f78f84e47579863.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/c4b0d83a534d6cdf2de54dbbd00e3538072ac2e360781b784608ed0d%40%3Cdev.tomee.apache.org%3E; https://lists.apache.org/thread.html/c4b0d83a534d6cdf2de54dbbd00e3538072ac2e360781b784608ed0d%40%3Cdev.tomee.apache.org%3E
CVE: CVE-2018-14573
Published: 2018-07-23
Description: A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://release-notes.trms.com/txt/448; http://release-notes.trms.com/txt/448
CVE: CVE-2017-18104
Published: 2018-07-24
Description: The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or otherwise intercept webhook events to learn information about changes in issues that should not be sent because they are not contained within the results of a specified JQL query.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://jira.atlassian.com/browse/JRASERVER-59980; https://jira.atlassian.com/browse/JRASERVER-59980