deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-3588
Published: 2018-10-26
Description: There is improper access control of the SSC and GPU mapped regions which lead to inject code from HLOS in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 820, SD 820A, SD 835, SDA660.
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-5866
Published: 2018-10-26
Description: While processing logs, data is copied into a buffer pointed to by an untrusted pointer in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SD 845, SD 850, SDA660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-5914
Published: 2018-10-26
Description: Improper input validation in TZ led to array out of bound in TZ function while accessing the peripheral details using the incoming data in Snapdragon Mobile, Snapdragon Wear version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SDA660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-15686
Published: 2018-10-26
Description: A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/105747; https://access.redhat.com/errata/RHSA-2019:2091; https://access.redhat.com/errata/RHSA-2019:3222
CVE: CVE-2018-15687
Published: 2018-10-26
Description: A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: http://www.securityfocus.com/bid/105748; https://github.com/systemd/systemd/pull/10517/commits; https://security.gentoo.org/glsa/201810-10
CVE: CVE-2018-15688
Published: 2018-10-26
Description: A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://www.securityfocus.com/bid/105745; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3665
CVE: CVE-2018-18657
Published: 2018-10-26
Description: An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-18 Unauthenticated Sensitive Information Disclosure via /gateway/services/EdgeServiceImpl issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.arcserve.com/s/article/[PII_REDACTED]63?language=en_US; https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US; https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
CVE: CVE-2018-18658
Published: 2018-10-26
Description: An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-20 Unauthenticated Sensitive Information Disclosure via /UDPUpdates/Config/FullUpdateSettings.xml issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.arcserve.com/s/article/[PII_REDACTED]63?language=en_US; https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US; https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
CVE: CVE-2018-18659
Published: 2018-10-26
Description: An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://support.arcserve.com/s/article/[PII_REDACTED]63?language=en_US; https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US; https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
CVE: CVE-2018-18660
Published: 2018-10-26
Description: An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.arcserve.com/s/article/[PII_REDACTED]63?language=en_US; https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UDP-and-fixes-for-them?language=en_US; https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
CVE: CVE-2018-18661
Published: 2018-10-26
Description: An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://bugzilla.maptools.org/show_bug.cgi?id=2819; http://www.securityfocus.com/bid/105762; https://access.redhat.com/errata/RHSA-2019:2053
CVE: CVE-2018-18662
Published: 2018-10-26
Description: There is an out-of-bounds read in fz_run_t3_glyph in fitz/font.c in Artifex MuPDF 1.14.0, as demonstrated by mutool.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105755; https://bugs.ghostscript.com/show_bug.cgi?id=700043; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=164ddc22ee0d5b63a81d5148f44c37dd132a9356
CVE: CVE-2018-4022
Published: 2018-10-26
Description: A use-after-free vulnerability exists in the way MKVToolNix MKVINFO v25.0.0 handles the MKV (matroska) file format. A specially crafted MKV file can cause arbitrary code execution in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0694; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0694
CVE: CVE-2018-6559
Published: 2018-10-26
Description: The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/105752; https://launchpad.net/bugs/1793458; https://lists.ubuntu.com/archives/kernel-team/2018-October/096172.html
CVE: CVE-2018-18690
Published: 2018-10-26
Description: In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b38460dc8e4eafba06c78f8e37099d3b34d473c; http://www.securityfocus.com/bid/105753; https://bugzilla.kernel.org/show_bug.cgi?id=199119
CVE: CVE-2016-10731
Published: 2018-10-29
Description: ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/; https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/
CVE: CVE-2016-10732
Published: 2018-10-29
Description: ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/; https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/
CVE: CVE-2016-10733
Published: 2018-10-29
Description: ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/; https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/
CVE: CVE-2016-10734
Published: 2018-10-29
Description: ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/; https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/
CVE: CVE-2018-18694
Published: 2018-10-29
Description: admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/monstra-cms/monstra/issues/459; https://github.com/monstra-cms/monstra/issues/459
CVE: CVE-2018-18699
Published: 2018-10-29
Description: An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/gopro/gpmf-parser/issues/43; https://github.com/gopro/gpmf-parser/issues/43
CVE: CVE-2018-18700
Published: 2018-10-29
Description: An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87681; https://usn.ubuntu.com/4326-1/; https://usn.ubuntu.com/4336-1/
CVE: CVE-2018-18701
Published: 2018-10-29
Description: An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87675; https://usn.ubuntu.com/4326-1/; https://usn.ubuntu.com/4336-1/
CVE: CVE-2018-18702
Published: 2018-10-29
Description: spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, and used for database insertion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/idreamsoft/iCMS/issues/42; https://github.com/idreamsoft/iCMS/issues/42
CVE: CVE-2018-18703
Published: 2018-10-29
Description: PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal, bypassing the login page, as demonstrated by the Mailserver_filesystem/home.php coninb, consent, contrsh, condrft, or conspam parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://packetstormsecurity.com/files/149965/PHPTPoint-Mailing-Server-Using-File-Handling-1.0-Arbitrary-File-Read.html; https://packetstormsecurity.com/files/149965/PHPTPoint-Mailing-Server-Using-File-Handling-1.0-Arbitrary-File-Read.html
CVE: CVE-2018-18704
Published: 2018-10-29
Description: PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/45682/; https://www.exploit-db.com/exploits/45682/
CVE: CVE-2018-18705
Published: 2018-10-29
Description: PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/149942/PHPTPoint-Hospital-Management-System-1-SQL-Injection.html; https://packetstormsecurity.com/files/149942/PHPTPoint-Hospital-Management-System-1-SQL-Injection.html
CVE: CVE-2018-18706
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function "fromDhcpListClient" for a request, it is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-06/Tenda.md; https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-06/Tenda.md
CVE: CVE-2018-18707
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "ssid" parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-07/Tenda.md; https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-07/Tenda.md
CVE: CVE-2018-18708
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function "fromAddressNat" for a post request, the value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-05/Tenda.md; https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-05/Tenda.md
CVE: CVE-2018-18709
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "firewallEn" parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-08/Tenda.md; https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-08/Tenda.md
CVE: CVE-2018-18710
Published: 2018-10-29
Description: An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276; http://www.securityfocus.com/bid/106041; https://github.com/torvalds/linux/commit/e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276
CVE: CVE-2018-18711
Published: 2018-10-29
Description: An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/wuzhicms/wuzhicms/issues/156; https://github.com/wuzhicms/wuzhicms/issues/156
CVE: CVE-2018-18712
Published: 2018-10-29
Description: An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/wuzhicms/wuzhicms/issues/156; https://github.com/wuzhicms/wuzhicms/issues/156
CVE: CVE-2018-18713
Published: 2018-10-29
Description: The function down_sql_action() in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=down_sql&name=../ URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jlkl.github.io/2018/10/25/CVE_02/; http://str3am.me/2018/10/25/CVE_02/; http://jlkl.github.io/2018/10/25/CVE_02/
CVE: CVE-2018-18717
Published: 2018-10-29
Description: An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=[XSS] URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Sunvas/Eleanor-CMS/issues/5; https://github.com/Sunvas/Eleanor-CMS/issues/5
CVE: CVE-2018-18718
Published: 2018-10-29
Description: An issue was discovered in gThumb through 3.6.2. There is a double-free vulnerability in the add_themes_from_dir method in dlg-contact-sheet.c because of two successive calls of g_free, each of which frees the same buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://gitlab.gnome.org/GNOME/gthumb/issues/18; https://lists.debian.org/debian-lts-announce/2018/11/msg00002.html; https://gitlab.gnome.org/GNOME/gthumb/issues/18
CVE: CVE-2018-18720
Published: 2018-10-29
Description: An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/yunucms/issues/2; https://github.com/source-trace/yunucms/issues/2
CVE: CVE-2018-18721
Published: 2018-10-29
Description: An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/yunucms/issues/7; https://github.com/source-trace/yunucms/issues/7
CVE: CVE-2018-18722
Published: 2018-10-29
Description: An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/yunucms/issues/6; https://github.com/source-trace/yunucms/issues/6
CVE: CVE-2018-18723
Published: 2018-10-29
Description: An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/yunucms/issues/3; https://github.com/source-trace/yunucms/issues/3
CVE: CVE-2018-18724
Published: 2018-10-29
Description: An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/yunucms/issues/5; https://github.com/source-trace/yunucms/issues/5
CVE: CVE-2018-18725
Published: 2018-10-29
Description: An XSS issue was discovered in admin/banner/editbanner?id=20 in YUNUCMS 1.1.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/yunucms/issues/4; https://github.com/source-trace/yunucms/issues/4
CVE: CVE-2018-18726
Published: 2018-10-29
Description: An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/yunucms/issues/8; https://github.com/source-trace/yunucms/issues/8
CVE: CVE-2018-18727
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceList' parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/ZIllR0/Routers/blob/master/Tenda/stack1.md; https://github.com/ZIllR0/Routers/blob/master/Tenda/stack1.md
CVE: CVE-2018-18728
Published: 2018-10-29
Description: An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. They allow remote code execution via shell metacharacters in the usbName field to the __fastcall function with a POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/ZIllR0/Routers/blob/master/Tenda/rce1.md; https://github.com/ZIllR0/Routers/blob/master/Tenda/rce1.md
CVE: CVE-2018-18729
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a heap-based buffer overflow vulnerability in the router's web server -- httpd. While processing the 'mac' parameter for a post request, the value is directly used in a strcpy to a variable placed on the heap, which can leak sensitive information or even hijack program control flow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ZIllR0/Routers/blob/master/Tenda/heapoverflow1.md; https://github.com/ZIllR0/Routers/blob/master/Tenda/heapoverflow1.md
CVE: CVE-2018-18730
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request, each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/ZIllR0/Routers/blob/master/Tenda/stack3.md; https://github.com/ZIllR0/Routers/blob/master/Tenda/stack3.md
CVE: CVE-2018-18731
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'deviceMac' parameter for a post request, the value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/ZIllR0/Routers/blob/master/Tenda/stack4.md; https://github.com/ZIllR0/Routers/blob/master/Tenda/stack4.md