deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-19005
Published: 2018-12-20
Description: Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing specially crafted POC files lacking user input validation. This may allow an attacker to read confidential information and remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/106275; https://ics-cert.us-cert.gov/advisories/ICSA-18-354-01; http://www.securityfocus.com/bid/106275
CVE: CVE-2018-20125
Published: 2018-12-20
Description: hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2018/12/19/3; http://www.securityfocus.com/bid/106298; https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02823.html
CVE: CVE-2018-20126
Published: 2018-12-20
Description: hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html; http://www.openwall.com/lists/oss-security/2018/12/19/4
CVE: CVE-2018-20216
Published: 2018-12-20
Description: QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).
CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-835
References: http://www.openwall.com/lists/oss-security/2018/12/19/2; http://www.securityfocus.com/bid/106291; https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg03052.html
CVE: CVE-2018-17244
Published: 2018-12-20
Description: Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-362, CWE-200
References: http://www.securityfocus.com/bid/106318; https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594; https://www.elastic.co/community/security
CVE: CVE-2018-17245
Published: 2018-12-20
Description: Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-201, CWE-522
References: https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594
CVE: CVE-2018-17246
Published: 2018-12-20
Description: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-73, CWE-829
References: http://www.securityfocus.com/bid/106285; https://access.redhat.com/errata/RHBA-2018:3743; https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594
CVE: CVE-2018-17247
Published: 2018-12-20
Description: Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/106294; https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594; https://www.elastic.co/community/security
CVE: CVE-2017-9732
Published: 2018-12-20
Description: The read_packet function in knc (Kerberised NetCat) before 1.11-1 is vulnerable to denial of service (memory exhaustion) that can be exploited remotely without authentication, possibly affecting another services running on the targeted host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://packetstormsecurity.com/files/150534/knc-Kerberized-NetCat-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2018/Nov/65; https://github.com/elric1/knc/commit/f237f3e09ecbaf59c897f5046538a7b1a3fa40c1
CVE: CVE-2018-12651
Published: 2018-12-20
Description: A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the ShiftEmployeeSearch.aspx prntFrmName or prntDDLCntrlName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.knowcybersec.com/2018/12/CVE-2018-12651-reflected-XSS.html; https://www.securethy.com/2018/12/CVE-2018-12651-reflected-XSS.html; https://www.knowcybersec.com/2018/12/CVE-2018-12651-reflected-XSS.html
CVE: CVE-2018-14846
Published: 2018-12-20
Description: The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://ansawaf.blogspot.com/2018/10/cve-2018-14846-multiple-stored-xss-in.html; https://cwatch.comodo.com/blog/website-security/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5/; https://wpvulndb.com/vulnerabilities/9186
CVE: CVE-2018-16627
Published: 2018-12-20
Description: panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://github.com/security-breachlock/CVE-2018-16627; https://github.com/security-breachlock/CVE-2018-16627
CVE: CVE-2018-18388
Published: 2018-12-20
Description: eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222.
CVSS Score: 9.8 (CRITICAL)
References: http://blog.escanav.com/2018/11/cve-2018-18388/; http://blog.escanav.com/2018/11/cve-2018-18388/
CVE: CVE-2018-18399
Published: 2018-12-20
Description: SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/150810/KARMA-6.0.0-SQL-Injection.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]; http://packetstormsecurity.com/files/150810/KARMA-6.0.0-SQL-Injection.html
CVE: CVE-2018-18441
Published: 2018-12-20
Description: D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: <Camera-IP>/common/info.cgi, with no authentication. The configuration file include the following fields: model, product, brand, version, build, hw_version, nipca version, device name, location, MAC address, IP address, gateway IP address, wireless status, input/output settings, speaker, and sensor settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/; https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/
CVE: CVE-2018-18442
Published: 2018-12-20
Description: D-Link DCS-825L devices with firmware 1.08 do not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e., live-online video/audio streaming) by using the hping3 tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding, UDP flooding, ICMP flooding, and SYN-ACK flooding.
CVSS Score: 7.5 (HIGH)
References: https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/; https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/
CVE: CVE-2018-18629
Published: 2018-12-20
Description: An issue was discovered in the Keybase command-line client before 2.8.0[PII_REDACTED]4437 for Linux. An untrusted search path vulnerability in the keybase-redirector application allows a local, unprivileged user on Linux to gain root privileges via a Trojan horse binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://blog.mirch.io/2018/12/21/cve-2018-18629-keybase-linux-privilege-escalation/; https://hackerone.com/reports/426944; https://keybase.io/docs/secadv/kb002
CVE: CVE-2018-18767
Published: 2018-12-20
Description: An issue was discovered in D-Link 'myDlink Baby App' version 2.04.06. Whenever actions are performed from the app (e.g., change camera settings or play lullabies), it communicates directly with the Wi-Fi camera (D-Link 825L firmware 1.08) with the credentials (username and password) in base64 cleartext. An attacker could conduct an MitM attack on the local network and very easily obtain these credentials.
CVSS Score: 7.0 (HIGH)
CWE: CWE-326
References: https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/; https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor/
CVE: CVE-2018-19134
Published: 2018-12-20
Description: In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=693baf02152119af6e6afd30bb8ec76d14f84bbf; http://www.securityfocus.com/bid/106278; https://access.redhat.com/errata/RHSA-2018:3834
CVE: CVE-2018-19239
Published: 2018-12-20
Description: TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the start_arpping function of the timer binary, which allows remote attackers to execute arbitrary commands via three parameters (dhcpd_start, dhcpd_end, and lan_ipaddr) passed to the apply.cgi binary through a POST request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/21; http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html
CVE: CVE-2018-19240
Published: 2018-12-20
Description: Buffer overflow in network.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (without authentication).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/21; http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html
CVE: CVE-2018-19241
Published: 2018-12-20
Description: Buffer overflow in video.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (without authentication).
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/21; http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html
CVE: CVE-2018-19242
Published: 2018-12-20
Description: Buffer overflow in apply.cgi on TRENDnet TEW-632BRP 1.010B32 and TEW-673GRU devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (with authentication).
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/21; http://packetstormsecurity.com/files/150693/TRENDnet-Command-Injection-Buffer-Overflow-Cross-Site-Scripting.html
CVE: CVE-2018-20124
Published: 2018-12-20
Description: hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2018/12/18/2; http://www.securityfocus.com/bid/106290; https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02822.html
CVE: CVE-2018-20191
Published: 2018-12-20
Description: hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2018/12/18/1; http://www.securityfocus.com/bid/106276; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/
CVE: CVE-2018-20318
Published: 2018-12-21
Description: An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/Wechat-Group/weixin-java-tools/issues/889; https://github.com/Wechat-Group/weixin-java-tools/issues/889
CVE: CVE-2018-20327
Published: 2018-12-21
Description: Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/814049e5bd5317d761dda0ebbbc519cb2a64ab6c; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-32-2018-11-28-Low-risk-More-XSS-and-path-disclosure-issues; https://github.com/chamilo/chamilo-lms/commit/814049e5bd5317d761dda0ebbbc519cb2a64ab6c
CVE: CVE-2018-20328
Published: 2018-12-21
Description: Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/5e61c2b0fcc938ca687b8d4e593b1500aa52a034; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-32-2018-11-28-Low-risk-More-XSS-and-path-disclosure-issues; https://github.com/chamilo/chamilo-lms/commit/5e61c2b0fcc938ca687b8d4e593b1500aa52a034
CVE: CVE-2018-20329
Published: 2018-12-21
Description: Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/chamilo/chamilo-lms/commit/bfa1eccfabb457b800618d9d115f12dc614a55df; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-33-2018-12-13-Moderate-risk-high-impact-SQL-Injection; https://github.com/chamilo/chamilo-lms/commit/bfa1eccfabb457b800618d9d115f12dc614a55df
CVE: CVE-2018-20330
Published: 2018-12-21
Description: The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled, as demonstrated by tjbench.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://github.com/libjpeg-turbo/libjpeg-turbo/issues/304; https://usn.ubuntu.com/4190-1/; https://github.com/libjpeg-turbo/libjpeg-turbo/issues/304
CVE: CVE-2018-20332
Published: 2018-12-21
Description: An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download&file= followed by a full pathname, and listing of arbitrary directories is possible with /file?action=download&dir= followed by a full pathname. This is related to plugin/controllers/file.py in the e2openplugin-OpenWebif project.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://danieltindall.me/openwebif-vulnerabilities; https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/commit/a846b7664eda3a4c51a452e00638cf7337dc2013; https://danieltindall.me/openwebif-vulnerabilities
CVE: CVE-2018-20337
Published: 2018-12-21
Description: There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibRaw/LibRaw/issues/192; https://usn.ubuntu.com/3989-1/; https://github.com/LibRaw/LibRaw/issues/192
CVE: CVE-2018-20338
Published: 2018-12-21
Description: Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/106302; https://www.manageengine.com/network-monitoring/help/read-me.html; http://www.securityfocus.com/bid/106302
CVE: CVE-2018-20339
Published: 2018-12-21
Description: Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106302; https://www.manageengine.com/network-monitoring/help/read-me.html; http://www.securityfocus.com/bid/106302
CVE: CVE-2018-11794
Published: 2018-12-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it did not affect any released versions.  Notes: none
CVE: CVE-2018-18330
Published: 2018-12-21
Description: An Address Bar Spoofing vulnerability in Trend Micro Dr. Safety for Android (Consumer) versions 3.0.1324 and below could allow an attacker to potentially trick a victim into visiting a malicious URL using address bar spoofing on the Private Browser of the app on vulnerable installations.
CVSS Score: 6.5 (MEDIUM)
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1121673.aspx; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1121673.aspx
CVE: CVE-2018-18331
Published: 2018-12-21
Description: A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alter the files, which could lead to other exploits on vulnerable installations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://success.trendmicro.com/solution/1121674; https://success.trendmicro.com/solution/1121674
CVE: CVE-2018-18332
Published: 2018-12-21
Description: A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key files to modify other files and folders on vulnerable installations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://success.trendmicro.com/solution/1121674; https://success.trendmicro.com/solution/1121674
CVE: CVE-2018-5196
Published: 2018-12-21
Description: Alzip 10.76.0.0 and earlier is vulnerable to a stack overflow caused by improper bounds checking. By persuading a victim to open a specially-crafted LZH archive file, a attacker could execute arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.altools.co.kr/Support/Notice_Contents.aspx?idx=1677&page=2&t=; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=27688; https://www.altools.co.kr/Support/Notice_Contents.aspx?idx=1677&page=2&t=
CVE: CVE-2018-5201
Published: 2018-12-21
Description: Hancom Office 2018 10.0.0.8214 and earlier, Hancom Office NEO 9.6.1.10472 and earlier, Hancom Office 2014 9.1.1.4540 and earlier, Hancom Office 2010 8.5.8.1724 and earlier versions have a heap overflow vulnerability when handling Compound File in document. This result in a program crash or denial of service conditions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30116; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30116
CVE: CVE-2018-5202
Published: 2018-12-21
Description: SKCertService 2.5.5 and earlier contains a vulnerability that could allow remote attacker to execute arbitrary code. This vulnerability exists due to the way .dll files are loaded by SKCertService. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge.
CVSS Score: 7.8 (HIGH)
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30119; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30119
CVE: CVE-2018-20342
Published: 2018-12-21
Description: The Floureon IP Camera SP012 provides a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://neolex-security.fr/article/obtenir-un-shell-root-par-les-ports-uart-sur-une-camera-ip-floureon/; https://neolex-security.fr/blog/8/; https://neolex-security.fr/blog/7/
CVE: CVE-2018-20345
Published: 2018-12-21
Description: Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=<username>" query filter parameters. Enterprise editions with RBAC enabled are not affected.
CVSS Score: 5.3 (MEDIUM)
References: https://stackstorm.com/2018/12/20/stackstorm-v2-9-2-and-v2-10-1-a-security-release/; https://stackstorm.com/2018/12/20/stackstorm-v2-9-2-and-v2-10-1-a-security-release/
CVE: CVE-2018-20346
Published: 2018-12-21
Description: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html; http://www.securityfocus.com/bid/106323