deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-14636
Published: 2018-09-10
Description: Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-300
References: https://bugs.launchpad.net/neutron/+bug/1734320; https://bugs.launchpad.net/neutron/+bug/1767422; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636
CVE: CVE-2018-3875
Published: 2018-09-10
Description: An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy overflows the destination buffer, which has a size of 2,000 bytes. An attacker can send an arbitrarily long "sessionToken" value in order to exploit this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555
CVE: CVE-2018-11775
Published: 2018-09-10
Description: TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt; http://www.securityfocus.com/bid/105335; http://www.securitytracker.com/id/1041618
CVE: CVE-2018-16805
Published: 2018-09-10
Description: In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/b3log/solo/issues/12501; https://github.com/b3log/solo/issues/12501
CVE: CVE-2018-16806
Published: 2018-09-10
Description: A Pektron Passive Keyless Entry and Start (PKES) system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipher, which makes it easier for attackers to obtain access via an approach involving a 5.4 TB precomputation, followed by wake-frame reception and two challenge/response operations, to clone a key fob within a few seconds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: https://www.esat.kuleuven.be/cosic/fast-furious-and-insecure-passive-keyless-entry-and-start-in-modern-supercars/; https://www.esat.kuleuven.be/cosic/fast-furious-and-insecure-passive-keyless-entry-and-start-in-modern-supercars/
CVE: CVE-2018-16807
Published: 2018-09-11
Description: In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol parser.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/bro/bro/commit/34d0cf886ca16c665f673a299e295b2a2bc14533; https://github.com/bro/bro/commit/34d0cf886ca16c665f673a299e295b2a2bc14533
CVE: CVE-2018-1571
Published: 2018-09-11
Description: IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 143121.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/105333; https://exchange.xforce.ibmcloud.com/vulnerabilities/143121; https://www-01.ibm.com/support/docview.wss?uid=ibm10729701
CVE: CVE-2016-0750
Published: 2018-09-11
Description: The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-138, CWE-502
References: http://www.securityfocus.com/bid/101910; https://access.redhat.com/errata/RHSA-2017:3244; https://access.redhat.com/errata/RHSA-2018:0501
CVE: CVE-2016-7047
Published: 2018-09-11
Description: A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/99329; https://access.redhat.com/errata/RHSA-2017:1601; https://access.redhat.com/errata/RHSA-2017:1758
CVE: CVE-2016-7068
Published: 2018-09-11
Description: An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7068; https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/; https://www.debian.org/security/2017/dsa-3763
CVE: CVE-2016-7069
Published: 2018-09-11
Description: An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100509; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7069; https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2017-01.html
CVE: CVE-2016-7070
Published: 2018-09-11
Description: A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database.
CVSS Score: 8.0 (HIGH)
CWE: CWE-266, CWE-264
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7070; https://docs.ansible.com/ansible-tower/3.0.3/html/upgrade-migration-guide/release_notes.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7070
CVE: CVE-2016-7073
Published: 2018-09-11
Description: An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever, leading to a possible replay attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7073; https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/; https://www.debian.org/security/2017/dsa-3764
CVE: CVE-2016-7074
Published: 2018-09-11
Description: An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7074; https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/; https://www.debian.org/security/2017/dsa-3764
CVE: CVE-2018-16831
Published: 2018-09-11
Description: Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statement.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/smarty-php/smarty/issues/486; https://github.com/smarty-php/smarty/issues/486
CVE: CVE-2018-16832
Published: 2018-09-11
Description: CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/ysrc/xunfeng/issues/177; https://github.com/ysrc/xunfeng/issues/177
CVE: CVE-2016-7066
Published: 2018-09-11
Description: It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to connect to CLI and allow the user to execute any arbitrary operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266, CWE-275
References: https://access.redhat.com/errata/RHSA-2017:3456; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7066; https://access.redhat.com/errata/RHSA-2017:3456
CVE: CVE-2018-10853
Published: 2018-09-11
Description: A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.
CVSS Score: 7.0 (HIGH)
CWE: CWE-250, CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html; https://access.redhat.com/errata/RHSA-2019:2029; https://access.redhat.com/errata/RHSA-2019:2043
CVE: CVE-2018-6975
Published: 2018-09-11
Description: The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-311
References: http://www.securityfocus.com/bid/105356; http://www.securitytracker.com/id/1041604; https://www.vmware.com/security/advisories/VMSA-2018-0023.html
CVE: CVE-2018-6976
Published: 2018-09-11
Description: The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted filenames and associated metadata in SQLite database for the Content Locker.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: http://www.securityfocus.com/bid/105367; http://www.securitytracker.com/id/1041604; https://www.vmware.com/security/advisories/VMSA-2018-0023.html
CVE: CVE-2018-10893
Published: 2018-09-11
Description: Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.
CVSS Score: 7.6 (HIGH)
CWE: CWE-122, CWE-190, CWE-190
References: https://access.redhat.com/errata/RHSA-2019:2229; https://access.redhat.com/errata/RHSA-2020:0471; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10893
CVE: CVE-2018-10935
Published: 2018-09-11
Description: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html; https://access.redhat.com/errata/RHSA-2018:2757; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10935
CVE: CVE-2018-1114
Published: 2018-09-11
Description: It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://access.redhat.com/errata/RHSA-2018:2643; https://access.redhat.com/errata/RHSA-2018:2669; https://access.redhat.com/errata/RHSA-2019:0877
CVE: CVE-2018-1127
Published: 2018-09-11
Description: Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-613, CWE-384
References: http://www.securitytracker.com/id/1041597; https://access.redhat.com/errata/RHSA-2018:2616; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1127
CVE: CVE-2018-2452
Published: 2018-09-11
Description: The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105325; https://launchpad.support.sap.com/#/notes/2623846; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2454
Published: 2018-09-11
Description: SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/105316; https://launchpad.support.sap.com/#/notes/2645133; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2455
Published: 2018-09-11
Description: SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_SEPA) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/105320; https://launchpad.support.sap.com/#/notes/2646067; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2457
Published: 2018-09-11
Description: Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access information which would otherwise be restricted.
CVSS Score: 6.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2679788; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993; https://launchpad.support.sap.com/#/notes/2679788
CVE: CVE-2018-2458
Published: 2018-09-11
Description: Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attacker to access information which would otherwise be restricted.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/105307; https://launchpad.support.sap.com/#/notes/2670284; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2459
Published: 2018-09-11
Description: Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by default), occasionally receive some data values of a different user.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/105338; https://launchpad.support.sap.com/#/notes/2672919; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2460
Published: 2018-09-11
Description: SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/105309; https://launchpad.support.sap.com/#/notes/2682503; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2461
Published: 2018-09-11
Description: Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which may result in an escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/105327; https://launchpad.support.sap.com/#/notes/2673959; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2462
Published: 2018-09-11
Description: In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105326; https://launchpad.support.sap.com/#/notes/2644279; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2463
Published: 2018-09-11
Description: The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: http://www.securityfocus.com/bid/105339; https://launchpad.support.sap.com/#/notes/2680834; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2464
Published: 2018-09-11
Description: SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105308; https://launchpad.support.sap.com/#/notes/2679378; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-2465
Published: 2018-09-11
Description: SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized hacker can cause the database server to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105324; https://launchpad.support.sap.com/#/notes/2681207; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE: CVE-2018-10937
Published: 2018-09-11
Description: A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/105190; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10937; https://github.com/openshift/console/commit/d56666852da6e7309a2e63a49f49a72ff66d309c
CVE: CVE-2018-16836
Published: 2018-09-11
Description: Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/maroueneboubakri/CVE/tree/master/rubedo-cms; https://www.exploit-db.com/exploits/45385/; https://github.com/maroueneboubakri/CVE/tree/master/rubedo-cms
CVE: CVE-2016-0715
Published: 2018-09-11
Description: Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosure. It was found that original mitigation configuration instructions provided as part of CVE-2016-0708 were incomplete and could leave PHP Buildpack, Staticfile Buildpack and potentially other custom Buildpack applications vulnerable to remote information disclosure. Affected applications use automated buildpack detection, serve files directly from the root of the application and have a buildpack that matched after the Java Buildpack in the system buildpack priority when Java Buildpack versions 2.0 through 3.4 were present.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://pivotal.io/security/cve-2016-0715; https://pivotal.io/security/cve-2016-0715
CVE: CVE-2017-3170
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3171
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3172
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3173
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3174
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3175
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3176
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3177
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3178
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3179
Published: 2018-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2018-11068
Published: 2018-09-11
Description: RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physical access to the system to recover sensitive key material.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-459
References: http://www.securitytracker.com/id/1041614; https://seclists.org/fulldisclosure/2018/Sep/7; http://www.securitytracker.com/id/1041614
CVE: CVE-2018-11069
Published: 2018-09-11
Description: RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: http://www.securitytracker.com/id/1041614; https://seclists.org/fulldisclosure/2018/Sep/7; http://www.securitytracker.com/id/1041614