deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7998
Published: 2018-01-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) printer name when adding a printer in the admin panel or (2) username parameter to webapp/users/user_reg.jsp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Jan/13; https://sysdream.com/news/lab/2018-01-02-cve-2017-7998-gespage-stored-cross-site-scripting-xss-vulnerability/; http://seclists.org/fulldisclosure/2018/Jan/13
CVE: CVE-2018-5301
Published: 2018-01-08
Description: Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://magento.com/security/patches/magento-2010-and-212-security-update; https://magento.com/security/patches/magento-2010-and-212-security-update
CVE: CVE-2018-5263
Published: 2018-01-08
Description: The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://stackideas.com/blog/easydiscuss4021-update; https://www.exploit-db.com/exploits/43488/; https://stackideas.com/blog/easydiscuss4021-update
CVE: CVE-2012-3353
Published: 2018-01-09
Description: The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://issues.apache.org/jira/browse/SLING-2512; https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a%40%3Cdev.sling.apache.org%3E; https://issues.apache.org/jira/browse/SLING-2512
CVE: CVE-2017-18025
Published: 2018-01-09
Description: cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.exploit-db.com/exploits/43343/; https://www.exploit-db.com/exploits/43343/
CVE: CVE-2018-5308
Published: 2018-01-09
Description: PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1532390; https://bugzilla.redhat.com/show_bug.cgi?id=1532390
CVE: CVE-2018-5309
Published: 2018-01-09
Description: In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1532381; https://bugzilla.redhat.com/show_bug.cgi?id=1532381
CVE: CVE-2018-5310
Published: 2018-01-09
Description: In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/media-from-ftp.md; https://wordpress.org/plugins/media-from-ftp/#developers; https://wordpress.org/support/topic/any-directory-traversal-bugs-at-the-latest-version-of-media-from-ftp/
CVE: CVE-2018-5311
Published: 2018-01-09
Description: The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/easy-custom-auto-excerpt.md; https://wordpress.org/support/topic/stored-xss-bugs-at-the-latest-version-of-easy-custom-auto-excerpt/; https://github.com/d4wner/Vulnerabilities-Report/blob/master/easy-custom-auto-excerpt.md
CVE: CVE-2018-5312
Published: 2018-01-09
Description: The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/tabs-responsive.md; https://wordpress.org/support/topic/stored-xss-bugs-at-the-latest-version-of-tabs-responsive/; https://github.com/d4wner/Vulnerabilities-Report/blob/master/tabs-responsive.md
CVE: CVE-2018-2360
Published: 2018-01-09
Description: SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption of file system storage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://www.securityfocus.com/bid/102448; https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/; https://launchpad.support.sap.com/#/notes/2523961
CVE: CVE-2018-2361
Published: 2018-01-09
Description: In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for configuring the BPO tools.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/102450; https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/; https://launchpad.support.sap.com/#/notes/2507934
CVE: CVE-2018-2362
Published: 2018-01-09
Description: A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/102452; https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/; https://launchpad.support.sap.com/#/notes/2575750
CVE: CVE-2018-2363
Published: 2018-01-09
Description: SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/102449; https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/; https://launchpad.support.sap.com/#/notes/1906212
CVE: CVE-2015-1208
Published: 2018-01-09
Description: Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3ebd76a9c57558e284e94da367dd23b435e6a6d0; https://bugs.chromium.org/p/chromium/issues/detail?id=444546; https://github.com/FFmpeg/FFmpeg/blob/n2.4.6/Changelog
CVE: CVE-2015-1290
Published: 2018-01-09
Description: The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.5.1; http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2015-12/msg00116.html
CVE: CVE-2018-5211
Published: 2018-01-09
Description: PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43409/; https://www.exploit-db.com/exploits/43409/
CVE: CVE-2018-5221
Published: 2018-01-09
Description: Multiple buffer overflows in BarCodeWiz BarCode before 6.7 ActiveX control (BarcodeWiz.DLL) allow remote attackers to execute arbitrary code via a long argument to the (1) BottomText or (2) TopText property.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://hyp3rlinx.altervista.org/advisories/BARCODEWIZ-v6.7-ACTIVEX-COMPONENT-BUFFER-OVERFLOW.txt; http://packetstormsecurity.com/files/145731/BarcodeWiz-ActiveX-Control-Buffer-Overflow.html; http://hyp3rlinx.altervista.org/advisories/BARCODEWIZ-v6.7-ACTIVEX-COMPONENT-BUFFER-OVERFLOW.txt
CVE: CVE-2017-15129
Published: 2018-01-09
Description: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=21b[PII_REDACTED]d2583e82dd59b19a9ba94a007f0; http://seclists.org/oss-sec/2018/q1/7; http://www.securityfocus.com/bid/102485
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-09
Description: MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://www.ieee-security.org/TC/SP2017/papers/231.pdf; https://www.youtube.com/watch?v=FW--c_F_cY8; https://www.ieee-security.org/TC/SP2017/papers/231.pdf
CVE: CVE-2017-1493
Published: 2018-01-09
Description: IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. IBM X-Force ID: 128691.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-269
References: http://www.ibm.com/support/docview.wss?uid=swg2C1000367; http://www.securityfocus.com/bid/102483; https://exchange.xforce.ibmcloud.com/vulnerabilities/128691
CVE: CVE-2017-1612
Published: 2018-01-09
Description: IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22009918; http://www.securityfocus.com/bid/102479; http://www.securitytracker.com/id/1040175
CVE: CVE-2017-1666
Published: 2018-01-09
Description: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 133540.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg22011970; http://www.securityfocus.com/bid/102434; https://exchange.xforce.ibmcloud.com/vulnerabilities/133560
CVE: CVE-2017-1668
Published: 2018-01-09
Description: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 133562.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22012010; http://www.securityfocus.com/bid/102430; https://exchange.xforce.ibmcloud.com/vulnerabilities/133562
CVE: CVE-2017-1670
Published: 2018-01-09
Description: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 133637.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg22012009; http://www.securityfocus.com/bid/102429; https://exchange.xforce.ibmcloud.com/vulnerabilities/133637
CVE: CVE-2017-1671
Published: 2018-01-09
Description: IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 133638.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.ibm.com/support/docview.wss?uid=swg22011967; http://www.securityfocus.com/bid/102487; https://exchange.xforce.ibmcloud.com/vulnerabilities/133638
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-09
Description: rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lucifaer.com/index.php/archives/35/; http://lucifaer.com/index.php/archives/35/
CVE: CVE-2017-12695
Published: 2018-01-09
Description: An Improper Authentication issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to subvert security mechanisms and reset a user account password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/102481; https://ics-cert.us-cert.gov/advisories/ICSA-17-234-04; http://www.securityfocus.com/bid/102481
CVE: CVE-2017-12697
Published: 2018-01-09
Description: A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to intercept sensitive information when the client connects to the server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-300, CWE-200
References: http://www.securityfocus.com/bid/102481; https://ics-cert.us-cert.gov/advisories/ICSA-17-234-04; http://www.securityfocus.com/bid/102481
CVE: CVE-2017-15124
Published: 2018-01-09
Description: VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-20
References: http://www.securityfocus.com/bid/102295; https://access.redhat.com/errata/RHSA-2018:0816; https://access.redhat.com/errata/RHSA-2018:1104
CVE: CVE-2017-15131
Published: 2018-01-09
Description: It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-276
References: https://access.redhat.com/errata/RHSA-2018:0842; https://bugzilla.redhat.com/show_bug.cgi?id=1412762; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE: CVE-2017-16740
Published: 2018-01-09
Description: A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and earlier. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-120, CWE-119
References: http://www.securityfocus.com/bid/102474; https://ics-cert.us-cert.gov/advisories/ICSA-18-009-01; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1070883
CVE: CVE-2017-9663
Published: 2018-01-09
Description: An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow a remote attacker to access an encryption key that is stored in cleartext in memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: http://www.securityfocus.com/bid/102481; https://ics-cert.us-cert.gov/advisories/ICSA-17-234-04; http://www.securityfocus.com/bid/102481
CVE: CVE-2018-3610
Published: 2018-01-09
Description: SEMA driver in Intel Driver and Support Assistant before version 3.1.1 allows a local attacker the ability to read and writing to Memory Status registers potentially allowing information disclosure or a denial of service condition.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00108&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00108&languageid=en-fr
CVE: CVE-2018-4871
Published: 2018-01-09
Description: An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102465; http://www.securitytracker.com/id/1040155; https://access.redhat.com/errata/RHSA-2018:0081
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-09
Description: Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in disruption of service and execution of javascript code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sulu/sulu-standard/issues/835; https://github.com/sulu/sulu-standard/issues/835
CVE: CVE-2018-5316
Published: 2018-01-09
Description: The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/145459/WordPress-Sagepay-Server-Gateway-For-WooCommerce-1.0.7-XSS.html; https://wordpress.org/plugins/sagepay-server-gateway-for-woocommerce/#developers; https://wordpress.org/support/topic/sagepay-server-gateway-for-woocommerce-1-0-7-cross-site-scripting/#post-9792337
CVE: CVE-2018-0764
Published: 2018-01-10
Description: Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/102387; http://www.securitytracker.com/id/1040152; https://access.redhat.com/errata/RHSA-2018:0379
CVE: CVE-2018-0784
Published: 2018-01-10
Description: ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0808.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102377; http://www.securitytracker.com/id/1040151; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0784
CVE: CVE-2018-0785
Published: 2018-01-10
Description: ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/102379; http://www.securitytracker.com/id/1040151; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0785
CVE: CVE-2018-0786
Published: 2018-01-10
Description: Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.securityfocus.com/bid/102380; http://www.securitytracker.com/id/1040152; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0786
CVE: CVE-2018-0789
Published: 2018-01-10
Description: Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0790.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102394; http://www.securitytracker.com/id/1040150; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0789
CVE: CVE-2018-0790
Published: 2018-01-10
Description: Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0789.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102391; http://www.securitytracker.com/id/1040150; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0790
CVE: CVE-2018-0791
Published: 2018-01-10
Description: Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerability due to the way email messages are parsed, aka "Microsoft Outlook Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0793.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102383; http://www.securitytracker.com/id/1040154; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0791
CVE: CVE-2018-0792
Published: 2018-01-10
Description: Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0794.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102381; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0792
CVE: CVE-2018-0793
Published: 2018-01-10
Description: Microsoft Outlook 2007, Microsoft Outlook 2010 and Microsoft Outlook 2013 allow a remote code execution vulnerability due to the way email messages are parsed, aka "Microsoft Outlook Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0791.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102375; http://www.securitytracker.com/id/1040154; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0793
CVE: CVE-2018-0794
Published: 2018-01-10
Description: Microsoft Word in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0792.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102373; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0794