deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7213
Published: 2018-03-11
Description: The Password Manager Extension in Abine Blur 7.8.242* before 7.8.2428 allows attackers to bypass the Multi-Factor Authentication and macOS disk-encryption protection mechanisms, and consequently exfiltrate secured data, because the right-click context menu is not secured.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2019/Mar/33; https://addons.mozilla.org/en-US/firefox/addon/donottrackplus/versions/?page=1#version-7.8.2428
CVE: CVE-2018-8050
Published: 2018-03-11
Description: The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation fault) via a corrupt AFF image that triggers an unexpected pagesize value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/sshock/AFFLIBv3/commit/435a2ca802358a3debb6d164d2c33049131df81c; https://github.com/sshock/AFFLIBv3/commit/435a2ca802358a3debb6d164d2c33049131df81c
CVE: CVE-2018-8056
Published: 2018-03-11
Description: Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/manage/channel/addchannel or a direct request to /export.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Kyhvedn/CVE_Description/blob/master/Cobub_Razor_0.8.0_physical_path_leakage.md; https://github.com/cobub/razor/issues/162; https://www.exploit-db.com/exploits/44495/
CVE: CVE-2018-8057
Published: 2018-03-11
Description: A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Kyhvedn/CVE_Description/blob/master/Cobub_Razor_0.8.0_SQL_injection_description.md; https://github.com/cobub/razor/issues/162; https://www.exploit-db.com/exploits/44454/
CVE: CVE-2018-8059
Published: 2018-03-11
Description: The Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to certain configurations involving Docker Compose, have a Missing SSL Certificate Validation issue because no proxy_ssl_* directives are used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: http://openwall.com/lists/oss-security/2018/03/07/4; https://exchange.xforce.ibmcloud.com/vulnerabilities/140144; http://openwall.com/lists/oss-security/2018/03/07/4
CVE: CVE-2014-8129
Published: 2018-03-12
Description: LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2, and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2487; http://bugzilla.maptools.org/show_bug.cgi?id=2488; http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
CVE: CVE-2014-8130
Published: 2018-03-12
Description: The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://bugzilla.maptools.org/show_bug.cgi?id=2483; http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
CVE: CVE-2016-5314
Published: 2018-03-12
Description: Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2554; http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.html; http://lists.opensuse.org/opensuse-updates/2016-07/msg00087.html
CVE: CVE-2016-5320
Published: 2018-03-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-5314.  Reason: This candidate is a reservation duplicate of CVE-2016-5314.  Notes: All CVE users should reference CVE-2016-5314 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-5875
Published: 2018-03-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-5314.  Reason: This candidate is a reservation duplicate of CVE-2016-5314.  Notes: All CVE users should reference CVE-2016-5314 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-18224
Published: 2018-03-12
Description: In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allows local users to cause a denial of service (BUG) by modifying a certain e_cpos field.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3e4c56d41eef[PII_REDACTED]a2ec5a483f42e8917f; http://www.securityfocus.com/bid/103353; https://github.com/torvalds/linux/commit/3e4c56d41eef[PII_REDACTED]a2ec5a483f42e8917f
CVE: CVE-2018-7893
Published: 2018-03-12
Description: CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md; https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md
CVE: CVE-2018-8058
Published: 2018-03-12
Description: CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md; https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md
CVE: CVE-2017-18225
Published: 2018-03-12
Description: The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which might allow local users to gain privileges by leveraging access to this account and then waiting for root to execute one of these programs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://bugs.gentoo.org/629412; https://bugs.gentoo.org/629412
CVE: CVE-2017-18226
Published: 2018-03-12
Description: The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM `cat /var/run/jabber/filename.pid`" command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://bugs.gentoo.org/631068; https://bugs.gentoo.org/631068
CVE: CVE-2017-18227
Published: 2018-03-12
Description: TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://dx.doi.org/10.14722/ndss.2017.23456; https://jhalderm.com/pub/papers/interception-ndss17.pdf; https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/security-impact-https-interception/
CVE: CVE-2018-8065
Published: 2018-03-12
Description: An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe memory region that can be triggered by rapidly sending a variety of HTTP requests with long HTTP header values or long URIs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/172676/Flexense-HTTP-Server-10.6.24-Buffer-Overflow-Denial-Of-Service.html; https://github.com/EgeBalci/Sync_Breeze_Enterprise_10_6_24_-DOS; https://github.com/rapid7/metasploit-framework/pull/9701
CVE: CVE-2018-8069
Published: 2018-03-12
Description: QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/imsebao/404team/blob/master/qcms/qcms.md; https://github.com/imsebao/404team/blob/master/qcms/qcms.md
CVE: CVE-2018-8070
Published: 2018-03-12
Description: QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/imsebao/404team/blob/master/qcms_xss/qcms_xss.md; https://github.com/imsebao/404team/blob/master/qcms_xss/qcms_xss.md
CVE: CVE-2015-5205
Published: 2018-03-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015.  Notes: none
CVE: CVE-2017-15719
Published: 2018-03-12
Description: In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://openmeetings.apache.org/security.html#_toc_cve-2017-15719_-_wicket_jquery_ui_xss_in_wysiwyg_e; https://github.com/sebfz1/wicket-jquery-ui/wiki#cve-2017-15719---xss-in-wysiwyg-editor; http://openmeetings.apache.org/security.html#_toc_cve-2017-15719_-_wicket_jquery_ui_xss_in_wysiwyg_e
CVE: CVE-2017-6281
Published: 2018-03-12
Description: NVIDIA libnvomx contains a possible out of bounds write due to a improper input validation which could lead to local escalation of privilege. This issue is rated as high. Product: Android. Version: N/A. Android: A-66969318. Reference: N-CVE-2017-6281.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: http://www.securityfocus.com/bid/103286; https://source.android.com/security/bulletin/2018-03-01; http://www.securityfocus.com/bid/103286
CVE: CVE-2017-6285
Published: 2018-03-12
Description: NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure. This issue is rated as moderate. Product: Android. Version: N/A. Android: A-64893156. Reference: N-CVE-2017-6285.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-6286
Published: 2018-03-12
Description: NVIDIA libnvomx contains a possible out of bounds write due to a missing bounds check which could lead to local escalation of privilege. This issue is rated as high. Product: Android. Version: N/A. Android: A-64893247. Reference: N-CVE-2017-6286.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103286; https://source.android.com/security/bulletin/2018-03-01; http://www.securityfocus.com/bid/103286
CVE: CVE-2017-6287
Published: 2018-03-12
Description: NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure. This issue is rated as moderate.Product: Android. Version: N/A. Android: A-64893264. Reference: N-CVE-2017-6287.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-6288
Published: 2018-03-12
Description: NVIDIA libnvrm contains a possible out of bounds read due to a missing bounds check which could lead to local information disclosure. This issue is rated as moderate. Product: Android. Version: N/A. Android: A-65482562. Reference: N-CVE-2017-6288.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2016-8629
Published: 2018-03-12
Description: Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-264
References: http://rhn.redhat.com/errata/RHSA-2017-0876.html; http://www.securityfocus.com/bid/97392; http://www.securitytracker.com/id/1038180
CVE: CVE-2016-9589
Published: 2018-03-12
Description: Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://rhn.redhat.com/errata/RHSA-2017-0830.html; http://rhn.redhat.com/errata/RHSA-2017-0831.html; http://rhn.redhat.com/errata/RHSA-2017-0832.html
CVE: CVE-2016-9600
Published: 2018-03-12
Description: JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2017:1208; https://bugzilla.redhat.com/show_bug.cgi?id=1410026; https://usn.ubuntu.com/3693-1/
CVE: CVE-2017-2585
Published: 2018-03-12
Description: Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2017-0876.html; http://www.securityfocus.com/bid/97393; http://www.securitytracker.com/id/1038180
CVE: CVE-2017-2619
Published: 2018-03-12
Description: Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-59, CWE-362
References: http://www.securityfocus.com/bid/97033; http://www.securitytracker.com/id/1038117; https://access.redhat.com/errata/RHSA-2017:1265
CVE: CVE-2017-2628
Published: 2018-03-12
Description: curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2017-0847.html; http://www.securityfocus.com/bid/97187; https://bugzilla.redhat.com/show_bug.cgi?id=1422464
CVE: CVE-2017-2661
Published: 2018-03-12
Description: ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1428948; https://github.com/ClusterLabs/pcs/commit/1874a769b5720ae5430f10c6cedd234430bc703f; https://bugzilla.redhat.com/show_bug.cgi?id=1428948
CVE: CVE-2017-2667
Published: 2018-03-12
Description: Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345, CWE-295
References: http://projects.theforeman.org/issues/19033; http://www.securityfocus.com/bid/97153; https://access.redhat.com/errata/RHSA-2018:0336
CVE: CVE-2018-1323
Published: 2018-03-12
Description: The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-200
References: http://www.securityfocus.com/bid/103389; https://access.redhat.com/errata/RHSA-2018:1843; https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E
CVE: CVE-2018-1206
Published: 2018-03-12
Description: Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contain a hardcoded database account with administrative privileges. The affected account is "apollosuperuser." An attacker with local access to the server where DPA Datastore Service is installed and knowledge of the password may potentially gain unauthorized access to the database. Note: The Datastore Service database cannot be accessed remotely using this account.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2018/Mar/22; http://www.securityfocus.com/bid/103376; http://www.securitytracker.com/id/1040484
CVE: CVE-2018-7749
Published: 2018-03-12
Description: The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4; https://groups.google.com/forum/#%21msg/asyncssh-announce/57_5O7kiHSA/8BXZ_hxHAQAJ; https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4
CVE: CVE-2016-0235
Published: 2018-03-12
Description: IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a hardcoded password, related to use on GRUB systems. IBM X-Force ID: 110326.
CVSS Score: 8.2 (HIGH)
CWE: CWE-798
References: http://www-01.ibm.com/support/docview.wss?uid=swg21981748; https://exchange.xforce.ibmcloud.com/vulnerabilities/110326; http://www-01.ibm.com/support/docview.wss?uid=swg21981748
CVE: CVE-2016-0237
Published: 2018-03-12
Description: IBM Security Guardium Database Activity Monitor 10 allows local users to obtain sensitive information by reading cached browser data. IBM X-Force ID: 110328.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21981631; https://exchange.xforce.ibmcloud.com/vulnerabilities/110328; http://www-01.ibm.com/support/docview.wss?uid=swg21981631
CVE: CVE-2016-0250
Published: 2018-03-12
Description: XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-611
References: http://www-01.ibm.com/support/docview.wss?uid=swg21977152; https://exchange.xforce.ibmcloud.com/vulnerabilities/110510; http://www-01.ibm.com/support/docview.wss?uid=swg21977152
CVE: CVE-2016-0261
Published: 2018-03-12
Description: Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1 iFix1, and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110604.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21981103; https://exchange.xforce.ibmcloud.com/vulnerabilities/110604; http://www-01.ibm.com/support/docview.wss?uid=swg21981103
CVE: CVE-2016-9952
Published: 2018-03-12
Description: The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by "*.com."
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://curl.haxx.se/CVE-2016-9952.patch; https://curl.haxx.se/docs/adv_20161221B.html; https://curl.haxx.se/CVE-2016-9952.patch
CVE: CVE-2016-9953
Published: 2018-03-12
Description: The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://curl.haxx.se/CVE-2016-9952.patch; https://curl.haxx.se/docs/adv_20161221C.html; https://curl.haxx.se/CVE-2016-9952.patch
CVE: CVE-2018-5758
Published: 2018-03-12
Description: The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://rhinosecuritylabs.com/research/xml-external-entity-injection-xxe-cve-2018-5758/; https://rhinosecuritylabs.com/research/xml-external-entity-injection-xxe-cve-2018-5758/
CVE: CVE-2018-6016
Published: 2018-03-12
Description: Unquoted Windows search path vulnerability in the srvInventoryWebServer service in 10-Strike Network Monitor 5.4 allows local users to gain privileges via a malicious artefact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://seclists.org/fulldisclosure/2018/Mar/21; http://seclists.org/fulldisclosure/2018/Mar/21
CVE: CVE-2018-6183
Published: 2018-03-12
Description: BitDefender Total Security 2018 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of an "insecurely created named pipe". Ensures full access to Everyone users group.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2018/Mar/24; http://seclists.org/fulldisclosure/2018/Mar/24
CVE: CVE-2018-6321
Published: 2018-03-12
Description: Unquoted Windows search path vulnerability in the panda_url_filtering service in Panda Global Protection 17.0.1 allows local users to gain privileges via a malicious artefact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://seclists.org/fulldisclosure/2018/Mar/25; http://seclists.org/fulldisclosure/2018/Mar/25
CVE: CVE-2018-6322
Published: 2018-03-12
Description: Panda Global Protection 17.0.1 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of \.\pipe\PSANMSrvcPpal -- an "insecurely created named pipe." Ensures full access to Everyone users group.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2018/Mar/26; http://seclists.org/fulldisclosure/2018/Mar/26
CVE: CVE-2018-6400
Published: 2018-03-12
Description: Kingsoft WPS Office Free 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of \\.\pipe\WPSCloudSvr\WpsCloudSvr -- an "insecurely created named pipe." Ensures full access to Everyone users group.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2018/Mar/27; http://seclists.org/fulldisclosure/2018/Mar/27