deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-16778
Published: 2018-12-21
Description: Cross-site scripting (XSS) vulnerability in Jenzabar v8.2.1 through 9.2.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter (aka the Search Field).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://metamorfosec.com/Files/Advisories/METS-2018-004-A_XSS_Vulnerability_in_Jenzabar_8.2.1_to_9.2.0.txt; https://metamorfosec.com/Files/Advisories/METS-2018-004-A_XSS_Vulnerability_in_Jenzabar_8.2.1_to_9.2.0.txt
CVE: CVE-2018-18007
Published: 2018-12-21
Description: atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2018/Dec/38; http://www.securityfocus.com/bid/106337; http://seclists.org/fulldisclosure/2018/Dec/38
CVE: CVE-2018-18008
Published: 2018-12-21
Description: spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2018/Dec/45; http://www.securityfocus.com/bid/106344; http://seclists.org/fulldisclosure/2018/Dec/45
CVE: CVE-2018-18009
Published: 2018-12-21
Description: dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2018/Dec/46; http://www.securityfocus.com/bid/106336; http://seclists.org/fulldisclosure/2018/Dec/46
CVE: CVE-2018-19320
Published: 2018-12-21
Description: The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2018/Dec/39; http://www.securityfocus.com/bid/106252; https://www.gigabyte.com/Support/Security/1801
CVE: CVE-2018-19321
Published: 2018-12-21
Description: The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2018/Dec/39; http://www.securityfocus.com/bid/106252; https://www.gigabyte.com/Support/Security/1801
CVE: CVE-2018-19322
Published: 2018-12-21
Description: The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: http://seclists.org/fulldisclosure/2018/Dec/39; http://www.securityfocus.com/bid/106252; https://www.gigabyte.com/Support/Security/1801
CVE: CVE-2018-19323
Published: 2018-12-21
Description: The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
CVSS Score: 9.8 (CRITICAL)
References: http://seclists.org/fulldisclosure/2018/Dec/39; http://www.securityfocus.com/bid/106252; https://www.gigabyte.com/Support/Security/1801
CVE: CVE-2018-20193
Published: 2018-12-21
Description: Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 (build 9627) 4.2 Release (build 7631). This occurs because appropriate controls are not performed. Specifically, it is possible for a readonly user to change the administrator user password by making a local copy of the /dana-admin/user/update.cgi page, changing the "user" value, and saving the changes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2018/Dec/37; http://www.securityfocus.com/bid/106289; http://seclists.org/fulldisclosure/2018/Dec/37
CVE: CVE-2018-20226
Published: 2018-12-21
Description: An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method.
CVSS Score: 7.2 (HIGH)
References: https://github.com/TheHive-Project/Cortex/blob/2.1.3/CHANGELOG.md; https://github.com/TheHive-Project/Cortex/commit/1aaf2182a6b722ad539e2717bc11967d1bde723a; https://github.com/TheHive-Project/Cortex/issues/158
CVE: CVE-2018-20322
Published: 2018-12-21
Description: LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.limesurvey.org/view.php?id=14376; https://github.com/LimeSurvey/LimeSurvey/commit/bfee69edaa0b90f97dc2d8fab09a87958cb32405; https://bugs.limesurvey.org/view.php?id=14376
CVE: CVE-2018-20325
Published: 2018-12-21
Description: There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/danijar/definitions/issues/14; https://github.com/danijar/definitions/issues/14
CVE: CVE-2018-20348
Published: 2018-12-22
Description: libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/libyal/libpff/issues/48; https://github.com/libyal/libpff/issues/48
CVE: CVE-2018-20349
Published: 2018-12-22
Description: The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/igraph/igraph/issues/1141; https://lists.debian.org/debian-lts-announce/2019/12/msg00038.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NCGDUNQYLSZLSGN6JJBORVFW46U3A75Y/
CVE: CVE-2018-20351
Published: 2018-12-22
Description: The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.yinxiang.com/security/updates/; https://www.yinxiang.com/security/updates/
CVE: CVE-2018-19863
Published: 2018-12-22
Description: An issue was discovered in 1Password 7.2.3.BETA before 7.2.3.BETA-3 on macOS. A mistake in error logging resulted in instances where sensitive data passed from Safari to 1Password could be logged locally on the user's machine. This data could include usernames and passwords that a user manually entered into Safari.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://app-updates.agilebits.com/product_history/OPM7#v70203009; https://discussions.agilebits.com/discussion/99429/the-security-content-of=-betas-7-2-3-beta-3-and-7-2-3-beta-4/p1?new=3D1; https://support.1password.com/kb/201812/
CVE: CVE-2018-20357
Published: 2018-12-22
Description: A NULL pointer dereference was discovered in sbr_process_channel of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/knik0/faad2/issues/28; https://seclists.org/bugtraq/2019/Sep/28; https://security.gentoo.org/glsa/202006-17
CVE: CVE-2018-20358
Published: 2018-12-22
Description: An invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/knik0/faad2/issues/31; https://seclists.org/bugtraq/2019/Sep/28; https://security.gentoo.org/glsa/202006-17
CVE: CVE-2018-20359
Published: 2018-12-22
Description: An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/knik0/faad2/issues/29; https://seclists.org/bugtraq/2019/Sep/28; https://security.gentoo.org/glsa/202006-17
CVE: CVE-2018-20360
Published: 2018-12-22
Description: An invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/knik0/faad2/issues/32; https://lists.debian.org/debian-lts-announce/2019/08/msg00033.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html
CVE: CVE-2018-20361
Published: 2018-12-22
Description: An invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/knik0/faad2/issues/30; https://seclists.org/bugtraq/2019/Sep/28; https://security.gentoo.org/glsa/202006-17
CVE: CVE-2018-20362
Published: 2018-12-22
Description: A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash because adding to windowed output is mishandled in the EIGHT_SHORT_SEQUENCE case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/knik0/faad2/issues/26; https://lists.debian.org/debian-lts-announce/2019/05/msg00022.html; https://seclists.org/bugtraq/2019/Sep/28
CVE: CVE-2018-20363
Published: 2018-12-22
Description: LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/106299; https://github.com/LibRaw/LibRaw/issues/193; https://usn.ubuntu.com/3989-1/
CVE: CVE-2018-20364
Published: 2018-12-22
Description: LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/106299; https://github.com/LibRaw/LibRaw/issues/194; https://usn.ubuntu.com/3989-1/
CVE: CVE-2018-20365
Published: 2018-12-22
Description: LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106299; https://github.com/LibRaw/LibRaw/issues/195; https://usn.ubuntu.com/3989-1/
CVE: CVE-2018-20367
Published: 2018-12-22
Description: The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8_181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wstmall/wstmart/issues/1; https://github.com/wstmall/wstmart/issues/1
CVE: CVE-2018-20331
Published: 2018-12-23
Description: Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x80002004 by the ssdt.sys kernel driver. The bug is caused by failure to properly validate the length of the user-supplied data. An attacker can leverage this vulnerability to execute arbitrary code in the context of the kernel, which could lead to privilege escalation. A failed exploit could lead to denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://packetstormsecurity.com/files/150900; https://packetstormsecurity.com/files/150900
CVE: CVE-2018-20368
Published: 2018-12-23
Description: The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2158; https://www.vulnerability-lab.com/get_content.php?id=2158
CVE: CVE-2018-20369
Published: 2018-12-23
Description: Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. The injection point of the issue is the Add_Update module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2168; https://www.vulnerability-lab.com/get_content.php?id=2168
CVE: CVE-2018-20370
Published: 2018-12-23
Description: SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2171; https://www.vulnerability-lab.com/get_content.php?id=2171
CVE: CVE-2018-20371
Published: 2018-12-23
Description: PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as demonstrated by "GET /login.html__passwd1" and "GET /login.html__passwd2" and so on.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://www.vulnerability-lab.com/get_content.php?id=2110; https://www.vulnerability-lab.com/get_content.php?id=2110
CVE: CVE-2018-20372
Published: 2018-12-23
Description: TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=1990; https://www.youtube.com/watch?v=HUM5myJWbvc; https://www.vulnerability-lab.com/get_content.php?id=1990
CVE: CVE-2018-20373
Published: 2018-12-23
Description: Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP client.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=1990; https://www.youtube.com/watch?v=HUM5myJWbvc; https://www.vulnerability-lab.com/get_content.php?id=1990
CVE: CVE-2018-20374
Published: 2018-12-23
Description: An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the use_section1 function in tccasm.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00015.html; https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00015.html
CVE: CVE-2018-20375
Published: 2018-12-23
Description: An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the sym_pop function in tccgen.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00014.html; https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00014.html
CVE: CVE-2018-20376
Published: 2018-12-23
Description: An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the asm_parse_directive function in tccasm.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00013.html; https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00013.html
CVE: CVE-2018-20377
Published: 2018-12-23
Description: Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials via /get_getnetworkconf.cgi on port 8080, leading to full control if the admin password equals the Wi-Fi password or has the default admin value. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03, Modem 5.4.1.10.1.1A, Hardware 02, and Arcadyan ARV7519RW22-A-L T VR9 1.2.
CVSS Score: 9.8 (CRITICAL)
References: https://badpackets.net/over-19000-orange-livebox-adsl-modems-are-leaking-their-wifi-credentials/; https://github.com/zadewg/LIVEBOX-0DAY; https://news.ycombinator.com/item?id=18745533
CVE: CVE-2018-20379
Published: 2018-12-23
Description: Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-160428a devices allow XSS via a Cross Protocol Injection attack with setSSID of 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.1.1.3.10001.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://misteralfa-hack.blogspot.com/2018/12/cisco-dpc3928sl-explotando-un-xss-via.html; https://misteralfa-hack.blogspot.com/2018/12/cisco-dpc3928sl-explotando-un-xss-via.html
CVE: CVE-2018-20380
Published: 2018-12-23
Description: Ambit DDW2600 5.100.1009, DDW2602 5.105.1003, T60C926 4.64.1012, and U10C019 5.66.1026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20381
Published: 2018-12-23
Description: Technicolor DPC2320 dpc2300r2-v202r[PII_REDACTED]20a-v6 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20382
Published: 2018-12-23
Description: Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20383
Published: 2018-12-23
Description: ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20384
Published: 2018-12-23
Description: iNovo Broadband IB-8120-W21 139.4410mp1.004200.002 and IB-8120-W21E1 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20385
Published: 2018-12-23
Description: CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNIT 125.553mp1.39219mp1.899.005ITT, CBW383G4J 37.556mp5.008, and CBW38G4J 37.553mp1.008 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20386
Published: 2018-12-23
Description: ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20387
Published: 2018-12-23
Description: Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20388
Published: 2018-12-23
Description: Comtrend CM-6200un 123.447.007 and CM-6300n 123.553mp1.005 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20389
Published: 2018-12-23
Description: D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20390
Published: 2018-12-23
Description: Kaonmedia CG2001-AN22A 1.2.1, CG2001-UDBNA 3.0.8, and CG2001-UN2NA 3.0.8 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20391
Published: 2018-12-23
Description: TEKNOTEL CBW700N 81.447.392110.729.024 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv