deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-16222
Published: 2018-11-20
Description: Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to retrieve the username and password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-522
References: http://packetstormsecurity.com/files/150165/QBee-Camera-iSmartAlarm-Credential-Disclosure.html; http://seclists.org/fulldisclosure/2018/Nov/2; http://packetstormsecurity.com/files/150165/QBee-Camera-iSmartAlarm-Credential-Disclosure.html
CVE: CVE-2018-16223
Published: 2018-11-20
Description: Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamera_preferences.xml in the QBee Cam application through 1.0.5 for Android allows an attacker to retrieve the username and password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://packetstormsecurity.com/files/150165/QBee-Camera-iSmartAlarm-Credential-Disclosure.html; http://seclists.org/fulldisclosure/2018/Nov/2; http://packetstormsecurity.com/files/150165/QBee-Camera-iSmartAlarm-Credential-Disclosure.html
CVE: CVE-2018-16224
Published: 2018-11-20
Description: Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted TCP request to port 12345 and 22306, and access sensitive information from the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/150165/QBee-Camera-iSmartAlarm-Credential-Disclosure.html; http://seclists.org/fulldisclosure/2018/Nov/2; http://packetstormsecurity.com/files/150165/QBee-Camera-iSmartAlarm-Credential-Disclosure.html
CVE: CVE-2018-18439
Published: 2018-11-20
Description: DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traffic is mishandled. Also, local exploitation can occur via a crafted kernel image.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2018/11/02/2; http://www.openwall.com/lists/oss-security/2018/11/02/2
CVE: CVE-2018-18440
Published: 2018-11-20
Description: DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2018/11/02/2; https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf; http://www.openwall.com/lists/oss-security/2018/11/02/2
CVE: CVE-2018-18561
Published: 2018-11-20
Description: An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the operating system.
CVSS Score: 8.0 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/105843; https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01; http://www.securityfocus.com/bid/105843
CVE: CVE-2018-18562
Published: 2018-11-20
Description: An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-521
References: http://www.securityfocus.com/bid/105843; https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01; http://www.securityfocus.com/bid/105843
CVE: CVE-2018-18563
Published: 2018-11-20
Description: An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial Number below KQ0400000 or KS0400000) and cobas h 232 before 04.00.04 (Serial Number above KQ0400000 or KS0400000). Improper access control to a service command allows attackers in the adjacent network to execute arbitrary code on the system through a crafted Poct1-A message.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/105843; https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01; http://www.securityfocus.com/bid/105843
CVE: CVE-2018-18564
Published: 2018-11-20
Description: An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). Improper access control allows attackers in the adjacent network to change the instrument configuration.
CVSS Score: 7.4 (HIGH)
References: http://www.securityfocus.com/bid/105843; https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01; http://www.securityfocus.com/bid/105843
CVE: CVE-2018-18565
Published: 2018-11-20
Description: An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: http://www.securityfocus.com/bid/105843; https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01; http://www.securityfocus.com/bid/105843
CVE: CVE-2018-18715
Published: 2018-11-20
Description: Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150124/Zoho-ManageEngine-OpManager-12.3-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Nov/3; https://seclists.org/bugtraq/2018/Oct/60
CVE: CVE-2018-18716
Published: 2018-11-20
Description: Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150124/Zoho-ManageEngine-OpManager-12.3-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Nov/6; https://seclists.org/bugtraq/2018/Oct/61
CVE: CVE-2018-18772
Published: 2018-11-20
Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-Root-Account-Takeover-Command-Execution.html; http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-XSS-CSRF-Code-Execution.html; https://www.exploit-db.com/exploits/45822/
CVE: CVE-2018-18773
Published: 2018-11-20
Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-Root-Account-Takeover-Command-Execution.html; http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-XSS-CSRF-Code-Execution.html; https://www.exploit-db.com/exploits/45822/
CVE: CVE-2018-18774
Published: 2018-11-20
Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-Root-Account-Takeover-Command-Execution.html; http://packetstormsecurity.com/files/150169/CentOS-Web-Panel-0.9.8.740-XSS-CSRF-Code-Execution.html; https://www.exploit-db.com/exploits/45822/
CVE: CVE-2018-18856
Published: 2018-11-20
Description: Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the system function to execute the "openvpncmd" parameter as a shell command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2018/Nov/1; https://www.exploit-db.com/exploits/45782/
CVE: CVE-2018-18857
Published: 2018-11-20
Description: Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the system function to execute the "command_line" parameter as a shell command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2018/Nov/1; https://www.exploit-db.com/exploits/45782/
CVE: CVE-2018-18858
Published: 2018-11-20
Description: Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the system function to execute the "tun_path" or "tap_path" pathname within a shell command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2018/Nov/1; https://www.exploit-db.com/exploits/45782/
CVE: CVE-2018-18859
Published: 2018-11-20
Description: Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate with an unprotected XPC service and directly execute arbitrary OS commands as root or load a potentially malicious kernel extension because com.smr.liquidvpn.OVPNHelper uses the value of the "tun_path" or "tap_path" pathname in a kextload() call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/150137/LiquidVPN-For-macOS-1.3.7-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2018/Nov/1; https://www.exploit-db.com/exploits/45782/
CVE: CVE-2018-18861
Published: 2018-11-20
Description: Buffer overflow in PCMan FTP Server 2.0.7 allows for remote code execution via the APPE command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/150174/PCManFTPD-2.0.7-Server-APPE-Command-Buffer-Overflow.html; http://packetstormsecurity.com/files/150174/PCManFTPD-2.0.7-Server-APPE-Command-Buffer-Overflow.html
CVE: CVE-2018-18864
Published: 2018-11-20
Description: Loadbalancer.org Enterprise VA MAX before 8.3.3 has XSS because Apache HTTP Server logs are displayed.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150135/Loadbalancer.org-Enterprise-VA-MAX-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Nov/5; http://packetstormsecurity.com/files/150135/Loadbalancer.org-Enterprise-VA-MAX-Cross-Site-Scripting.html
CVE: CVE-2018-18865
Published: 2018-11-20
Description: The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13) allow Credentials Disclosure.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/150136/Royal-TS-X-Information-Disclosure.html; http://seclists.org/fulldisclosure/2018/Nov/25; http://seclists.org/fulldisclosure/2018/Nov/4
CVE: CVE-2018-19376
Published: 2018-11-20
Description: An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clear URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/GreenCMS/GreenCMS/issues/114; https://github.com/GreenCMS/GreenCMS/issues/114
CVE: CVE-2018-19387
Published: 2018-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-19388
Published: 2018-11-20
Description: FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read, access violation, and application crash) via TIFF data because of a ConvertToPDF_x86!ReleaseFXURLToHtml issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/20/2018/11/2018-11-20/index.html; https://yan-1-20.github.io/2018/11/20/2018/11/2018-11-20/; https://exchange.xforce.ibmcloud.com/vulnerabilities/153214
CVE: CVE-2018-19389
Published: 2018-11-20
Description: FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and application crash) via BMP data because of a ConvertToPDF_x86!ConnectedPDF::ConnectedPDFSDK::FCP_SendEmailNotification issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/20/2018/11/2018-11-20/index.html; https://yan-1-20.github.io/2018/11/20/2018/11/2018-11-20/; https://exchange.xforce.ibmcloud.com/vulnerabilities/153215
CVE: CVE-2018-19390
Published: 2018-11-20
Description: FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and application crash) via TIFF data because of a ConvertToPDF_x86!ConnectedPDF::ConnectedPDFSDK::FCP_SendEmailNotification issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/20/2018/11/2018-11-20/index.html; https://yan-1-20.github.io/2018/11/20/2018/11/2018-11-20/; https://exchange.xforce.ibmcloud.com/vulnerabilities/153216
CVE: CVE-2018-19395
Published: 2018-11-20
Description: ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM("WScript.Shell").
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/105989; https://bugs.php.net/bug.php?id=77177; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-19396
Published: 2018-11-20
Description: ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/105989; https://bugs.php.net/bug.php?id=77177; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-19404
Published: 2018-11-21
Description: In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url= followed by that URL. This is related to the onlineinstall and import functions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/HF9/yxcms-code-audit/blob/master/Any%20PHP%20Code%20Execution; https://github.com/HF9/yxcms-code-audit/blob/master/Any%20PHP%20Code%20Execution
CVE: CVE-2018-19406
Published: 2018-11-21
Description: kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/105988; https://lkml.org/lkml/2018/11/20/411; http://www.securityfocus.com/bid/105988
CVE: CVE-2018-19407
Published: 2018-11-21
Description: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/105987; https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html; https://lkml.org/lkml/2018/11/20/580
CVE: CVE-2009-5153
Published: 2018-11-21
Description: In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthenticated attackers to execute code, because a length field was incorrectly trusted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugzilla.suse.com/show_bug.cgi?id=515804; https://download.novell.com/Download?buildid=1z3z-OsVCiE~; https://www.zerodayinitiative.com/advisories/ZDI-09-067/
CVE: CVE-2018-1843
Published: 2018-11-21
Description: The Identity and Access Management (IAM) services (IBM Cloud Private 3.1.0) do not use a secure channel, such as SSL, to exchange information only when accessed internally from within the cluster. It could be possible for an attacker with access to network traffic to sniff packets from the connection and uncover data. IBM X-Force ID: 150903
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10739845; https://exchange.xforce.ibmcloud.com/vulnerabilities/150903; http://www.ibm.com/support/docview.wss?uid=ibm10739845
CVE: CVE-2018-19409
Published: 2018-11-21
Description: An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/105990; https://access.redhat.com/errata/RHSA-2018:3834; https://bugs.ghostscript.com/show_bug.cgi?id=700176
CVE: CVE-2018-19410
Published: 2018-11-21
Description: PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
CVSS Score: 9.8 (CRITICAL)
References: https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-24/; https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-24/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19410
CVE: CVE-2018-19411
Published: 2018-11-21
Description: PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account (including administrator) via an HTTP request because /api/addusers doesn't check, or doesn't properly check, user rights.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-25/; https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-25/
CVE: CVE-2018-19416
Published: 2018-11-21
Description: An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106010; https://github.com/sysstat/sysstat/issues/196; http://www.securityfocus.com/bid/106010
CVE: CVE-2018-19417
Published: 2018-11-21
Description: An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages with a variable length header uses memcpy to input data into a fixed size buffer. The allocated buffer can fit only MQTT_MAX_TOPIC_LENGTH (default 64) bytes, and a length check is missing. This could lead to Remote Code Execution via a stack-smashing attack (overwriting the function return address). Contiki-NG does not separate the MQTT server from other servers and the OS modules, so access to all memory regions is possible.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: https://github.com/contiki-ng/contiki-ng/issues/600; https://github.com/contiki-ng/contiki-ng/issues/600
CVE: CVE-2018-19420
Published: 2018-11-21
Description: In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename), because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.
CVSS Score: 3.8 (LOW)
CWE: CWE-434
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301
CVE: CVE-2018-19421
Published: 2018-11-21
Description: In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.
CVSS Score: 3.8 (LOW)
CWE: CWE-434
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301
CVE: CVE-2018-19422
Published: 2018-11-21
Description: /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html; http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html; https://github.com/intelliants/subrion/issues/801
CVE: CVE-2018-19423
Published: 2018-11-21
Description: Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/162772/Codiad-2.8.4-Shell-Upload.html; https://github.com/Codiad/Codiad/issues/1098; https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-19423-Exploit
CVE: CVE-2018-19424
Published: 2018-11-21
Description: ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/ClipperCMS/ClipperCMS/issues/495; https://github.com/ClipperCMS/ClipperCMS/issues/495
CVE: CVE-2018-19432
Published: 2018-11-22
Description: An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function sf_write_int in sndfile.c, which will lead to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/105996; https://github.com/erikd/libsndfile/issues/427; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html
CVE: CVE-2018-19433
Published: 2018-11-22
Description: ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/star7th/showdoc/issues/392; https://github.com/star7th/showdoc/issues/392