deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-1551
Published: 2018-08-06
Description: IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name. IBM X-Force ID: 142888.
CVSS Score: 3.1 (LOW)
CWE: CWE-732
References: http://www.securityfocus.com/bid/105040; https://exchange.xforce.ibmcloud.com/vulnerabilities/142888; https://www.ibm.com/support/docview.wss?uid=ibm10716113
CVE: CVE-2017-6920
Published: 2018-08-06
Description: Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://www.securityfocus.com/bid/99211; http://www.securitytracker.com/id/1038781; https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
CVE: CVE-2018-14960
Published: 2018-08-06
Description: Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://blog.whiterabbitxyj.com/cve/Xiao5uCompany_1.7_csrf.doc; https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/cve/Xiao5uCompany_1.7_csrf.doc; http://blog.whiterabbitxyj.com/cve/Xiao5uCompany_1.7_csrf.doc
CVE: CVE-2018-14961
Published: 2018-08-06
Description: dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.csdn.net/weixin_42813492/article/details/81240523; https://github.com/AvaterXXX/ZZCMS/blob/master/README.md; https://blog.csdn.net/weixin_42813492/article/details/81240523
CVE: CVE-2018-14962
Published: 2018-08-06
Description: zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/ZZCMS/blob/master/README.md; https://github.com/AvaterXXX/ZZCMS/blob/master/README.md
CVE: CVE-2018-14963
Published: 2018-08-06
Description: zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AvaterXXX/ZZCMS/blob/master/README.md; https://github.com/AvaterXXX/ZZCMS/blob/master/README.md
CVE: CVE-2018-14964
Published: 2018-08-06
Description: An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/emlsoft/blob/master/README.md; https://github.com/AvaterXXX/emlsoft/blob/master/README.md
CVE: CVE-2018-14965
Published: 2018-08-06
Description: An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AvaterXXX/emlsoft/blob/master/README.md; https://github.com/AvaterXXX/emlsoft/blob/master/README.md
CVE: CVE-2018-14966
Published: 2018-08-06
Description: An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AvaterXXX/emlsoft/blob/master/README.md; https://github.com/AvaterXXX/emlsoft/blob/master/README.md
CVE: CVE-2018-14967
Published: 2018-08-06
Description: An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.user.php has SQL Injection via the numPerPage parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/AvaterXXX/emlsoft/blob/master/README.md; https://github.com/AvaterXXX/emlsoft/blob/master/README.md
CVE: CVE-2018-14968
Published: 2018-08-06
Description: An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.address.php has SQL Injection via the numPerPage parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/AvaterXXX/emlsoft/blob/master/README.md; https://github.com/AvaterXXX/emlsoft/blob/master/README.md
CVE: CVE-2018-14969
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/README.md; https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE: CVE-2018-14970
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/README.md; https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE: CVE-2018-14971
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/README.md; https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE: CVE-2018-14972
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/README.md; https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE: CVE-2018-14973
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/README.md; https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE: CVE-2018-14974
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/README.md; https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE: CVE-2018-14975
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/README.md; https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE: CVE-2018-14976
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/README.md; https://github.com/AvaterXXX/QCMS/blob/master/README.md
CVE: CVE-2018-14977
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/QCMS/blob/master/XSS.md; https://github.com/AvaterXXX/QCMS/blob/master/XSS.md
CVE: CVE-2018-14978
Published: 2018-08-06
Description: An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AvaterXXX/QCMS/blob/master/CSRF; https://github.com/AvaterXXX/QCMS/blob/master/CSRF
CVE: CVE-2017-14447
Published: 2018-08-06
Description: An exploitable buffer overflow vulnerability exists in the PubNub message handler for the 'ad' channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0496; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0496
CVE: CVE-2016-4391
Published: 2018-08-06
Description: A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/93789; http://www.securitytracker.com/id/1037068; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05313743
CVE: CVE-2016-4392
Published: 2018-08-06
Description: A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93933; http://www.securitytracker.com/id/1037127; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05316329
CVE: CVE-2016-4397
Published: 2018-08-06
Description: A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/94154; http://www.securityfocus.com/bid/95080; http://www.securitytracker.com/id/1037234
CVE: CVE-2016-4398
Published: 2018-08-06
Description: A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using Java Deserialization.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/94195; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05325823; http://www.securityfocus.com/bid/94195
CVE: CVE-2016-4399
Published: 2018-08-06
Description: A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94195; http://www.securitytracker.com/id/1037232; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05325823
CVE: CVE-2016-4400
Published: 2018-08-06
Description: A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94195; http://www.securitytracker.com/id/1037232; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05325823
CVE: CVE-2016-4402
Published: 2018-08-06
Description: A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94184; http://www.securitytracker.com/id/1037235; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05325836
CVE: CVE-2016-4403
Published: 2018-08-06
Description: A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94184; http://www.securitytracker.com/id/1037235; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05325836
CVE: CVE-2016-4404
Published: 2018-08-06
Description: A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via a memory allocation issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94184; http://www.securitytracker.com/id/1037235; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05325836
CVE: CVE-2016-4405
Published: 2018-08-06
Description: A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.20-v9.26
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/94183; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05327447; http://www.securityfocus.com/bid/94183
CVE: CVE-2016-4406
Published: 2018-08-06
Description: A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94426; http://www.securitytracker.com/id/1037318; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05337025
CVE: CVE-2016-8526
Published: 2018-08-06
Description: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker's choosing. This could include files that contain passwords, which could then lead to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-001.txt; http://www.securityfocus.com/bid/96495; https://www.exploit-db.com/exploits/41482/
CVE: CVE-2016-8527
Published: 2018-08-06
Description: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into AirWave in the same browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-001.txt; http://www.securityfocus.com/bid/96495; https://www.exploit-db.com/exploits/41482/
CVE: CVE-2017-8968
Published: 2018-08-06
Description: A remote execution of arbitrary code vulnerability has been identified in HPE RESTful Interface Tool 1.5, 2.0 (hprest-1.5-79.x86_64.rpm, ilorest-2.0-403.x86_64.rpm). The issue is resolved in iLOREST v2.1 or subsequent versions.
CVSS Score: 7.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03796en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03796en_us
CVE: CVE-2017-8987
Published: 2018-08-06
Description: A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 (iLO 3) version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions.
CVSS Score: 8.6 (HIGH)
References: http://www.securitytracker.com/id/1040429; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03826en_us; http://www.securitytracker.com/id/1040429
CVE: CVE-2017-8988
Published: 2018-08-06
Description: A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software Earlier than 8.5.3-00. The vulnerability impacts DevMgr Earlier than 8.5.3-00 (for Windows, Linux), RepMgr earlier than 8.5.3-00 (for Windows, Linux) and HDLM earlier than 8.5.3-00 (for Windows, Linux, Solaris, AIX).
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03822en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03822en_us
CVE: CVE-2017-8989
Published: 2018-08-06
Description: A security vulnerability in HPE IceWall SSO Dfw 10.0 and 11.0 on RHEL, HP-UX, and Windows could be exploited remotely to allow URL Redirection.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-601
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03833en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03833en_us
CVE: CVE-2017-8990
Published: 2018-08-06
Description: A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Service Manager (WSM) Software earlier than version WSM 7.3 (E0506). This issue was resolved in HPE IMC Wireless Services Manager Software IMC WSM 7.3 E0506P01 or subsequent version.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securitytracker.com/id/1040988; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03852en_us; http://www.securitytracker.com/id/1040988
CVE: CVE-2017-8991
Published: 2018-08-06
Description: HPE has identified a cross site scripting (XSS) vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03837en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03837en_us
CVE: CVE-2017-8992
Published: 2018-08-06
Description: HPE has identified a remote privilege escalation vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03837en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03837en_us
CVE: CVE-2017-9000
Published: 2018-08-06
Description: ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An unauthenticated user with network access to an Aruba mobility controller on TCP port 8080 or 8081 may be able to access arbitrary files stored on the mobility controller. Ports 8080 and 8081 are used for captive portal functionality and are listening, by default, on all IP interfaces of the mobility controller, including captive portal interfaces. The attacker could access files which could contain passwords, keys, and other sensitive information that could lead to full system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt; http://www.securitytracker.com/id/1039580; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt
CVE: CVE-2017-9001
Published: 2018-08-06
Description: Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user to execute arbitrary commands on the underlying operating system with "root" privilege level. This vulnerability is only present when a specific feature has been enabled. The SSH Lockout feature is not enabled by default, so only systems which have enabled this feature are vulnerable.
CVSS Score: 8.1 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-004.txt
CVE: CVE-2017-9002
Published: 2018-08-06
Description: All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into ClearPass in the same browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-004.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-004.txt
CVE: CVE-2017-9003
Published: 2018-08-06
Description: Multiple memory corruption flaws are present in ArubaOS which could allow an unauthenticated user to crash ArubaOS processes. With sufficient time and effort, it is possible these vulnerabilities could lead to the ability to execute arbitrary code - remote code execution has not yet been confirmed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt; http://www.securitytracker.com/id/1039580; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-006.txt
CVE: CVE-2018-13877
Published: 2018-08-06
Description: The doPayouts() function of the smart contract implementation for MegaCryptoPolis, an Ethereum game, has a Denial of Service vulnerability. If a smart contract that has a fallback function always causing exceptions buys a land, users cannot buy lands near that contract's land, because those purchase attempts will not be completed unless the doPayouts() function successfully sends Ether to certain neighbors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://medium.com/coinmonks/denial-of-service-dos-attack-on-megacryptopolis-an-ethereum-game-cve-2018-13877-cdd7f7ef8b08; https://medium.com/coinmonks/denial-of-service-dos-attack-on-megacryptopolis-an-ethereum-game-cve-2018-13877-cdd7f7ef8b08
CVE: CVE-2018-14716
Published: 2018-08-06
Description: A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://ha.cker.info/exploitation-of-server-side-template-injection-with-craft-cms-plguin-seomatic/; https://github.com/nystudio107/craft-seomatic/commit/1e7d1d084ac3a89e7ec70620f[PII_REDACTED]d1ce1; https://github.com/nystudio107/craft-seomatic/releases/tag/3.1.4
CVE: CVE-2018-5390
Published: 2018-08-06
Description: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181031-02-linux-en; http://www.openwall.com/lists/oss-security/2019/06/28/2
CVE: CVE-2018-7058
Published: 2018-08-06
Description: Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest captive portal, and API. Customers who do not expose ClearPass web interfaces to untrusted users are impacted to a lesser extent.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt
CVE: CVE-2018-7059
Published: 2018-08-06
Description: Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when authenticated as a user with "mon" permission.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt
CVE: CVE-2018-7060
Published: 2018-08-06
Description: Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt