deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-1092
Published: 2018-04-02
Description: The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://openwall.com/lists/oss-security/2018/03/29/1; https://access.redhat.com/errata/RHSA-2018:2948; https://access.redhat.com/errata/RHSA-2018:3083
CVE: CVE-2018-1093
Published: 2018-04-02
Description: The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://openwall.com/lists/oss-security/2018/03/29/1; https://bugzilla.kernel.org/show_bug.cgi?id=199181; https://bugzilla.redhat.com/show_bug.cgi?id=1560782
CVE: CVE-2018-1094
Published: 2018-04-02
Description: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://openwall.com/lists/oss-security/2018/03/29/1; https://access.redhat.com/errata/RHSA-2018:2948; https://access.redhat.com/errata/RHSA-2018:3083
CVE: CVE-2018-1095
Published: 2018-04-02
Description: The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://openwall.com/lists/oss-security/2018/03/29/1; https://access.redhat.com/errata/RHSA-2018:2948; https://bugzilla.kernel.org/show_bug.cgi?id=199185
CVE: CVE-2018-9173
Published: 2018-04-02
Description: Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as demonstrated by the movieName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1266; https://www.exploit-db.com/exploits/44408/; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1266
CVE: CVE-2018-9174
Published: 2018-04-02
Description: sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker's control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://xz.aliyun.com/t/2237; https://xz.aliyun.com/t/2237
CVE: CVE-2018-9175
Published: 2018-04-02
Description: DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database is accessible to uploads/dede/sys_cache_up.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://xz.aliyun.com/t/2237; https://xz.aliyun.com/t/2237
CVE: CVE-2018-9163
Published: 2018-04-02
Description: A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103773; https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/; https://www.exploit-db.com/exploits/44666/
CVE: CVE-2018-1038
Published: 2018-04-02
Description: The Windows kernel in Windows 7 SP1 and Windows Server 2008 R2 SP1 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/103549; http://www.securitytracker.com/id/1040632; https://blog.xpnsec.com/total-meltdown-cve-2018-1038/
CVE: CVE-2018-6660
Published: 2018-04-02
Description: Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/103392; http://www.securitytracker.com/id/1040884; https://kc.mcafee.com/corporate/index?page=content&id=SB10228
CVE: CVE-2018-6661
Published: 2018-04-02
Description: DLL Side-Loading vulnerability in Microsoft Windows Client in McAfee True Key before 4.20.110 allows local users to gain privilege elevation via not verifying a particular DLL file signature.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102801; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102801
CVE: CVE-2018-0194
Published: 2018-04-02
Description: Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute commands with root privileges on the device. The vulnerabilities exist because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An attacker could exploit these vulnerabilities by submitting a malicious CLI command to the affected software. A successful exploit could allow the attacker to break from the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell on an affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuz03145, CSCuz56419, CSCva31971, CSCvb09542.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/103547; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-cmdinj; http://www.securityfocus.com/bid/103547
CVE: CVE-2018-9183
Published: 2018-04-02
Description: The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://vel.joomla.org/resolved/2146-js-jobs-1-2-0-xss-cross-site-scripting; https://www.exploit-db.com/exploits/44401/; https://www.joomsky.com/products/js-jobs.html
CVE: CVE-2018-6247
Published: 2018-04-02
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL pointer dereference may lead to denial of service or possible escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4649; http://nvidia.custhelp.com/app/answers/detail/a_id/4649
CVE: CVE-2018-6248
Published: 2018-04-02
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the software uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer which may lead to denial of service or possible escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4649; http://nvidia.custhelp.com/app/answers/detail/a_id/4649
CVE: CVE-2018-6249
Published: 2018-04-02
Description: NVIDIA GPU Display Driver contains a vulnerability in kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4649; https://usn.ubuntu.com/3662-1/; http://nvidia.custhelp.com/app/answers/detail/a_id/4649
CVE: CVE-2018-6250
Published: 2018-04-02
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL pointer dereference occurs which may lead to denial of service or possible escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4649; http://nvidia.custhelp.com/app/answers/detail/a_id/4649
CVE: CVE-2018-6251
Published: 2018-04-02
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the DirectX 10 Usermode driver, where a specially crafted pixel shader can cause writing to unallocated memory, leading to denial of service or potential code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4649; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0514; http://nvidia.custhelp.com/app/answers/detail/a_id/4649
CVE: CVE-2018-6252
Published: 2018-04-02
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the software allows an actor access to restricted functionality that is unnecessary to production usage, and which may result in denial of service.
CVSS Score: 5.5 (MEDIUM)
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4649; http://nvidia.custhelp.com/app/answers/detail/a_id/4649
CVE: CVE-2018-6253
Published: 2018-04-02
Description: NVIDIA GPU Display Driver contains a vulnerability in the DirectX and OpenGL Usermode drivers where a specially crafted pixel shader can cause infinite recursion leading to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4649; https://usn.ubuntu.com/3662-1/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0522
CVE: CVE-2016-8717
Published: 2018-04-02
Description: An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The device operating system contains an undocumented, privileged (root) account with hard-coded credentials, giving attackers full control of affected devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0231; https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0231
CVE: CVE-2018-1295
Published: 2018-04-02
Description: In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.securityfocus.com/bid/103692; https://access.redhat.com/errata/RHSA-2018:2405; https://lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae[PII_REDACTED]ff757e5a558da80d0209%40%3Cdev.ignite.apache.org%3E
CVE: CVE-2018-6659
Published: 2018-04-02
Description: Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an XSS issue via not sanitizing the user input.
CVSS Score: 3.7 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103392; http://www.securitytracker.com/id/1040884; https://kc.mcafee.com/corporate/index?page=content&id=SB10228
CVE: CVE-2018-9127
Published: 2018-04-02
Description: Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://botan.randombit.net/security.html; https://botan.randombit.net/security.html
CVE: CVE-2018-9230
Published: 2018-04-02
Description: In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall (ngx_lua_waf or X-WAF) products. NOTE: the vendor has reported that 100 parameters is an intentional default setting, but is adjustable within the API. The vendor's position is that a security-relevant misuse of the API by a WAF product is a vulnerability in the WAF product, not a vulnerability in OpenResty
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Bypass007/vuln/blob/master/OpenResty/Uri%20parameter%20overflow%20in%20Openresty.md; https://openresty.org/en/changelog-1013006.html; https://github.com/Bypass007/vuln/blob/master/OpenResty/Uri%20parameter%20overflow%20in%20Openresty.md
CVE: CVE-2017-13806
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Profiles" component. It does not enforce the configuration profile's settings for whether pairings are allowed.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT208112; https://support.apple.com/HT208112
CVE: CVE-2017-13827
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "kext tools" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app that performs kext loading.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/HT208144; https://support.apple.com/HT208144
CVE: CVE-2017-13837
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Installer" component. It does not properly restrict an app's entitlements for accessing the FileVault unlock key.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/HT208144; https://support.apple.com/HT208144
CVE: CVE-2017-13839
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Spotlight" component. It allows local users to see results for other users' files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/HT208144; https://support.apple.com/HT208144
CVE: CVE-2017-13850
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Font Importer" component. It allows remote attackers to cause a denial of service (memory corruption) or obtain sensitive information from process memory via a crafted font.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: https://support.apple.com/HT207922; https://support.apple.com/HT207922
CVE: CVE-2017-13851
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "DesktopServices" component. It allows local users to bypass intended access restrictions on home folder files.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT208144; https://support.apple.com/HT208144
CVE: CVE-2017-13853
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "AppleGraphicsControl" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/HT207922; https://support.apple.com/HT207922
CVE: CVE-2017-13854
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/HT208112; https://support.apple.com/HT208113; https://support.apple.com/HT208115
CVE: CVE-2017-13863
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "APNs" component. It allows man-in-the-middle attackers to track users by leveraging the transmission of client certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://support.apple.com/HT208112; https://support.apple.com/HT208112
CVE: CVE-2017-13873
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Kernel" component. It allows attackers to obtain sensitive network-activity information about arbitrary apps via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/HT208112; https://support.apple.com/HT208113; https://support.apple.com/HT208115
CVE: CVE-2017-13877
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Sandbox Profiles" component. It allows attackers to determine whether arbitrary files exist via a crafted app.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://support.apple.com/HT208112; https://support.apple.com/HT208112
CVE: CVE-2017-13884
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/HT208324; https://support.apple.com/HT208325; https://support.apple.com/HT208326
CVE: CVE-2017-13885
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/HT208324; https://support.apple.com/HT208326; https://support.apple.com/HT208327
CVE: CVE-2017-13890
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. macOS before 10.13 is affected. The issue involves the "CoreTypes" component. It allows remote attackers to trigger disk-image mounting via a crafted web site.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103579; http://www.securitytracker.com/id/1040608; https://support.apple.com/HT208144
CVE: CVE-2017-13904
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/172828/Apple-packet-mangler-Remote-Code-Execution.html; https://support.apple.com/HT208325; https://support.apple.com/HT208327
CVE: CVE-2017-2492
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "JavaScriptCore" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that triggers prototype mishandling.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/HT207600; https://support.apple.com/HT207601; https://support.apple.com/HT207617
CVE: CVE-2017-2493
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted elements on a web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/HT207600; https://support.apple.com/HT207601; https://support.apple.com/HT207607
CVE: CVE-2017-6976
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Sandbox Profiles" component. It allows attackers to bypass intended access restrictions (for iCloud user records) via a crafted app.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT207617; https://support.apple.com/HT207617
CVE: CVE-2017-7000
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98767; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-7001
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98768; https://support.apple.com/HT207797; https://support.apple.com/HT207798
CVE: CVE-2017-7002
Published: 2018-04-03
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98773; https://support.apple.com/HT207797; https://support.apple.com/HT207798