deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-18199
Published: 2019-10-24
Description: An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of password-based authentication, they are vulnerable to replay attacks.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-319
References: http://packetstormsecurity.com/files/154954/Fujitsu-Wireless-Keyboard-Set-LX390-Replay-Attacks.html; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-009.txt; https://www.syss.de/pentest-blog/2019/syss-2019-009-syss-2019-010-und-syss-2019-011-schwachstellen-in-weiterer-funktastatur-mit-sicherer-24-ghz-technologie/
CVE: CVE-2019-18408
Published: 2019-10-24
Description: archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html; https://access.redhat.com/errata/RHSA-2020:0203
CVE: CVE-2019-18409
Published: 2019-10-24
Description: The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/zenspider/ruby_parser-legacy/issues/1; https://github.com/zenspider/ruby_parser-legacy/issues/1
CVE: CVE-2019-6692
Published: 2019-10-24
Description: A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary code execution via forging that DLL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://fortiguard.com/psirt/FG-IR-19-148; https://fortiguard.com/psirt/FG-IR-19-148
CVE: CVE-2019-12017
Published: 2019-10-24
Description: A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to the CLDB to influence the JSON library's decision on which Java class this JSON request is deserialized to. By doing so, the attacker can force the MapR CLDB to construct a URLClassLoader which loads a malicious Java class from a remote path and instantiate this object in the MapR CLDB, thus executing arbitrary code on the machine running the MapR CLDB and take over the cluster. By switching to the newer Jackson library and ensuring that all incoming JSON requests are only deserialized to the same class that it was serialized from, the vulnerability is fixed. This vulnerability affects the entire MapR core platform.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://mapr.com/support/s/article/Remote-code-execution-vulnerability-in-MapR-MFS-CLDB?language=en_US; https://mapr.com/support/s/article/Remote-code-execution-vulnerability-in-MapR-MFS-CLDB?language=en_US
CVE: CVE-2019-13649
Published: 2019-10-24
Description: TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow externalPort OS Command Injection (issue 1 of 5).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://pastebin.com/yAxBFe05; https://pastebin.com/yAxBFe05
CVE: CVE-2019-13650
Published: 2019-10-24
Description: TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection (issue 2 of 5).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://pastebin.com/yAxBFe05; https://pastebin.com/yAxBFe05
CVE: CVE-2019-13651
Published: 2019-10-24
Description: TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection (issue 3 of 5).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://pastebin.com/yAxBFe05; https://www.tp-link.com; https://pastebin.com/yAxBFe05
CVE: CVE-2019-13652
Published: 2019-10-24
Description: TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection (issue 4 of 5).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://pastebin.com/yAxBFe05; https://pastebin.com/yAxBFe05
CVE: CVE-2019-13653
Published: 2019-10-24
Description: TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection (issue 5 of 5).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://pastebin.com/yAxBFe05; https://pastebin.com/yAxBFe05
CVE: CVE-2019-18200
Published: 2019-10-24
Description: An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, they are prone to keystroke injection attacks.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/154956/Fujitsu-Wireless-Keyboard-Set-LX390-Keystroke-Injection.html; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-011.txt; https://www.syss.de/pentest-blog/2019/syss-2019-009-syss-2019-010-und-syss-2019-011-schwachstellen-in-weiterer-funktastatur-mit-sicherer-24-ghz-technologie/
CVE: CVE-2019-18201
Published: 2019-10-24
Description: An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is able to eavesdrop on sensitive data such as passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/154955/Fujitsu-Wireless-Keyboard-Set-LX390-Missing-Encryption.html; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-010.txt; https://www.syss.de/pentest-blog/2019/syss-2019-009-syss-2019-010-und-syss-2019-011-schwachstellen-in-weiterer-funktastatur-mit-sicherer-24-ghz-technologie/
CVE: CVE-2019-11021
Published: 2019-10-24
Description: admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://gurelahmet.com/schlix-cms-v2-1-8-7-authenticated-unrestricted-file-upload-to-rce/; https://vuldb.com/?id.144129; https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2019-11021
CVE: CVE-2019-15929
Published: 2019-10-24
Description: In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: http://packetstormsecurity.com/files/155012/Craft-CMS-Rate-Limiting-Brute-Force.html; https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#317---2019-01-31; http://packetstormsecurity.com/files/155012/Craft-CMS-Rate-Limiting-Brute-Force.html
CVE: CVE-2019-18196
Published: 2019-10-24
Description: A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in 13.2.36216), and 14.6.4835 (fixed in 14.7.1965) on Windows could allow an attacker to perform code execution on a target system via a service restart where the DLL was previously installed with administrative privileges. Exploitation requires that an attacker be able to create a new file in the TeamViewer application directory; directory permissions restrict that by default.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-426
References: https://community.teamviewer.com/t5/Announcements/Security-bulletin-CVE-2019-18196/td-p/74564; https://safebreach.com/Post/TeamViewer-Windows-Client-v11-to-v14-DLL-Preloading-and-Potential-Abuses-CVE-2019-18196; https://community.teamviewer.com/t5/Announcements/Security-bulletin-CVE-2019-18196/td-p/74564
CVE: CVE-2019-5012
Published: 2019-10-24
Description: An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the startProcess command. The command takes a user-supplied script argument and executes it under root context. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine for a successful exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88, CWE-88
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0760; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0760
CVE: CVE-2019-5013
Published: 2019-10-24
Description: An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command. The command takes a user-supplied string argument and executes launchctl under root context. A user with local access can use this vulnerability to raise load arbitrary launchD agents. An attacker would need local access to the machine for a successful exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88, CWE-88
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0761; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0761
CVE: CVE-2019-9699
Published: 2019-10-24
Description: Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.
CVSS Score: 4.5 (MEDIUM)
References: https://support.symantec.com/en_US/article.SYMSA1482.html; https://support.symantec.com/en_US/article.SYMSA1482.html
CVE: CVE-2019-12094
Published: 2019-10-24
Description: Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.horde.org/ticket/14926; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://numanozdemir.com/respdisc/horde/horde.mp4
CVE: CVE-2019-12095
Published: 2019-10-24
Description: Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: https://bugs.horde.org/ticket/14926; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://exchange.xforce.ibmcloud.com/vulnerabilities/161333
CVE: CVE-2019-18413
Published: 2019-10-24
Description: In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-89
References: https://github.com/typestack/class-validator#passing-options; https://github.com/typestack/class-validator/issues/1422#issuecomment[PII_REDACTED]; https://github.com/typestack/class-validator/issues/438
CVE: CVE-2019-18414
Published: 2019-10-24
Description: Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.sevenlayers.com/index.php/263-restaurant-management-system-csrf; https://www.sevenlayers.com/index.php/263-restaurant-management-system-csrf
CVE: CVE-2019-18415
Published: 2019-10-24
Description: Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sevenlayers.com/index.php/264-restaurant-management-system-1-0-xss-session-hijack; https://www.sevenlayers.com/index.php/264-restaurant-management-system-1-0-xss-session-hijack
CVE: CVE-2019-18416
Published: 2019-10-24
Description: Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sevenlayers.com/index.php/264-restaurant-management-system-1-0-xss-session-hijack; https://www.sevenlayers.com/index.php/264-restaurant-management-system-1-0-xss-session-hijack
CVE: CVE-2019-18417
Published: 2019-10-24
Description: Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution. The issue occurs because the application fails to adequately sanitize user-supplied input, e.g., "add a new food" allows .php files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.sevenlayers.com/index.php/265-restaurant-management-system-1-0-arbitrary-file-upload; https://www.sevenlayers.com/index.php/265-restaurant-management-system-1-0-arbitrary-file-upload
CVE: CVE-2019-8078
Published: 2019-10-24
Description: Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8079
Published: 2019-10-24
Description: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8080
Published: 2019-10-24
Description: Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-18419
Published: 2019-10-24
Description: A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Andhrimnirr/ClonOS-WEB-control-panel-multi-vulnerability; https://github.com/Andhrimnirr/ClonOS-WEB-control-panel-multi-vulnerability
CVE: CVE-2019-18418
Published: 2019-10-24
Description: clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: http://packetstormsecurity.com/files/154986/ClonOs-WEB-UI-19.09-Improper-Access-Control.html; https://github.com/Andhrimnirr/ClonOS-WEB-control-panel-multi-vulnerability; http://packetstormsecurity.com/files/154986/ClonOs-WEB-UI-19.09-Improper-Access-Control.html
CVE: CVE-2018-7367
Published: 2019-10-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-3417. Reason: This candidate is a reservation duplicate of CVE-2019-3417. Notes: All CVE users should reference CVE-2019-3417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-7368
Published: 2019-10-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-3418. Reason: This candidate is a reservation duplicate of CVE-2019-3418. Notes: All CVE users should reference CVE-2019-3418 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-17596
Published: 2019-10-24
Description: Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-436
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html; https://access.redhat.com/errata/RHSA-2020:0101
CVE: CVE-2015-0270
Published: 2019-10-25
Description: Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://framework.zend.com/security/advisory/ZF2015-02; https://framework.zend.com/security/advisory/ZF2015-02
CVE: CVE-2016-2356
Published: 2019-10-25
Description: Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://kirils.org/slides/2016-10-06_Milesight_initial.pdf; https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/; https://www.youtube.com/watch?v=scckkI7CAW0
CVE: CVE-2016-2357
Published: 2019-10-25
Description: Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://kirils.org/slides/2016-10-06_Milesight_initial.pdf; https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/; https://www.youtube.com/watch?v=scckkI7CAW0
CVE: CVE-2016-2358
Published: 2019-10-25
Description: Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessible if the customer has not configured 10 actual user accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://kirils.org/slides/2016-10-06_Milesight_initial.pdf; https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/; https://www.youtube.com/watch?v=scckkI7CAW0
CVE: CVE-2016-2359
Published: 2019-10-25
Description: Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://kirils.org/slides/2016-10-06_Milesight_initial.pdf; https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/; https://www.youtube.com/watch?v=scckkI7CAW0
CVE: CVE-2016-2360
Published: 2019-10-25
Description: Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://kirils.org/slides/2016-10-06_Milesight_initial.pdf; https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/; https://www.youtube.com/watch?v=scckkI7CAW0
CVE: CVE-2016-5202
Published: 2019-10-25
Description: browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732
References: http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00029.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5202; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-5202
CVE: CVE-2019-8081
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 7.5 (HIGH)
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8082
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8083
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8084
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2013-4855
Published: 2019-10-25
Description: D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/; https://www.ise.io/wp-content/uploads/2017/06/soho_defcon21.pdf
CVE: CVE-2013-4856
Published: 2019-10-25
Description: D-Link DIR-865L has Information Disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/; https://www.ise.io/wp-content/uploads/2017/06/soho_defcon21.pdf
CVE: CVE-2013-4857
Published: 2019-10-25
Description: D-Link DIR-865L has PHP File Inclusion in the router xml file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-91
References: https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/; https://www.ise.io/casestudies/exploiting-soho-routers/
CVE: CVE-2017-11008
Published: 2019-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2017-15816
Published: 2019-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2017-15838
Published: 2019-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2017-15839
Published: 2019-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2017-15840
Published: 2019-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none