deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11260
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a fast Initial link setup (FILS) connection request, integer overflow may lead to a buffer overflow when the key length is zero.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securitytracker.com/id/1041432; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=9fd239116d9cb19a18b3892b8a1f428636ca1453; https://www.codeaurora.org/security-bulletin/2018/08/06/august-2018-code-aurora-security-bulletin
CVE: CVE-2018-11261
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible Use-after-free issue in Media Codec process. Any application using codec service will be affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.codeaurora.org/quic/la/platform/hardware/qcom/media/commit/?id=0e910e74e56f2a46f65dbc7694b160cd6e7f379a; https://source.codeaurora.org/quic/la/platform/hardware/qcom/media/commit/?id=d41a7a4c7d43fa67f2e4a487b8a1fb0aac38226d; https://www.codeaurora.org/security-bulletin/2018/08/06/august-2018-code-aurora-security-bulletin
CVE: CVE-2018-11266
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper input validation can lead to an improper access to already freed up dci client entries while closing dci client.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=21dd238ad58362877e341d905bea1c7cf273f19a; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=8e5749b17c2024af317f06e08aae455af9b79bd0; https://www.codeaurora.org/security-bulletin/2018/08/06/august-2018-code-aurora-security-bulletin
CVE: CVE-2018-11823
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, freeing device memory in driver probe failure will result in double free issue in power module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=4519cc36b1a396dc55c9b43ab6e8736ae4a6f4cf; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=4519cc36b1a396dc55c9b43ab6e8736ae4a6f4cf
CVE: CVE-2018-11906
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern with default privileged access to ADB and debug-fs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=1dffcbf6fea3667a9a19dad70ddba12eff5ccbfb; https://source.codeaurora.org/quic/le/qti-conf/commit/?id=0eeb4558d541fac40b486a224eb6c601b64115a1; https://source.codeaurora.org/quic/le/qti-conf/commit/?id=fba5fe2ff19998db42acd4c39a6b02246e13bee0
CVE: CVE-2018-11907
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /firmware/ which presents a potential issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44
CVE: CVE-2018-11908
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /data/ which presents a potential issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44
CVE: CVE-2018-11909
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /cache/ which presents a potential issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44
CVE: CVE-2018-11910
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /persist/ which presents a potential issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44
CVE: CVE-2018-11911
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of script may lead to unprivileged access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=34d3d7fe7e98cc0a6fb0995107d1cd99d6f29798; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=34d3d7fe7e98cc0a6fb0995107d1cd99d6f29798
CVE: CVE-2018-11912
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of daemons may lead to unprivileged access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=36a2b6dbb9b7839dcb2127bb5d6a5d90c520345f; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=36a2b6dbb9b7839dcb2127bb5d6a5d90c520345f
CVE: CVE-2018-11913
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of dev nodes may lead to potential security issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=7e10a2c815f02696824a6a146304a77d7d47fc43; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=e4d7a885bca8251517ada85545656bfe7a2e6834; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin
CVE: CVE-2018-11914
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /systemrw/ which presents a potential security.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=e1a95254dd0ec874f884160aaf0f5ce7947a06c8; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin
CVE: CVE-2018-11918
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated is automatically released by the kernel if the 'probe' function fails with an error code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=5ca16318bf1a409e9e5c169dc5b7f0821e5323d7; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=5ca16318bf1a409e9e5c169dc5b7f0821e5323d7
CVE: CVE-2018-11919
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a potential heap overflow and memory corruption due to improper error handling in SOC infrastructure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=085e7272b4c5a41b1ab26c683591864aefab14fe; https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=87925782e640efb493f21bf0e255b6a638eea334; https://source.codeaurora.org/quic/qsdk/oss/kernel/linux-msm/commit/?id=456a408d62cef797107e3b0de7d05bb211742bbd
CVE: CVE-2018-11943
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing fastboot flash command, memory leak or unexpected behavior may occur due to processing of unintialized data buffers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=45734409dd45e6b117f7f9f7e11047f67a7accc1; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=45734409dd45e6b117f7f9f7e11047f67a7accc1
CVE: CVE-2018-11946
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, the UPnP daemon should not be running out of box because it enables port forwarding without authentication.
CVSS Score: 6.5 (MEDIUM)
References: https://source.codeaurora.org/quic/qsdk/oss/system/feeds/routing/commit/?id=3f625190fb469cb56de619eae6b5ca8db2463d5b; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/qsdk/oss/system/feeds/routing/commit/?id=3f625190fb469cb56de619eae6b5ca8db2463d5b
CVE: CVE-2018-11956
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper mounting lead to device node and executable to be run from /dsp/ which presents a potential security issue.
CVSS Score: 7.8 (HIGH)
References: https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/le/meta-qti-bsp/commit/?id=ecd2fb4ab9e2a6851add554af03cebe337345c44
CVE: CVE-2018-11995
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a partition name-check variable is not reset for every iteration which may cause improper termination in the META image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105872; https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=e3688be47d2b72f130f90dafd24b5f5acc4684ca; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin
CVE: CVE-2018-19609
Published: 2018-11-27
Description: ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/CCCCCrash/POCs/tree/master/Web/showdoc/IncorrectAccessControl; https://github.com/CCCCCrash/POCs/tree/master/Web/showdoc/IncorrectAccessControl
CVE: CVE-2018-5856
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, due to a race condition, a Use After Free condition can occur in Audio.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=3b666735fcc49f5cd3a63440fdc0667ae9316f17; https://source.codeaurora.org/quic/la/platform/vendor/opensource/audio-kernel/commit/?id=7ab92dd2952d59f3c15c856effe94bba1858e3ff; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin
CVE: CVE-2018-5861
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, existing checks in place on partition size are incomplete and can lead to heap overwrite vulnerabilities while loading a secure application from the boot loader.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=114a392e29bc900c0fe15cc1f3e9ba369cd03244; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=114a392e29bc900c0fe15cc1f3e9ba369cd03244
CVE: CVE-2018-5904
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while list traversal in LPM status driver for clean up, use after free vulnerability may occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=88b838c8952ec6414c72449ae15768d15d2606dd; https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=8e82c0d84ccee87309fd22f8208915f0ba502b26; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin
CVE: CVE-2018-5906
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer overflow in debugfs module due to lack of check in size of input before copying into buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=ac40b7c7591476a8863b477ddc1c14c631f77256; https://www.codeaurora.org/security-bulletin/2018/08/06/august-2018-code-aurora-security-bulletin; https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=ac40b7c7591476a8863b477ddc1c14c631f77256
CVE: CVE-2018-5908
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible buffer overflow in display function due to lack of buffer length validation before copying.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=28e5918c60b832091c6b[PII_REDACTED]803cbd3302; https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=4689d03e5db548d263232c274bf307956207da27; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin
CVE: CVE-2018-5909
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow occur may occur in display handlers due to lack of checking in buffer size before copying into it and will lead to memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=2c1716c5afd660651724b6088f2e6301272f4926; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin; https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=2c1716c5afd660651724b6088f2e6301272f4926
CVE: CVE-2018-5910
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a memory corruption can occur in kernel due to improper check in callers count parameter in display handlers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=b67e04e3696f05411b7434c8b194895d273b00c5; https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=d9344c2f4b60cf5d4c747c11f3cb0b6f1558db78; https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin
CVE: CVE-2018-5919
Published: 2018-11-27
Description: In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a use after free issue in WLAN host driver can lead to device reboot.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=81a80c9973833f7cd93dc83ce0f23572dd81befe; https://www.codeaurora.org/security-bulletin/2018/08/06/august-2018-code-aurora-security-bulletin; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=81a80c9973833f7cd93dc83ce0f23572dd81befe
CVE: CVE-2018-6983
Published: 2018-11-27
Description: VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer overflow vulnerability in the virtual network devices. This issue may allow a guest to execute code on the host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/105986; https://www.vmware.com/security/advisories/VMSA-2018-0030.html; http://www.securityfocus.com/bid/105986
CVE: CVE-2018-12241
Published: 2018-11-27
Description: The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker with knowledge of the SA web UI hostname or IP address can craft a malicious URL for the SA web UI and target SA web UI users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious JavaScript code into the SA web UI client application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105965; https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1466.html; http://www.securityfocus.com/bid/105965
CVE: CVE-2018-6263
Published: 2018-11-27
Description: NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows in which an attacker who has access to a local user account can plant a malicious dynamic link library (DLL) during application installation, which may lead to escalation of privileges.
CVSS Score: 7.8 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4740; https://support.lenovo.com/us/en/product_security/LEN-25444; https://nvidia.custhelp.com/app/answers/detail/a_id/4740
CVE: CVE-2018-6265
Published: 2018-11-27
Description: NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 during application installation on Windows 7 in elevated privilege mode, where a local user who initiates a browser session may obtain escalation of privileges on the browser.
CVSS Score: 7.8 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4740; https://support.lenovo.com/us/en/product_security/LEN-25444; https://nvidia.custhelp.com/app/answers/detail/a_id/4740
CVE: CVE-2018-6266
Published: 2018-11-27
Description: NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows where a local user may obtain third party integration parameters, which may lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4740; https://support.lenovo.com/us/en/product_security/LEN-25444; https://nvidia.custhelp.com/app/answers/detail/a_id/4740
CVE: CVE-2018-17256
Published: 2018-11-27
Description: Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.cspcert.ph/advisories/2018/CVE-2018-17256.html; https://www.cspcert.ph/advisories/2018/CVE-2018-17256.html
CVE: CVE-2018-0719
Published: 2018-11-27
Description: Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/nas-201809-20; https://www.qnap.com/zh-tw/security-advisory/nas-201809-20
CVE: CVE-2018-10142
Published: 2018-11-27
Description: The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106069; https://security.paloaltonetworks.com/CVE-2018-10142; http://www.securityfocus.com/bid/106069
CVE: CVE-2018-13022
Published: 2018-11-27
Description: Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScript via a modified URL path.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/hack-routers-get-toys-exploiting-the-mi-router-3-1d7fd42f0838; https://blog.securityevaluators.com/hack-routers-get-toys-exploiting-the-mi-router-3-1d7fd42f0838
CVE: CVE-2018-13023
Published: 2018-11-27
Description: System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.securityevaluators.com/hack-routers-get-toys-exploiting-the-mi-router-3-1d7fd42f0838; https://blog.securityevaluators.com/hack-routers-get-toys-exploiting-the-mi-router-3-1d7fd42f0838
CVE: CVE-2018-13306
Published: 2018-11-27
Description: System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154; https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE: CVE-2018-13307
Published: 2018-11-27
Description: System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certain payloads cause the device to become permanently inoperable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154; https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE: CVE-2018-13314
Published: 2018-11-27
Description: System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154; https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154