deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-2402
Published: 2018-03-14
Description: In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system.
CVSS Score: 7.6 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103369; https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/; https://launchpad.support.sap.com/#/notes/2587369
CVE: CVE-2018-6328
Published: 2018-03-14
Description: It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.unitrends.com/UnitrendsBackup/s/article/000001150; https://support.unitrends.com/UnitrendsBackup/s/article/000006002; https://www.exploit-db.com/exploits/44297/
CVE: CVE-2018-6329
Published: 2018-03-14
Description: It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://support.unitrends.com/UnitrendsBackup/s/article/000001150; https://support.unitrends.com/UnitrendsBackup/s/article/000006003; https://www.exploit-db.com/exploits/44297/
CVE: CVE-2018-8710
Published: 2018-03-14
Description: A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://sec-consult.com/en/blog/advisories/arbitrary-shortcode-execution-local-file-inclusion-in-woof-pluginus-net/index.html; https://wordpress.org/plugins/woocommerce-products-filter/#developers; https://www.woocommerce-filter.com/update-woocommerce-products-filter-v-2-2-0/
CVE: CVE-2018-8711
Published: 2018-03-14
Description: A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://sec-consult.com/en/blog/advisories/arbitrary-shortcode-execution-local-file-inclusion-in-woof-pluginus-net/index.html; https://wordpress.org/plugins/woocommerce-products-filter/#developers; https://www.woocommerce-filter.com/update-woocommerce-products-filter-v-2-2-0/
CVE: CVE-2018-8712
Published: 2018-03-14
Description: An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.7elements.co.uk/resources/technical-advisories/webmin-1-840-1-880-unrestricted-access-arbitrary-files-using-local-file-include/; https://www.7elements.co.uk/resources/technical-advisories/webmin-1-840-1-880-unrestricted-access-arbitrary-files-using-local-file-include/
CVE: CVE-2017-12194
Published: 2018-03-14
Description: A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-20
References: http://www.securityfocus.com/bid/103413; https://bugzilla.redhat.com/show_bug.cgi?id=1501200; https://security.gentoo.org/glsa/201811-20
CVE: CVE-2018-7701
Published: 2018-03-15
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) delete e-mail messages via a delete action in a request to secmail/getmessage.exe or (2) spoof arbitrary users and reply to their messages via a request to secserver/securectrl.exe.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2018/Mar/29; https://www.exploit-db.com/exploits/44285/; https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html
CVE: CVE-2018-7702
Published: 2018-03-15
Description: SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments by leveraging missing authentication and authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: http://seclists.org/fulldisclosure/2018/Mar/29; https://www.exploit-db.com/exploits/44285/; https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html
CVE: CVE-2018-7703
Published: 2018-03-15
Description: Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Mar/29; https://www.exploit-db.com/exploits/44285/; https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html
CVE: CVE-2018-7704
Published: 2018-03-15
Description: SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2018/Mar/29; https://www.exploit-db.com/exploits/44285/; https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html
CVE: CVE-2018-7705
Published: 2018-03-15
Description: Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. (dot dot) in the filename parameter to secupload2/upload.aspx.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/Mar/29; https://www.exploit-db.com/exploits/44285/; https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html
CVE: CVE-2018-7706
Published: 2018-03-15
Description: Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. (dot dot) in the option2 parameter in an attachment action to secmail/getmessage.exe.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/Mar/29; https://www.exploit-db.com/exploits/44285/; https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html
CVE: CVE-2018-7707
Published: 2018-03-15
Description: Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Mar/29; https://www.exploit-db.com/exploits/44285/; https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html
CVE: CVE-2018-7756
Published: 2018-03-15
Description: RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which allows remote attackers to execute arbitrary code or access internal commands, as demonstrated by a RUN command that launches a .EXE file located at an arbitrary external URL, or a "SETFIREWALL Off" command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://hyp3rlinx.altervista.org/advisories/DEWESOFT-X3-REMOTE-INTERNAL-COMMAND-ACCESS.txt; https://www.exploit-db.com/exploits/44275/; http://hyp3rlinx.altervista.org/advisories/DEWESOFT-X3-REMOTE-INTERNAL-COMMAND-ACCESS.txt
CVE: CVE-2018-8045
Published: 2018-03-15
Description: In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/103402; http://www.securitytracker.com/id/1040540; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-sqli-vulnerability.html
CVE: CVE-2018-8715
Published: 2018-03-15
Description: The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://blogs.securiteam.com/index.php/archives/3676; https://github.com/embedthis/appweb/issues/610; https://security.paloaltonetworks.com/CVE-2018-8715
CVE: CVE-2018-8717
Published: 2018-03-15
Description: joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/joyplus/joyplus-cms/issues/419; https://github.com/joyplus/joyplus-cms/issues/419
CVE: CVE-2018-7886
Published: 2018-03-15
Description: An issue was discovered in CloudMe 1.11.0. An unauthenticated local attacker that can connect to the "CloudMe Sync" client application listening on 127.0.0.1 port 8888 can send a malicious payload causing a buffer overflow condition. This will result in code execution, as demonstrated by a TCP reverse shell, or a crash. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-6892.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://0day4u.wordpress.com/2018/03/09/buffer-overflow-on-cloudme-sync-v1-11-0/; https://www.exploit-db.com/exploits/44470/; https://0day4u.wordpress.com/2018/03/09/buffer-overflow-on-cloudme-sync-v1-11-0/
CVE: CVE-2017-18232
Published: 2018-03-15
Description: The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.
CVSS Score: 5.5 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0558f33c06bb910e2879e355192227a8e8f0219d; http://www.securityfocus.com/bid/103423; https://access.redhat.com/errata/RHSA-2018:3083
CVE: CVE-2018-8076
Published: 2018-03-15
Description: ZenMate 1.5.4 for macOS suffers from a type confusion vulnerability within the com.zenmate.chron-xpc LaunchDaemon component. The LaunchDaemon implements an XPC service that uses an insecure XPC API for accessing data from an inbound XPC message. This could potentially result in an XPC object of the wrong type being passed as the first argument to the xpc_connection_create_from_endpoint function if controlled by an attacker. In recent versions of macOS and OS X, Apple has implemented an internal check to prevent such XPC API abuse from occurring, thus making this vulnerability only result in a denial of service if exploited by an attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-016.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-016.md
CVE: CVE-2018-8721
Published: 2018-03-15
Description: Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103424; https://pitstop.manageengine.com/portal/community/topic/manageengine-eventlog-analyzer-11-0-build-11000-stored-cross-site-scripting-attack; http://www.securityfocus.com/bid/103424
CVE: CVE-2018-8722
Published: 2018-03-15
Description: Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/desktop-central/cross-site-scripting-vulnerability.html; https://www.manageengine.com/products/desktop-central/cross-site-scripting-vulnerability.html
CVE: CVE-2018-8720
Published: 2018-03-15
Description: ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka search_results.do).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/137427/ServiceNow-ITSM-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/137427/ServiceNow-ITSM-Cross-Site-Scripting.html
CVE: CVE-2018-8728
Published: 2018-03-15
Description: server/app/views/static/code.html in Kontena before 1.5.0 allows XSS in "kontena master login --remote" code display, as demonstrated by /code#code= in a URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kontena/kontena/pull/3223; https://github.com/kontena/kontena/releases/tag/v1.5.0; https://lgtm.com/projects/g/kontena/kontena/rev/06a7a06e65a5ef0dada14faee2ae20388b87c1fe
CVE: CVE-2018-8729
Published: 2018-03-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pojome/activity-log/commit/950c46b2290c991187ff3471640e9688b16908fb; https://github.com/pojome/activity-log/commit/e7bcd12fcb0add82bed762a971f427a360664bd9; https://plugins.trac.wordpress.org/changeset/1836276
CVE: CVE-2017-18233
Published: 2018-03-15
Description: An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-835
References: https://access.redhat.com/errata/RHSA-2019:2048; https://bugs.freedesktop.org/show_bug.cgi?id=102151; https://cgit.freedesktop.org/exempi/commit/?id=65a8492832b7335ffabd01f5f64d89dec757c260
CVE: CVE-2017-18234
Published: 2018-03-15
Description: An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2019:2048; https://bugs.freedesktop.org/show_bug.cgi?id=100397; https://cgit.freedesktop.org/exempi/commit/?id=c26d5beb60a5a85f76259f50ed3e08c8169b0a0c
CVE: CVE-2017-18235
Published: 2018-03-15
Description: An issue was discovered in Exempi before 2.4.3. The VPXChunk class in XMPFiles/source/FormatSupport/WEBP_Support.cpp does not ensure nonzero widths and heights, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted .webp file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://bugs.freedesktop.org/show_bug.cgi?id=101913; https://cgit.freedesktop.org/exempi/commit/?id=9e76a7782a54a242f18d609e7ba32bf1c430a5e4; https://bugs.freedesktop.org/show_bug.cgi?id=101913
CVE: CVE-2017-18236
Published: 2018-03-15
Description: An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://access.redhat.com/errata/RHSA-2019:2048; https://bugs.freedesktop.org/show_bug.cgi?id=102484; https://cgit.freedesktop.org/exempi/commit/?id=fe59605d3520bf2ca4e0a963d194f10e9fee5806
CVE: CVE-2017-18237
Published: 2018-03-15
Description: An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugs.freedesktop.org/show_bug.cgi?id=101914; https://cgit.freedesktop.org/exempi/commit/?id=f19d0107fbae1fb41836cd110d4425e407e64048; https://bugs.freedesktop.org/show_bug.cgi?id=101914
CVE: CVE-2017-18238
Published: 2018-03-15
Description: An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .qt file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://access.redhat.com/errata/RHSA-2019:2048; https://bugs.freedesktop.org/show_bug.cgi?id=102483; https://cgit.freedesktop.org/exempi/commit/?id=886cd1d2314755adb1f4cdb99c16ff00830f0331
CVE: CVE-2018-6219
Published: 2018-03-15
Description: An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesdrop and tamper with certain types of update data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6220
Published: 2018-03-15
Description: An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining code execution on vulnerable systems.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6221
Published: 2018-03-15
Description: An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file and inject their own.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6222
Published: 2018-03-15
Description: Arbitrary logs location in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to change location of log files and be manipulated to execute arbitrary commands and attain command execution on a vulnerable system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6223
Published: 2018-03-15
Description: A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate the registration process of the product to reset configuration parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6224
Published: 2018-03-15
Description: A lack of cross-site request forgery (CSRF) protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to submit authenticated requests to a user browsing an attacker-controlled domain.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6225
Published: 2018-03-15
Description: An XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protected configuration script.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-611
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6226
Published: 2018-03-15
Description: Reflected cross-site scripting (XSS) vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files could allow an attacker to inject client-side scripts into vulnerable systems.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6227
Published: 2018-03-15
Description: A stored cross-site scripting (XSS) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject client-side scripts into vulnerable systems.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6228
Published: 2018-03-15
Description: A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/
CVE: CVE-2018-6229
Published: 2018-03-15
Description: A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://success.trendmicro.com/solution/1119349; https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44166/