deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-9514
Published: 2018-10-02
Description: In sdcardfs_open of file.c, there is a possible Use After Free due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-111642636 References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/105483; https://source.android.com/security/bulletin/2018-10-01; http://www.securityfocus.com/bid/105483
CVE: CVE-2018-9515
Published: 2018-10-02
Description: In sdcardfs_create and sdcardfs_mkdir of inode.c, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-111641492 References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105483; https://source.android.com/security/bulletin/2018-10-01; https://www.exploit-db.com/exploits/45558/
CVE: CVE-2017-7908
Published: 2018-10-02
Description: A heap-based buffer overflow exists in the third-party product Gigasoft, v5 and prior, included in GE Communicator 3.15 and prior. A malicious HTML file that loads the ActiveX controls can trigger the vulnerability via unchecked function calls.
CVSS Score: 7.6 (HIGH)
CWE: CWE-122, CWE-119
References: http://www.securityfocus.com/bid/99580; https://ics-cert.us-cert.gov/advisories/ICSA-18-275-02; http://www.securityfocus.com/bid/99580
CVE: CVE-2018-14822
Published: 2018-10-02
Description: Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, which may allow an attacker to impersonate a legitimate user and execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-598, CWE-200
References: http://www.securityfocus.com/bid/105489; https://ics-cert.us-cert.gov/advisories/ICSA-18-275-03; http://www.securityfocus.com/bid/105489
CVE: CVE-2018-14826
Published: 2018-10-02
Description: Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with a specially crafted URL. This could allow for remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-20
References: http://www.securityfocus.com/bid/105489; https://ics-cert.us-cert.gov/advisories/ICSA-18-275-03; http://www.securityfocus.com/bid/105489
CVE: CVE-2018-3943
Published: 2018-10-02
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0610; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3944
Published: 2018-10-02
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0611; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3957
Published: 2018-10-02
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Keywords property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3958
Published: 2018-10-02
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Subject property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3959
Published: 2018-10-02
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Author property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628; https://www.foxitsoftware.com/support/security-bulletins.php; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628
CVE: CVE-2018-3960
Published: 2018-10-02
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Producer property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628; https://www.foxitsoftware.com/support/security-bulletins.php; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628
CVE: CVE-2018-3961
Published: 2018-10-02
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Creator property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628; https://www.foxitsoftware.com/support/security-bulletins.php; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628
CVE: CVE-2018-3962
Published: 2018-10-02
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the CreationDate property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0628; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17938
Published: 2018-10-03
Description: Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: https://bugzilla.zimbra.com/show_bug.cgi?id=109021; https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.10; https://bugzilla.zimbra.com/show_bug.cgi?id=109021
CVE: CVE-2018-17942
Published: 2018-10-03
Description: The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/coreutils/gnulib/commit/278b4175c9d7dd47c1a3071554aac02add3b3c35; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5UQRNQE6XHMD5UYYHAU3VQWAYHIPMQS/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGHTVYH3KAFN34QXNSGEQDSTV7MCOQW/
CVE: CVE-2018-17946
Published: 2018-10-03
Description: The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.defensecode.com/advisories/DC-2017-01-014_WordPress_Tribulant_Slideshow_Gallery_Plugin_Advisory.pdf; https://wordpress.org/plugins/slideshow-gallery/#developers; http://www.defensecode.com/advisories/DC-2017-01-014_WordPress_Tribulant_Slideshow_Gallery_Plugin_Advisory.pdf
CVE: CVE-2018-17947
Published: 2018-10-03
Description: The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.defensecode.com/advisories/DC-2018-05-006_WordPress_Snazzy_Maps_Plugin_Advisory.pdf; https://seclists.org/bugtraq/2018/Jul/72; https://wordpress.org/plugins/snazzy-maps/#developers
CVE: CVE-2018-6689
Published: 2018-10-03
Description: Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint (DLPe) 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attackers to bypass local security protection via specific conditions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://www.securitytracker.com/id/1041908; https://kc.mcafee.com/corporate/index?page=content&id=SB10252; http://www.securitytracker.com/id/1041908
CVE: CVE-2018-14800
Published: 2018-10-03
Description: Delta Electronics ISPSoft version 3.0.5 and prior allow an attacker, by opening a crafted file, to cause the application to read past the boundary allocated to a stack object, which could allow execution of code under the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-125
References: http://www.securityfocus.com/bid/105485; https://ics-cert.us-cert.gov/advisories/ICSA-18-275-01; http://www.securityfocus.com/bid/105485
CVE: CVE-2018-1793
Published: 2018-10-03
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148948.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1041801; https://exchange.xforce.ibmcloud.com/vulnerabilities/148948; https://www.ibm.com/support/docview.wss?uid=ibm10729563
CVE: CVE-2018-1794
Published: 2018-10-03
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148949.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1041802; https://exchange.xforce.ibmcloud.com/vulnerabilities/148949; https://www.ibm.com/support/docview.wss?uid=ibm10729571
CVE: CVE-2018-3946
Published: 2018-10-03
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0613; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3964
Published: 2018-10-03
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0629; https://www.foxitsoftware.com/support/security-bulletins.php; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0629
CVE: CVE-2018-3965
Published: 2018-10-03
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0630; https://www.foxitsoftware.com/support/security-bulletins.php; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0630
CVE: CVE-2018-3966
Published: 2018-10-03
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0631; https://www.foxitsoftware.com/support/security-bulletins.php; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0631
CVE: CVE-2018-3967
Published: 2018-10-03
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0632; https://www.foxitsoftware.com/support/security-bulletins.php; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0632
CVE: CVE-2018-3993
Published: 2018-10-03
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0661; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3994
Published: 2018-10-03
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0662; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-3995
Published: 2018-10-03
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041769; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0663; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-16048
Published: 2018-10-03
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Missing Authorization Control for API Repository Storage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/49947; https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE: CVE-2018-16049
Published: 2018-10-03
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/46967; https://gitlab.com/gitlab-org/gitlab-ce/issues/49272
CVE: CVE-2018-16050
Published: 2018-10-03
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/49085; https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE: CVE-2018-16051
Published: 2018-10-03
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload Files Exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/6012; https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/
CVE: CVE-2018-12087
Published: 2018-10-03
Description: Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over a piece of network infrastructure to decrypt passwords.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12087.pdf; https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12087.pdf
CVE: CVE-2018-17053
Published: 2018-10-03
Description: Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17054.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/; https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018; https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/
CVE: CVE-2018-17054
Published: 2018-10-03
Description: Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17053.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/; https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018; https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/
CVE: CVE-2018-17965
Published: 2018-10-03
Description: ImageMagick 7.0.7-28 has a memory leak vulnerability in WriteSGIImage in coders/sgi.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/1052; https://usn.ubuntu.com/4034-1/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-17965
CVE: CVE-2018-17966
Published: 2018-10-03
Description: ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/1050; https://usn.ubuntu.com/4034-1/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-17966
CVE: CVE-2018-17967
Published: 2018-10-03
Description: ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/1051; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-17967; https://github.com/ImageMagick/ImageMagick/issues/1051
CVE: CVE-2018-17969
Published: 2018-10-03
Description: Samsung SCX-6545X V2.00.03.01 03-23-2012 devices allows remote attackers to discover cleartext credentials via iso.3.6.1.4.1.236.11.5.11.81.10.1.5.0 and iso.3.6.1.4.1.236.11.5.11.81.10.1.6.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://misteralfa-hack.blogspot.com/2018/10/samsung-printer-passwordleak.html; http://misteralfa-hack.blogspot.com/2018/10/samsung-printer-passwordleak.html
CVE: CVE-2017-2751
Published: 2018-10-03
Description: A BIOS password extraction vulnerability has been reported on certain consumer notebooks with firmware F.22 and others. The BIOS password was stored in CMOS in a way that allowed it to be extracted. This applies to consumer notebooks launched in early 2014.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-522
References: https://support.hp.com/us-en/document/c05913581; https://support.hp.com/us-en/document/c05913581