deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0188
Published: 2018-03-28
Description: Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepting a user request for the affected UI and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or allow the attacker to access sensitive browser-based information on the user's system. Cisco Bug IDs: CSCuz38591, CSCvb09530, CSCvb10022.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103551; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-webuixss; http://www.securityfocus.com/bid/103551
CVE: CVE-2018-0189
Published: 2018-03-28
Description: A vulnerability in the Forwarding Information Base (FIB) code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, network attacker to cause a denial of service (DoS) condition. The vulnerability is due to a limitation in the way the FIB is internally representing recursive routes. An attacker could exploit this vulnerability by injecting routes into the routing protocol that have a specific recursive pattern. The attacker must be in a position on the network that provides the ability to inject a number of recursive routes with a specific pattern. An exploit could allow the attacker to cause an affected device to reload, creating a DoS condition. Cisco Bug IDs: CSCva91655.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/103548; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-FIB-dos; http://www.securityfocus.com/bid/103548
CVE: CVE-2018-0190
Published: 2018-03-28
Description: Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepting a user request for the affected UI and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or allow the attacker to access sensitive browser-based information on the user's system. Cisco Bug IDs: CSCuz38591, CSCvb09530, CSCvb10022.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103551; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-webuixss; http://www.securityfocus.com/bid/103551
CVE: CVE-2018-0193
Published: 2018-03-28
Description: Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute commands with root privileges on the device. The vulnerabilities exist because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An attacker could exploit these vulnerabilities by submitting a malicious CLI command to the affected software. A successful exploit could allow the attacker to break from the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell on an affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuz03145, CSCuz56419, CSCva31971, CSCvb09542.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/103547; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-cmdinj; http://www.securityfocus.com/bid/103547
CVE: CVE-2018-0195
Published: 2018-03-28
Description: A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious request to an affected device via the REST API. A successful exploit could allow the attacker to selectively bypass authorization checks for the REST API of the affected software and use the API to perform privileged actions on an affected device. Cisco Bug IDs: CSCuz56428.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/103557; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-rest; http://www.securityfocus.com/bid/103557
CVE: CVE-2018-0196
Published: 2018-03-28
Description: A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbitrary files to the operating system of an affected device. The vulnerability is due to insufficient input validation of HTTP requests that are sent to the web UI of the affected software. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of the affected software. A successful exploit could allow the attacker to write arbitrary files to the operating system of an affected device. Cisco Bug IDs: CSCvb22645.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103570; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-wfw; http://www.securityfocus.com/bid/103570
CVE: CVE-2018-9120
Published: 2018-03-29
Description: In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.seekurity.com/blog/general/multiple-cross-site-scripting-vulnerabilities-in-crea8social-social-network-script/; https://www.youtube.com/watch?v=QqJFh3Ame9g; https://www.seekurity.com/blog/general/multiple-cross-site-scripting-vulnerabilities-in-crea8social-social-network-script/
CVE: CVE-2018-9121
Published: 2018-03-29
Description: In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.seekurity.com/blog/general/multiple-cross-site-scripting-vulnerabilities-in-crea8social-social-network-script/; https://www.youtube.com/watch?v=bCf0hO9upto; https://www.seekurity.com/blog/general/multiple-cross-site-scripting-vulnerabilities-in-crea8social-social-network-script/
CVE: CVE-2018-9122
Published: 2018-03-29
Description: In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.seekurity.com/blog/general/multiple-cross-site-scripting-vulnerabilities-in-crea8social-social-network-script/; https://www.youtube.com/watch?v=QqJFh3Ame9g; https://www.seekurity.com/blog/general/multiple-cross-site-scripting-vulnerabilities-in-crea8social-social-network-script/
CVE: CVE-2018-9123
Published: 2018-03-29
Description: In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.seekurity.com/blog/general/multiple-cross-site-scripting-vulnerabilities-in-crea8social-social-network-script/; https://www.seekurity.com/blog/general/multiple-cross-site-scripting-vulnerabilities-in-crea8social-social-network-script/
CVE: CVE-2018-7600
Published: 2018-03-29
Description: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/103534; http://www.securitytracker.com/id/1040598; https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/
CVE: CVE-2018-9116
Published: 2018-03-29
Description: An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://groups.google.com/forum/#%21topic/wiremock-user/PQ1UQzKZVl0; https://groups.google.com/forum/#%21topic/wiremock-user/PQ1UQzKZVl0
CVE: CVE-2018-9117
Published: 2018-03-29
Description: WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a specially crafted XML request, aka Directory Traversal.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://groups.google.com/forum/#%21topic/wiremock-user/PQ1UQzKZVl0; https://groups.google.com/forum/#%21topic/wiremock-user/PQ1UQzKZVl0
CVE: CVE-2018-4841
Published: 2018-03-29
Description: A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/tcp could perform administrative operations on the device without prior authentication. Successful exploitation could allow to cause a denial-of-service, or read and manipulate data as well as configuration settings of the affected device. At the stage of publishing this security advisory no public exploitation is known. Siemens provides mitigations to resolve it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-303, CWE-287
References: http://www.securityfocus.com/bid/103576; https://cert-portal.siemens.com/productcert/pdf/ssa-110922.pdf; http://www.securityfocus.com/bid/103576
CVE: CVE-2018-5223
Published: 2018-03-29
Description: Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103665; https://confluence.atlassian.com/x/Zi5sO; https://confluence.atlassian.com/x/aS5sO
CVE: CVE-2018-5224
Published: 2018-03-29
Description: Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan in Bamboo that has a non-linked Mercurial repository, or create a plan in Bamboo either globally or in a project using Bamboo Specs can can execute code of their choice on systems that run a vulnerable version of Bamboo on the Windows operating system. All versions of Bamboo starting with 2.7.0 before 6.3.3 (the fixed version for 6.3.x) and from version 6.4.0 before 6.4.1 (the fixed version for 6.4.x) running on the Windows operating system are affected by this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103653; https://confluence.atlassian.com/x/PS9sO; https://jira.atlassian.com/browse/BAM-19743
CVE: CVE-2018-6586
Published: 2018-03-29
Description: CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processing.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securitytracker.com/id/1040603; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180328-01--security-notice-for-ca-api-developer-portal.html; http://www.securitytracker.com/id/1040603
CVE: CVE-2018-6587
Published: 2018-03-29
Description: CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securitytracker.com/id/1040603; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180328-01--security-notice-for-ca-api-developer-portal.html; http://www.securitytracker.com/id/1040603
CVE: CVE-2018-6588
Published: 2018-03-29
Description: CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securitytracker.com/id/1040603; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180328-01--security-notice-for-ca-api-developer-portal.html; http://www.securitytracker.com/id/1040603
CVE: CVE-2017-3777
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3778
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3779
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3780
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3781
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3782
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3783
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3784
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3785
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3786
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3787
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3788
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3789
Published: 2018-03-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2018-9031
Published: 2018-03-29
Description: The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://gist.github.com/pabloonicarres/c2c284ca7b025d629da39087445ed15d#file-sentryvision_authentication_bypass-sh; https://www.youtube.com/watch?v=pLMH9vGPRCo; https://gist.github.com/pabloonicarres/c2c284ca7b025d629da39087445ed15d#file-sentryvision_authentication_bypass-sh
CVE: CVE-2014-5028
Published: 2018-03-29
Description: The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/22/12; https://bugzilla.redhat.com/show_bug.cgi?id=1123692; https://exchange.xforce.ibmcloud.com/vulnerabilities/94813
CVE: CVE-2014-5170
Published: 2018-03-29
Description: The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file contents after SA-CORE-2013-003.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/07/31/4; https://exchange.xforce.ibmcloud.com/vulnerabilities/95054; https://www.drupal.org/node/2312655
CVE: CVE-2014-6604
Published: 2018-03-29
Description: Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://barmat.io/blog/2014/10/01/stored-xss-vulnerability-in-the-wordpress-plugin-subscribe2/; https://plugins.trac.wordpress.org/changeset/993564/subscribe2; http://barmat.io/blog/2014/10/01/stored-xss-vulnerability-in-the-wordpress-plugin-subscribe2/
CVE: CVE-2015-2000
Published: 2018-03-29
Description: The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-118
References: https://alephsecurity.com/vulns/aleph-2015001; https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf; https://alephsecurity.com/vulns/aleph-2015001
CVE: CVE-2015-2001
Published: 2018-03-29
Description: The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-118
References: https://alephsecurity.com/vulns/aleph-2015002; https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf; https://alephsecurity.com/vulns/aleph-2015002
CVE: CVE-2015-2002
Published: 2018-03-29
Description: The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-118
References: https://alephsecurity.com/vulns/aleph-2015003; https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf; https://alephsecurity.com/vulns/aleph-2015003
CVE: CVE-2015-2003
Published: 2018-03-29
Description: The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-118
References: https://alephsecurity.com/vulns/aleph-2015004; https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf; https://alephsecurity.com/vulns/aleph-2015004
CVE: CVE-2015-2004
Published: 2018-03-29
Description: The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-118
References: https://alephsecurity.com/vulns/aleph-2015005; https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf; https://alephsecurity.com/vulns/aleph-2015005
CVE: CVE-2015-2009
Published: 2018-03-29
Description: Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to webmin. IBM X-Force ID: 103921.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21965821; http://www-01.ibm.com/support/docview.wss?uid=swg21965821
CVE: CVE-2015-2020
Published: 2018-03-29
Description: The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://alephsecurity.com/vulns/aleph-2015006; https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf; https://alephsecurity.com/vulns/aleph-2015006
CVE: CVE-2015-4952
Published: 2018-03-29
Description: The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. IBM X-Force ID: 105196.
CVSS Score: 8.8 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21962602; http://www-01.ibm.com/support/docview.wss?uid=swg21962602
CVE: CVE-2015-4953
Published: 2018-03-29
Description: IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a weakness in its encryption protocol. IBM X-Force ID: 105197.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-326
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV81388; https://exchange.xforce.ibmcloud.com/vulnerabilities/105197; https://www-304.ibm.com/support/docview.wss?uid=swg21972041
CVE: CVE-2017-5947
Published: 2018-03-29
Description: An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download (EDL) mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as the Android Bootloader.
CVSS Score: 6.8 (MEDIUM)
References: https://alephsecurity.com/vulns/aleph-2017007; https://alephsecurity.com/vulns/aleph-2017007
CVE: CVE-2018-1191
Published: 2018-03-29
Description: Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-215, CWE-200
References: https://www.cloudfoundry.org/blog/cve-2018-1191/; https://www.cloudfoundry.org/blog/cve-2018-1191/