deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5956
Published: 2018-01-21
Description: In Zillya! Antivirus 3.0.2230.0, the driver file (zef.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402414.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/ZillyaAntivirus_POC/tree/master/0x9C402414; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/ZillyaAntivirus_POC/tree/master/0x9C402414
CVE: CVE-2018-5957
Published: 2018-01-21
Description: In Zillya! Antivirus 3.0.2230.0, the driver file (zef.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40242C.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/ZillyaAntivirus_POC/tree/master/0x9C40242C; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/ZillyaAntivirus_POC/tree/master/0x9C40242C
CVE: CVE-2018-5958
Published: 2018-01-21
Description: In Zillya! Antivirus 3.0.2230.0, the driver file (zef.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402424.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/ZillyaAntivirus_POC/tree/master/0x9C402424; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/ZillyaAntivirus_POC/tree/master/0x9C402424
CVE: CVE-2018-5960
Published: 2018-01-22
Description: Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.vulnerability-lab.com/get_content.php?id=2043; https://www.vulnerability-lab.com/get_content.php?id=2043
CVE: CVE-2018-5961
Published: 2018-01-22
Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=1835; https://www.vulnerability-lab.com/get_content.php?id=1835
CVE: CVE-2018-5962
Published: 2018-01-22
Description: index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the mail_add-new module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=1836; https://www.vulnerability-lab.com/get_content.php?id=1836
CVE: CVE-2016-10709
Published: 2018-01-22
Description: pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.exploit-db.com/exploits/39709/; https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc; https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_exec
CVE: CVE-2017-18047
Published: 2018-01-22
Description: Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42011/; https://www.exploit-db.com/exploits/43236/; https://www.exploit-db.com/exploits/43518/
CVE: CVE-2018-5968
Published: 2018-01-22
Description: FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
CVSS Score: 8.1 (HIGH)
CWE: CWE-184, CWE-502
References: https://access.redhat.com/errata/RHSA-2018:0478; https://access.redhat.com/errata/RHSA-2018:0479; https://access.redhat.com/errata/RHSA-2018:0480
CVE: CVE-2018-1042
Published: 2018-01-22
Description: Moodle 3.x has Server Side Request Forgery in the filepicker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/153766/Moodle-Filepicker-3.5.2-Server-Side-Request-Forgery.html; http://www.securityfocus.com/bid/102752; https://moodle.org/mod/forum/discuss.php?d=364381
CVE: CVE-2018-1043
Published: 2018-01-22
Description: In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/102769; https://moodle.org/mod/forum/discuss.php?d=364382; http://www.securityfocus.com/bid/102769
CVE: CVE-2018-1044
Published: 2018-01-22
Description: In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102754; https://moodle.org/mod/forum/discuss.php?d=364383; http://www.securityfocus.com/bid/102754
CVE: CVE-2018-1045
Published: 2018-01-22
Description: In Moodle 3.x, there is XSS via a calendar event name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102755; https://moodle.org/mod/forum/discuss.php?d=364384; http://www.securityfocus.com/bid/102755
CVE: CVE-2017-17858
Published: 2018-01-22
Description: Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=55c3f68d638ac1263a386e0aaa004bb6e8bde731; https://bugs.ghostscript.com/show_bug.cgi?id=698819; https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.md
CVE: CVE-2018-5761
Published: 2018-01-22
Description: A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vulnerability might expose Rubrik user credentials configured to access vCenter as Rubrik clusters did not verify TLS certificates presented by vCenter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://gist.github.com/srau/0ed7747953b3571247a6c485f91619ff; https://support.rubrik.com/articles/How_To/000001135; https://gist.github.com/srau/0ed7747953b3571247a6c485f91619ff
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-22
Description: Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.
CVSS Score: 3.7 (LOW)
CWE: CWE-20
References: https://www.knot-resolver.cz/2018-01-22-knot-resolver-1.5.2.html; https://www.knot-resolver.cz/2018-01-22-knot-resolver-1.5.2.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-22
Description: Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.
CVSS Score: 3.7 (LOW)
CWE: CWE-20
References: https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html; https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html
CVE: CVE-2018-5999
Published: 2018-01-22
Description: An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
CVSS Score: 9.8 (CRITICAL)
References: https://blogs.securiteam.com/index.php/archives/3589; https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt; https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb
CVE: CVE-2018-6000
Published: 2018-01-22
Description: An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://blogs.securiteam.com/index.php/archives/3589; https://github.com/pedrib/PoC/blob/master/advisories/asuswrt-lan-rce.txt; https://raw.githubusercontent.com/pedrib/PoC/master/exploits/metasploit/asuswrt_lan_rce.rb
CVE: CVE-2018-6001
Published: 2018-01-22
Description: The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.defensecode.com/advisories/DC-2018-01-002_WordPress_Soundy_Audio_Playlist_Plugin_Advisory.pdf; http://www.defensecode.com/advisories/DC-2018-01-002_WordPress_Soundy_Audio_Playlist_Plugin_Advisory.pdf
CVE: CVE-2018-6002
Published: 2018-01-22
Description: The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.defensecode.com/advisories/DC-2018-01-001_WordPress_Soundy_Background_Music_Plugin_Advisory.pdf; http://www.defensecode.com/advisories/DC-2018-01-001_WordPress_Soundy_Background_Music_Plugin_Advisory.pdf
CVE: CVE-2018-6003
Published: 2018-01-22
Description: An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://git.savannah.nongnu.org/cgit/libtasn1.git/commit/?id=c593ae84cfcde8fea45787e53950e0ac71e9ca97; https://bugzilla.redhat.com/show_bug.cgi?id=1535926; https://bugzilla.suse.com/show_bug.cgi?id=1076832
CVE: CVE-2018-6009
Published: 2018-01-22
Description: In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yiisoft/yii2/commit/6c0540aa2d6e0fe0fa89e4fd35bba4be5d6cece7; https://github.com/yiisoft/yii2/commit/6c0540aa2d6e0fe0fa89e4fd35bba4be5d6cece7
CVE: CVE-2018-6010
Published: 2018-01-22
Description: In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/yiisoft/yii2/commit/6b0be47e0fa9c532e03b07b[PII_REDACTED]fcf5c7a; https://github.com/yiisoft/yii2/issues/14711; https://github.com/yiisoft/yii2/pull/15534
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-22
Description: axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-193
References: https://www.ieee-security.org/TC/SP2017/papers/231.pdf; https://www.youtube.com/watch?v=FW--c_F_cY8; https://www.ieee-security.org/TC/SP2017/papers/231.pdf
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-22
Description: MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension) on X.509 certificates.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/matrixssl/matrixssl/blob/master/doc/CHANGES.md; https://www.ieee-security.org/TC/SP2017/papers/231.pdf; https://www.youtube.com/watch?v=FW--c_F_cY8
CVE: CVE-2018-0845
Published: 2018-01-22
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102746; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0845; http://www.securityfocus.com/bid/102746
CVE: CVE-2018-0848
Published: 2018-01-22
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102747; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0848; http://www.securityfocus.com/bid/102747
CVE: CVE-2018-0849
Published: 2018-01-22
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102748; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0849; http://www.securityfocus.com/bid/102748
CVE: CVE-2018-0862
Published: 2018-01-22
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102749; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862; http://www.securityfocus.com/bid/102749
CVE: CVE-2018-6013
Published: 2018-01-23
Description: Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter. This issue exists in core/admin/ajax/developer/extensions/file-browser.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigtreecms/BigTree-CMS/issues/327; https://github.com/bigtreecms/BigTree-CMS/issues/327
CVE: CVE-2018-6014
Published: 2018-01-23
Description: Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to steal user data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.vulnerability-lab.com/get_content.php?id=2115; https://www.youtube.com/watch?v=t3nYuhAHOMg; https://www.vulnerability-lab.com/get_content.php?id=2115
CVE: CVE-2016-5345
Published: 2018-01-23
Description: Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to gain privileges via a crafted application, aka Android internal bug 32639452 and Qualcomm internal bug CR1079713.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95273; https://source.android.com/security/bulletin/2017-01-01.html; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=67118716a2933f6f30a25ea7e3946569a8b191c6
CVE: CVE-2017-16590
Published: 2018-01-23
Description: This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User interaction is required to exploit this vulnerability. The specific flaw exists within the MainFilter servlet. The issue results from the lack of proper string matching inside the doFilter method. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of Administrator. Was ZDI-CAN-5099.
CVSS Score: 8.8 (HIGH)
CWE: CWE-289, CWE-287
References: https://zerodayinitiative.com/advisories/ZDI-17-955; https://zerodayinitiative.com/advisories/ZDI-17-955
CVE: CVE-2017-16591
Published: 2018-01-23
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.restore.download_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5100.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-200
References: https://zerodayinitiative.com/advisories/ZDI-17-956; https://zerodayinitiative.com/advisories/ZDI-17-956
CVE: CVE-2017-16592
Published: 2018-01-23
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the common.download_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5103.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-200
References: https://zerodayinitiative.com/advisories/ZDI-17-957; https://zerodayinitiative.com/advisories/ZDI-17-957
CVE: CVE-2017-16593
Published: 2018-01-23
Description: This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.restore.del_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filenames parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete any files accessible to the Administrator user. Was ZDI-CAN-5104.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-668
References: https://zerodayinitiative.com/advisories/ZDI-17-958; https://zerodayinitiative.com/advisories/ZDI-17-958
CVE: CVE-2017-16594
Published: 2018-01-23
Description: This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.db.save_005fimage_jsp servlet, which listens on TCP port 8081 by default. When parsing the id parameter, the process does not properly validate user-supplied data, which can allow for the upload of files. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5117.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434, CWE-20
References: https://zerodayinitiative.com/advisories/ZDI-17-959; https://zerodayinitiative.com/advisories/ZDI-17-959
CVE: CVE-2017-16595
Published: 2018-01-23
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.reports.export_005fdownload_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5118.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-200
References: https://zerodayinitiative.com/advisories/ZDI-17-960; https://zerodayinitiative.com/advisories/ZDI-17-960
CVE: CVE-2017-16596
Published: 2018-01-23
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.designer.script_005fsamples_jsp servlet, which listens on TCP port 8081 by default. When parsing the type parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5119.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-200
References: https://zerodayinitiative.com/advisories/ZDI-17-961; https://zerodayinitiative.com/advisories/ZDI-17-961
CVE: CVE-2017-16597
Published: 2018-01-23
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of WRQ requests. When parsing the Filename field, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5137.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-668
References: https://zerodayinitiative.com/advisories/ZDI-17-962; https://zerodayinitiative.com/advisories/ZDI-17-962
CVE: CVE-2017-16598
Published: 2018-01-23
Description: This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.tools.snmpwalk.snmpwalk_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the ip parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5138.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-668
References: https://zerodayinitiative.com/advisories/ZDI-17-963; https://zerodayinitiative.com/advisories/ZDI-17-963