deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0835
Published: 2018-02-15
Description: Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102874; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0835
CVE: CVE-2018-0836
Published: 2018-02-15
Description: Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102875; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0836
CVE: CVE-2018-0837
Published: 2018-02-15
Description: Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102876; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0837
CVE: CVE-2018-0838
Published: 2018-02-15
Description: Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102877; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0838
CVE: CVE-2018-0839
Published: 2018-02-15
Description: Microsoft Edge in Microsoft Windows 10 1703 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0763.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102860; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0839
CVE: CVE-2018-0840
Published: 2018-02-15
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102886; http://www.securitytracker.com/id/1040369; http://www.securitytracker.com/id/1040372
CVE: CVE-2018-0841
Published: 2018-02-15
Description: Microsoft Office 2016 Click-to-Run allows a remote code execution vulnerability due to how objects are handled in memory, aka "Office Remote Code Execution Vulnerability"
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102957; http://www.securitytracker.com/id/1040367; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0841
CVE: CVE-2018-0842
Published: 2018-02-15
Description: Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow an elevation of privilege vulnerability due to how objects in memory are handled, aka "Windows Kernel Elevation of Privilege Vulnerability".
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/102946; http://www.securitytracker.com/id/1040371; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0842
CVE: CVE-2018-0843
Published: 2018-02-15
Description: The Windows kernel in Windows 10 version 1709 and Windows Server, version 1709 allows an information disclosure vulnerability due to how objects in memory are handled, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0742, CVE-2018-0756, CVE-2018-0809 and CVE-2018-0820.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102951; http://www.securitytracker.com/id/1040373; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0843
CVE: CVE-2018-0844
Published: 2018-02-15
Description: The Windows Common Log File System (CLFS) driver in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how objects in memory are handled, aka "Windows Common Log File System Driver Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0846.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102929; http://www.securitytracker.com/id/1040380; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0844
CVE: CVE-2018-0846
Published: 2018-02-15
Description: The Windows Common Log File System (CLFS) driver in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how objects in memory are handled, aka "Windows Common Log File System Driver Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0844.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/102931; http://www.securitytracker.com/id/1040380; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0846
CVE: CVE-2018-0847
Published: 2018-02-15
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow information disclosure, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Information Disclosure Vulnerability".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102861; http://www.securitytracker.com/id/1040370; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0847
CVE: CVE-2018-0850
Published: 2018-02-15
Description: Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run allow an elevation of privilege vulnerability due to how the format of incoming message is validated, aka "Microsoft Outlook Elevation of Privilege Vulnerability".
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/102866; http://www.securitytracker.com/id/1040382; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0850
CVE: CVE-2018-0851
Published: 2018-02-15
Description: Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102870; http://www.securitytracker.com/id/1040381; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851
CVE: CVE-2018-0852
Published: 2018-02-15
Description: Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Outlook handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0851.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102871; http://www.securitytracker.com/id/1040368; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0852
CVE: CVE-2018-0853
Published: 2018-02-15
Description: Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow an information disclosure vulnerability, due to how Office initializes the affected variable, aka "Microsoft Office Information Disclosure Vulnerability".
CVSS Score: 3.3 (LOW)
CWE: CWE-665
References: http://www.securityfocus.com/bid/102868; http://www.securitytracker.com/id/1040381; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0853
CVE: CVE-2018-0855
Published: 2018-02-15
Description: The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0755, CVE-2018-0760, and CVE-2018-0761.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102936; http://www.securitytracker.com/id/1040374; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0855
CVE: CVE-2018-0856
Published: 2018-02-15
Description: Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102880; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0856
CVE: CVE-2018-0857
Published: 2018-02-15
Description: Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102881; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0857
CVE: CVE-2018-0858
Published: 2018-02-15
Description: ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102865; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0858
CVE: CVE-2018-0859
Published: 2018-02-15
Description: Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102882; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0859
CVE: CVE-2018-0860
Published: 2018-02-15
Description: Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0861, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102883; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0860
CVE: CVE-2018-0861
Published: 2018-02-15
Description: Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, and CVE-2018-0866.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102884; http://www.securitytracker.com/id/1040372; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0861
CVE: CVE-2018-0864
Published: 2018-02-15
Description: SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled, aka "Microsoft SharePoint Information Disclosure Vulnerability".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102962; http://www.securitytracker.com/id/1040376; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0864
CVE: CVE-2018-0866
Published: 2018-02-15
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, and CVE-2018-0861.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103032; http://www.securitytracker.com/id/1040369; http://www.securitytracker.com/id/1040372
CVE: CVE-2018-0869
Published: 2018-02-15
Description: SharePoint Server 2016 allows an elevation of privilege vulnerability due to how web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102963; http://www.securitytracker.com/id/1040376; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0869
CVE: CVE-2017-12718
Published: 2018-02-15
Description: A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump does not verify input buffer size prior to copying, leading to a buffer overflow, allowing remote code execution on the target device. The pump receives the potentially malicious input infrequently and under certain conditions, increasing the difficulty of exploitation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-119
References: http://www.securityfocus.com/bid/100665; http://www.securityfocus.com/bid/101252; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A
CVE: CVE-2017-12720
Published: 2018-02-15
Description: An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump does not require authentication if the pump is configured to allow FTP connections.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: http://www.securityfocus.com/bid/100665; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A; http://www.securityfocus.com/bid/100665
CVE: CVE-2017-12721
Published: 2018-02-15
Description: An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump does not validate host certificates, leaving the pump vulnerable to a man-in-the-middle (MITM) attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/100665; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A; http://www.securityfocus.com/bid/100665
CVE: CVE-2017-12722
Published: 2018-02-15
Description: An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump reads memory out of bounds, causing the communications module to crash. Smiths Medical assesses that the crash of the communications module would not impact the operation of the therapeutic module.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100665; http://www.securityfocus.com/bid/101252; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A
CVE: CVE-2017-12723
Published: 2018-02-15
Description: A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stores some passwords in the configuration file, which are accessible if the pump is configured to allow external communications.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100665; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A; http://www.securityfocus.com/bid/100665
CVE: CVE-2017-12724
Published: 2018-02-15
Description: A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump contains hardcoded credentials, which are not fully initialized. The FTP server is only accessible if the pump is configured to allow FTP connections.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/bid/100665; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A; http://www.securityfocus.com/bid/100665
CVE: CVE-2017-12725
Published: 2018-02-15
Description: A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with default network configuration uses hard-coded credentials to automatically establish a wireless network connection. The pump will establish a wireless network connection even if the pump is Ethernet connected and active; however, if the wireless association is established and the Ethernet cable is attached, the pump does not attach the network stack to the wireless network. In this scenario, all network traffic is instead directed over the wired Ethernet connection.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-798
References: http://www.securityfocus.com/bid/100665; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A; http://www.securityfocus.com/bid/100665
CVE: CVE-2017-12726
Published: 2018-02-15
Description: A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which can be used if the pump is configured to allow external communications. Smiths Medical assesses that it is not possible to upload files via Telnet and the impact of this vulnerability is limited to the communications module.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/bid/100665; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-02A; http://www.securityfocus.com/bid/100665
CVE: CVE-2017-18189
Published: 2018-02-15
Description: In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2019:2283; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881121; https://lists.debian.org/debian-lts-announce/2019/02/msg00042.html
CVE: CVE-2018-5440
Published: 2018-02-15
Description: A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server. Specifically: all Microsoft Windows (also WinCE) based CODESYS web servers running stand-alone Version 2.3, or as part of the CODESYS runtime system running prior to Version V1.1.9.19. A crafted request may cause a buffer overflow and could therefore execute arbitrary code on the web server or lead to a denial-of-service condition due to a crash in the web server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/102909; https://ics-cert.us-cert.gov/advisories/ICSA-18-032-02; http://www.securityfocus.com/bid/102909
CVE: CVE-2018-7055
Published: 2018-02-15
Description: GroupViewProxyServlet in RoomWizard before 4.4.x allows SSRF via the url parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: http://misteralfa-hack.blogspot.cl/2018/02/steelcase-sala-por-favor-y-todos-tus.html; http://misteralfa-hack.blogspot.cl/2018/02/steelcase-sala-por-favor-y-todos-tus.html
CVE: CVE-2018-7056
Published: 2018-02-15
Description: RoomWizard before 4.4.x allows remote attackers to obtain potentially sensitive information about IP addresses via /getGroupTimeLineJSON.action.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://misteralfa-hack.blogspot.cl/2018/02/steelcase-sala-por-favor-y-todos-tus.html; http://misteralfa-hack.blogspot.cl/2018/02/steelcase-sala-por-favor-y-todos-tus.html
CVE: CVE-2018-7057
Published: 2018-02-15
Description: RoomWizard before 4.4.x allows XSS via the HelpAction.action pageName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://misteralfa-hack.blogspot.cl/2018/02/steelcase-sala-por-favor-y-todos-tus.html; http://misteralfa-hack.blogspot.cl/2018/02/steelcase-sala-por-favor-y-todos-tus.html