deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-18732
Published: 2018-10-29
Description: An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'ntpServer' parameter for a post request, the value is directly used in a strcpy to a local variable placed on the stack, which overrides the return address of the function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/ZIllR0/Routers/blob/master/Tenda/stack2.md; https://github.com/ZIllR0/Routers/blob/master/Tenda/stack2.md
CVE: CVE-2018-18733
Published: 2018-10-29
Description: An XSS issue was discovered in Catfish CMS 4.8.30, related to "write source code," a similar issue to CVE-2018-13999.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/catfish/blob/master/catfishcms.md#xss; https://github.com/AvaterXXX/catfish/blob/master/catfishcms.md#xss
CVE: CVE-2018-18734
Published: 2018-10-29
Description: A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AvaterXXX/catfish/blob/master/catfishcms.md#csrf; https://github.com/AvaterXXX/catfish/blob/master/catfishcms.md#csrf
CVE: CVE-2018-18735
Published: 2018-10-29
Description: A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AvaterXXX/catfish/blob/master/catfishblog.md#csrf; https://github.com/AvaterXXX/catfish/blob/master/catfishblog.md#csrf
CVE: CVE-2018-18736
Published: 2018-10-29
Description: An XSS issue was discovered in catfish blog 2.0.33, related to "write source code."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/catfish/blob/master/catfishblog.md#xss; https://github.com/AvaterXXX/catfish/blob/master/catfishblog.md#xss
CVE: CVE-2018-18737
Published: 2018-10-29
Description: An XXE issue was discovered in Douchat 4.0.4 because Data\notify.php calls simplexml_load_string. This can also be used for SSRF.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/AvaterXXX/douchat/blob/master/xxe.md#xxe; https://github.com/AvaterXXX/douchat/blob/master/xxe.md#xxe
CVE: CVE-2018-18738
Published: 2018-10-29
Description: An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Categories.php?pid=1&lgid=1 category_key parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss2; https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss2
CVE: CVE-2018-18739
Published: 2018-10-29
Description: An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss1; https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss1
CVE: CVE-2018-18740
Published: 2018-10-29
Description: An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss4; https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss4
CVE: CVE-2018-18741
Published: 2018-10-29
Description: An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Download.php?lgid=1 during editing.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss6; https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss6
CVE: CVE-2018-18742
Published: 2018-10-29
Description: A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AvaterXXX/SEMCMS/blob/master/CSRF.md; https://github.com/AvaterXXX/SEMCMS/blob/master/CSRF.md
CVE: CVE-2018-18743
Published: 2018-10-29
Description: An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss3; https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss3
CVE: CVE-2018-18744
Published: 2018-10-29
Description: An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS_Main.php URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss7; https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss7
CVE: CVE-2018-18745
Published: 2018-10-29
Description: An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss5; https://github.com/AvaterXXX/SEMCMS/blob/master/XSS.md#xss5
CVE: CVE-2018-18748
Published: 2018-10-29
Description: Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE: the vendor disputes this issue because the observed behavior is consistent with the product's intended functionality
CVSS Score: 10.0 (CRITICAL)
References: https://github.com/sandboxescape/Sandboxie-5.26-Sandbox-Escape-Exploit/blob/2632a5f7409e52b2e020f5d4467fa019f9095e73/README.doc; https://github.com/sandboxescape/Sandboxie-5.26-Sandbox-Escape-Exploit/; https://github.com/sandboxescape/Sandboxie-5.26-Sandbox-Escape-Exploit/blob/2632a5f7409e52b2e020f5d4467fa019f9095e73/README.doc
CVE: CVE-2018-18749
Published: 2018-10-29
Description: data-tools through 2017-07-26 has an Integer Overflow leading to an incorrect end value for the write_wchars function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/clarkgrubb/data-tools/issues/7; https://github.com/clarkgrubb/data-tools/issues/7
CVE: CVE-2018-18751
Published: 2018-10-29
Description: An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00061.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00065.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00025.html
CVE: CVE-2018-18752
Published: 2018-10-29
Description: Webiness Inventory 2.3 suffers from an Arbitrary File upload vulnerability via PHP code in the protected/library/ajax/WsSaveToModel.php logo parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://packetstormsecurity.com/files/149982/Webiness-Inventory-2.9-Shell-Upload.html; https://packetstormsecurity.com/files/149982/Webiness-Inventory-2.9-Shell-Upload.html
CVE: CVE-2018-18753
Published: 2018-10-29
Description: Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/wuzhicms/wuzhicms/issues/157; https://github.com/wuzhicms/wuzhicms/issues/157
CVE: CVE-2018-18754
Published: 2018-10-29
Description: ZyXEL VMG3312-B10B 1.00(AAPP.7) devices have a backdoor root account with the tTn3+Z@!Sr0O+ password hash in the etc/default.cfg file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://gist.github.com/numanturle/c99d3306e9e4e17bb2164dde363406bc; https://gist.github.com/numanturle/c99d3306e9e4e17bb2164dde363406bc
CVE: CVE-2018-18764
Published: 2018-10-29
Description: An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow1.md; https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow2.md; https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20getu16%20heap%20buffer%20overflow1.md
CVE: CVE-2018-18765
Published: 2018-10-29
Description: An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.md; https://twitter.com/thracky/status/[PII_REDACTED]40993541; https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.md
CVE: CVE-2018-18771
Published: 2018-10-29
Description: An issue was discovered in LuLu CMS through 2015-05-14. backend\modules\filemanager\controllers\DefaultController.php allows arbitrary file upload by entering a filename, directory name, and PHP code into the three text input fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/yiifans/lulucms/issues/6; https://github.com/yiifans/lulucms/issues/6
CVE: CVE-2018-18778
Published: 2018-10-29
Description: ACME mini_httpd before 1.30 lets remote users read arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.acme.com/software/mini_httpd/; http://www.acme.com/software/mini_httpd/
CVE: CVE-2018-18781
Published: 2018-10-29
Description: DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ky-j/dedecms/issues/9; https://github.com/ky-j/dedecms/issues/9
CVE: CVE-2018-18782
Published: 2018-10-29
Description: Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ky-j/dedecms/issues/10; https://github.com/ky-j/dedecms/issues/10
CVE: CVE-2018-18783
Published: 2018-10-29
Description: XSS was discovered in SEMCMS V3.4 via the semcms_remail.php?type=ok umail parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/m3lon/2018_Recorder/blob/master/SEMCMS%20DOM%20Based%20XSS.md; https://exchange.xforce.ibmcloud.com/vulnerabilities/152197; https://github.com/m3lon/2018_Recorder/blob/master/SEMCMS%20DOM%20Based%20XSS.md
CVE: CVE-2018-18784
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. (This needs an admin user login.)
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-18785
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zs/subzs.php with a zzcmscpid cookie to zs/search.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-18786
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in ajax/zs.php via a pxzs cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-18787
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs.php via a pxzs cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-18788
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. (This needs an admin user login.)
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-18789
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zt/top.php via a Host HTTP header to zt/news.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-18790
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in admin/special_add.php via a zxbigclassid cookie. (This needs an admin user login.)
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-18791
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-18792
Published: 2018-10-29
Description: An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs_list.php via a pxzs cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md; https://github.com/qiubaoyang/CVEs/blob/master/zzcms/zzcms.md
CVE: CVE-2018-0735
Published: 2018-10-29
Description: The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: http://www.securityfocus.com/bid/105750; http://www.securitytracker.com/id/1041986; https://access.redhat.com/errata/RHSA-2019:3700
CVE: CVE-2018-1380
Published: 2018-10-29
Description: IBM InfoSphere Master Data Management Collaboration Server 11.4, 11.5, and 11.6 could allow an authenticated user with CA level access to change change their ca-id to another users and read sensitive information. IBM X-Force ID: 138077.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/138077; https://www.ibm.com/support/docview.wss?uid=ibm10735411; https://exchange.xforce.ibmcloud.com/vulnerabilities/138077
CVE: CVE-2018-1766
Published: 2018-10-29
Description: IBM Team Concert (RTC) 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148620.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10737301; https://exchange.xforce.ibmcloud.com/vulnerabilities/148620; http://www.ibm.com/support/docview.wss?uid=ibm10737301
CVE: CVE-2018-1767
Published: 2018-10-29
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148621.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1041983; https://exchange.xforce.ibmcloud.com/vulnerabilities/148621; https://www.ibm.com/support/docview.wss?uid=ibm10729547
CVE: CVE-2017-18281
Published: 2018-10-29
Description: A bool variable in Video function, which gets typecasted to int before being read could result in an out of bound read access in all Android releases from CAF using the linux kernel
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securitytracker.com/id/1041432; https://www.codeaurora.org/security-bulletin/2018/10/01/october-2018-code-aurora-security-bulletin; http://www.securitytracker.com/id/1041432
CVE: CVE-2018-11856
Published: 2018-10-29
Description: Improper input validation leads to buffer overwrite in the WLAN function that handles WMI commands in Snapdragon Mobile in version SD 835, SD 845, SD 850.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11857
Published: 2018-10-29
Description: Improper input validation in WLAN encrypt/decrypt module can lead to a buffer copy in Snapdragon Mobile in version SD 835, SD 845, SD 850
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11858
Published: 2018-10-29
Description: When processing IE set command, buffer overwrite may occur due to lack of input validation of the IE length in Snapdragon Mobile in version SD 835, SD 845, SD 850.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11859
Published: 2018-10-29
Description: Buffer overwrite can happen in WLAN due to lack of validation of the input length in Snapdragon Mobile in version SD 845, SD 850.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11861
Published: 2018-10-29
Description: Buffer overflow can happen in WLAN function due to lack of validation of the input length in Snapdragon Mobile in version SD 845, SD 850, SDA660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11862
Published: 2018-10-29
Description: Buffer overflow can happen in WLAN module due to lack of validation of the input length in Snapdragon Mobile in version SD 845, SD 850, SDA660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11865
Published: 2018-10-29
Description: Integer overflow may happen when calculating an internal structure size due to lack of validation of the input length in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11866
Published: 2018-10-29
Description: Integer overflow may happen in WLAN when calculating an internal structure size due to lack of validation of the input length in Snapdragon Mobile, Snapdragon Wear in version IPQ8074, MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11867
Published: 2018-10-29
Description: Lack of buffer length check before copying in WLAN function while processing FIPS event, can lead to a buffer overflow in Snapdragon Mobile in version SD 845.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11870
Published: 2018-10-29
Description: Buffer overwrite can occur when the legacy rates count received from the host is not checked against the maximum number of legacy rates in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 600, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDX20.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11871
Published: 2018-10-29
Description: Buffer overwrite can happen in WLAN function while processing set pdev parameter command due to lack of input validation in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon_High_Med_2016.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11872
Published: 2018-10-29
Description: Improper input validation leads to buffer overwrite in the WLAN function that handles WMI commands in Snapdragon Mobile in version SD 845, SD 850, SDA660
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11873
Published: 2018-10-29
Description: Improper input validation leads to buffer overwrite in the WLAN function that handles WLAN roam buffer in Snapdragon Mobile in version SD 845.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11874
Published: 2018-10-29
Description: Buffer overflow if the length of passphrase is more than 32 when setting up secure NDP connection in Snapdragon Mobile in version SD 835, SD 845, SD 850, SDA660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11875
Published: 2018-10-29
Description: Lack of check of buffer size before copying in a WLAN function can lead to a buffer overflow in Snapdragon Mobile in version SD 845, SD 850.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681