deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-8155
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8149, CVE-2018-8156, CVE-2018-8168.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104047; http://www.securitytracker.com/id/1040856; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8155
CVE: CVE-2018-8156
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint, Microsoft Project Server. This CVE ID is unique from CVE-2018-8149, CVE-2018-8155, CVE-2018-8168.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104048; http://www.securitytracker.com/id/1040856; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8156
CVE: CVE-2018-8157
Published: 2018-05-09
Description: A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability." This affects Microsoft Office. This CVE ID is unique from CVE-2018-8158, CVE-2018-8161.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/104046; http://www.securitytracker.com/id/1040853; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8157
CVE: CVE-2018-8158
Published: 2018-05-09
Description: A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability." This affects Microsoft Office. This CVE ID is unique from CVE-2018-8157, CVE-2018-8161.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/104049; http://www.securitytracker.com/id/1040853; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8158
CVE: CVE-2018-8159
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104056; http://www.securitytracker.com/id/1040850; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8159
CVE: CVE-2018-8160
Published: 2018-05-09
Description: An information disclosure vulnerability exists in Outlook when a message is opened, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Word, Microsoft Office.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104051; http://www.securitytracker.com/id/1040852; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8160
CVE: CVE-2018-8161
Published: 2018-05-09
Description: A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability." This affects Microsoft Word, Word, Microsoft Office, Microsoft SharePoint. This CVE ID is unique from CVE-2018-8157, CVE-2018-8158.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/104052; http://www.securitytracker.com/id/1040853; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8161
CVE: CVE-2018-8162
Published: 2018-05-09
Description: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Excel. This CVE ID is unique from CVE-2018-8147, CVE-2018-8148.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/104058; http://www.securitytracker.com/id/1040857; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8162
CVE: CVE-2018-8163
Published: 2018-05-09
Description: An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Office, Microsoft Excel.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104059; http://www.securitytracker.com/id/1040857; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8163
CVE: CVE-2018-8164
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8120, CVE-2018-8124, CVE-2018-8166.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/104033; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8164; http://www.securityfocus.com/bid/104033
CVE: CVE-2018-8165
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/104038; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8165; http://www.securityfocus.com/bid/104038
CVE: CVE-2018-8166
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8120, CVE-2018-8124, CVE-2018-8164.
CVSS Score: 7.0 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/104062; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8166; http://www.securityfocus.com/bid/104062
CVE: CVE-2018-8167
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka "Windows Common Log File System Driver Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS Score: 7.0 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/104063; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8167; http://www.securityfocus.com/bid/104063
CVE: CVE-2018-8168
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint. This CVE ID is unique from CVE-2018-8149, CVE-2018-8155, CVE-2018-8156.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104067; http://www.securitytracker.com/id/1040856; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8168
CVE: CVE-2018-8170
Published: 2018-05-09
Description: An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory, aka "Windows Image Elevation of Privilege Vulnerability." This affects Windows 10, Windows 10 Servers.
CVSS Score: 7.0 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/104068; http://www.securitytracker.com/id/1040849; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8170
CVE: CVE-2018-8173
Published: 2018-05-09
Description: A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Microsoft InfoPath Remote Code Execution Vulnerability." This affects Microsoft Infopath.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/104069; http://www.securitytracker.com/id/1040855; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8173
CVE: CVE-2018-8174
Published: 2018-05-09
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/103998; https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174
CVE: CVE-2018-8177
Published: 2018-05-09
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-0943, CVE-2018-8130, CVE-2018-8133, CVE-2018-8145.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104090; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8177; http://www.securityfocus.com/bid/104090
CVE: CVE-2018-8178
Published: 2018-05-09
Description: A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104076; http://www.securitytracker.com/id/1040844; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8178
CVE: CVE-2018-8179
Published: 2018-05-09
Description: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104077; http://www.securitytracker.com/id/1040844; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8179
CVE: CVE-2018-8866
Published: 2018-05-09
Description: In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker on an adjacent network could perform command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/103966; https://ics-cert.us-cert.gov/advisories/ICSA-18-114-01; http://www.securityfocus.com/bid/103966
CVE: CVE-2017-14474
Published: 2018-05-09
Description: In the MMM::Agent::Helpers::_execute function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1, a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501
CVE: CVE-2017-14475
Published: 2018-05-09
Description: In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501
CVE: CVE-2017-14476
Published: 2018-05-09
Description: In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501
CVE: CVE-2017-14477
Published: 2018-05-09
Description: In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501
CVE: CVE-2017-14478
Published: 2018-05-09
Description: In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501
CVE: CVE-2017-14479
Published: 2018-05-09
Description: In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501
CVE: CVE-2017-14480
Published: 2018-05-09
Description: In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501
CVE: CVE-2017-14481
Published: 2018-05-09
Description: In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process. An attacker that can initiate a TCP session with mmm\_agentd can trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0501
CVE: CVE-2018-2415
Published: 2018-05-09
Description: SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-172
References: http://www.securityfocus.com/bid/104130; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/; https://launchpad.support.sap.com/#/notes/2550202
CVE: CVE-2018-2416
Published: 2018-05-09
Description: SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104106; http://www.securityfocus.com/bid/105076; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/
CVE: CVE-2018-2417
Published: 2018-05-09
Description: Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwise be restricted.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/104112; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/; https://launchpad.support.sap.com/#/notes/2601492
CVE: CVE-2018-2418
Published: 2018-05-09
Description: SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/104115; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/; https://launchpad.support.sap.com/#/notes/2610231
CVE: CVE-2018-2419
Published: 2018-05-09
Description: SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: http://www.securityfocus.com/bid/104116; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/; https://launchpad.support.sap.com/#/notes/2596627
CVE: CVE-2018-2420
Published: 2018-05-09
Description: SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without proper file format validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: http://www.securityfocus.com/bid/104108; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/; https://launchpad.support.sap.com/#/notes/2615635
CVE: CVE-2018-2421
Published: 2018-05-09
Description: SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/104111; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/; https://launchpad.support.sap.com/#/notes/2616599
CVE: CVE-2018-2422
Published: 2018-05-09
Description: SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/104110; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/; https://launchpad.support.sap.com/#/notes/2617553
CVE: CVE-2018-2423
Published: 2018-05-09
Description: SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/104109; https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/; https://launchpad.support.sap.com/#/notes/2620744
CVE: CVE-2018-6020
Published: 2018-05-09
Description: In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01; https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01
CVE: CVE-2018-6021
Published: 2018-05-09
Description: Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not properly sanitized, which may allow remote code execution.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78
References: https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01; https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01
CVE: CVE-2018-8860
Published: 2018-05-09
Description: In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker may be able to capture firmware updates through the adjacent network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103966; https://ics-cert.us-cert.gov/advisories/ICSA-18-114-01; http://www.securityfocus.com/bid/103966
CVE: CVE-2018-10949
Published: 2018-05-10
Description: mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.zimbra.com/show_bug.cgi?id=108962; https://bugzilla.zimbra.com/show_bug.cgi?id=108962
CVE: CVE-2018-10950
Published: 2018-05-10
Description: mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows Information Exposure through Verbose Error Messages containing a stack dump, tracing data, or full user-context dump.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.zimbra.com/show_bug.cgi?id=108963; https://bugzilla.zimbra.com/show_bug.cgi?id=108963
CVE: CVE-2018-10951
Published: 2018-05-10
Description: mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer, GetAllServers, or GetAllActiveServers call in the Admin SOAP API.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.zimbra.com/show_bug.cgi?id=108894; https://bugzilla.zimbra.com/show_bug.cgi?id=108894
CVE: CVE-2018-10952
Published: 2018-05-10
Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x00222088.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222088; https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x00222088