deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10373
Published: 2018-04-25
Description: concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/104000; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3032
CVE: CVE-2018-10374
Published: 2018-04-25
Description: EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/teameasy/EasyCMS/issues/1; https://github.com/teameasy/EasyCMS/issues/1
CVE: CVE-2018-10375
Published: 2018-04-25
Description: A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/ky-j/dedecms/issues/1; https://github.com/ky-j/dedecms/issues/1
CVE: CVE-2018-10376
Published: 2018-04-25
Description: An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted _fee and _value parameters, as exploited in the wild in April 2018, aka the "proxyOverflow" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://dasp.co/#item-3; https://peckshield.com/2018/04/25/proxyOverflow/; https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/
CVE: CVE-2018-8801
Published: 2018-04-25
Description: GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md; https://gitlab.com/gitlab-org/gitlab-ce/issues/41642; https://hackerone.com/reports/301924
CVE: CVE-2018-1112
Published: 2018-04-25
Description: glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html; https://access.redhat.com/articles/3422521; https://access.redhat.com/errata/RHSA-2018:1268
CVE: CVE-2017-12712
Published: 2018-04-25
Description: The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3 base score: 7.5, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/100523; https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01; http://www.securityfocus.com/bid/100523
CVE: CVE-2017-12714
Published: 2018-04-25
Description: Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly formatted "RF wake-up" commands that can be received, which may allow a nearby attacker to repeatedly send commands to reduce pacemaker battery life. CVSS v3 base score: 5.3, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-920, CWE-920
References: http://www.securityfocus.com/bid/100523; https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01; http://www.securityfocus.com/bid/100523
CVE: CVE-2017-12716
Published: 2018-04-25
Description: Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311, CWE-319
References: http://www.securityfocus.com/bid/100523; https://ics-cert.us-cert.gov/advisories/ICSMA-17-241-01; http://www.securityfocus.com/bid/100523
CVE: CVE-2017-1750
Published: 2018-04-25
Description: IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 135523.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22015712; http://www.securityfocus.com/bid/104012; https://exchange.xforce.ibmcloud.com/vulnerabilities/135523
CVE: CVE-2017-7652
Published: 2018-04-25
Description: In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.
CVSS Score: 7.5 (HIGH)
CWE: CWE-789
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102; https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html; https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html
CVE: CVE-2018-1363
Published: 2018-04-25
Description: IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137448.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22015712; http://www.securityfocus.com/bid/104014; https://exchange.xforce.ibmcloud.com/vulnerabilities/137448
CVE: CVE-2014-5014
Published: 2018-04-25
Description: The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://wordpress.org/plugins/wordpress-flash-uploader/changelog/; https://wordpress.org/support/topic/vulnerability-discovered-2/; https://wordpress.org/plugins/wordpress-flash-uploader/changelog/
CVE: CVE-2018-10206
Published: 2018-04-25
Description: An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message field of a file request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10206; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10206/; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10206/
CVE: CVE-2018-10207
Published: 2018-04-25
Description: An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. An attacker can exploit Missing Authorization on the FlexPaperViewer SWF reader, and export files that should have been restricted, via vectors involving page-by-page access to a document in SWF format.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10207; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10207/; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10207/
CVE: CVE-2018-10208
Published: 2018-04-25
Description: An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10208; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10208/; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10208/
CVE: CVE-2018-10209
Published: 2018-04-25
Description: An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder download pop-up via a crafted file or folder name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10209; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10209/; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10209/
CVE: CVE-2018-10210
Published: 2018-04-25
Description: An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is possible through the password-reset feature.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10210; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10210/; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10210/
CVE: CVE-2018-10211
Published: 2018-04-25
Description: An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization when listing the history of another user via a modified "vaultize_session_id" value in a cookie.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10211; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10211/; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10211/
CVE: CVE-2018-10212
Published: 2018-04-25
Description: An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization leading to creation of folders within another account via a modified device value.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10212; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10212/; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10212/
CVE: CVE-2018-10213
Published: 2018-04-25
Description: An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a different user, who can modify the HTML in that mail before sending it.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10213; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10213/; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10213/
CVE: CVE-2014-0872
Published: 2018-04-25
Description: The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain sensitive information by leveraging root access. IBM X-Force ID: 90988.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-200, CWE-255
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/90988; https://www.ibm.com/blogs/psirt/ibm-security-bulletin-unencrypted-credentials-stored-on-ibm-security-key-lifecycle-manager-server-cve-2014-0872/; https://exchange.xforce.ibmcloud.com/vulnerabilities/90988
CVE: CVE-2014-0881
Published: 2018-04-25
Description: The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to obtain sensitive key information or cause a denial of service by leveraging an incorrect configuration. IBM X-Force ID: 91146.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://support.lenovo.com/us/en/solutions/ht114524; https://www.ibm.com/blogs/psirt/security-bulletin-tpm-on-the-integrated-management-module-ii-imm2-of-flex-system-x222-compute-node-is-not-configured-correctly-cve-2014-0881/; https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094725
CVE: CVE-2014-0882
Published: 2018-04-25
Description: Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authenticated users to obtain sensitive account information via vectors related to generated Service Advisor data (FFDC). IBM X-Force ID: 91149.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.lenovo.com/us/en/solutions/ht114525; https://www.ibm.com/blogs/psirt/security-bulletin-account-specific-information-likely-to-be-present-in-service-advisor-data-ffdc-on-the-integrated-management-module-ii-imm2-cve-2014-0882/; https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094726
CVE: CVE-2018-8716
Published: 2018-04-25
Description: WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/147330/WSO2-Identity-Server-5.3.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Apr/45; http://www.securityfocus.com/archive/1/541954/100/0/threaded
CVE: CVE-2018-9101
Published: 2018-04-25
Description: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the launch_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.mitel.com/mitel-product-security-advisory-18-0003; https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf; https://www.mitel.com/mitel-product-security-advisory-18-0003
CVE: CVE-2018-9102
Published: 2018-04-25
Description: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the signin interface. A successful exploit could allow an attacker to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.mitel.com/mitel-product-security-advisory-18-0003; https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf; https://www.mitel.com/mitel-product-security-advisory-18-0003
CVE: CVE-2018-9103
Published: 2018-04-25
Description: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.mitel.com/mitel-product-security-advisory-18-0003; https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf; https://www.mitel.com/mitel-product-security-advisory-18-0003
CVE: CVE-2018-9104
Published: 2018-04-25
Description: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the api.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.mitel.com/mitel-product-security-advisory-18-0003; https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf; https://www.mitel.com/mitel-product-security-advisory-18-0003
CVE: CVE-2017-6888
Published: 2018-04-25
Description: An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: https://git.xiph.org/?p=flac.git%3Ba=commit%3Bh=4f47b63e9c971e6391590caf00a0f2a5ed612e67; https://lists.debian.org/debian-lts-announce/2021/01/msg00001.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33W6XZAAEJYRGU3XYHRO7XSYEA7YACUB/
CVE: CVE-2018-1335
Published: 2018-04-25
Description: From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
CVSS Score: 8.1 (HIGH)
References: http://packetstormsecurity.com/files/153864/Apache-Tika-1.17-Header-Command-Injection.html; http://www.securityfocus.com/bid/104001; https://access.redhat.com/errata/RHSA-2019:3140
CVE: CVE-2018-1338
Published: 2018-04-25
Description: A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://access.redhat.com/errata/RHSA-2018:2669; https://lists.apache.org/thread.html/4d20c5748fb9f836653bc78a1bad991ba8485d82a1e821f70b641932%40%3Cdev.tika.apache.org%3E; https://access.redhat.com/errata/RHSA-2018:2669
CVE: CVE-2018-1339
Published: 2018-04-25
Description: A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://access.redhat.com/errata/RHSA-2018:2669; https://lists.apache.org/thread.html/4d2cb5c819401bb075e2a1130e0d14f0404a136541a6f91da0225828%40%3Cdev.tika.apache.org%3E; https://access.redhat.com/errata/RHSA-2018:2669
CVE: CVE-2018-5226
Published: 2018-04-25
Description: There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. All versions of Sourcetree for Windows before 2.5.5.0 are affected by this vulnerability.
CVSS Score: 8.8 (HIGH)
References: https://jira.atlassian.com/browse/SRCTREEWIN-8509; https://jira.atlassian.com/browse/SRCTREEWIN-8509
CVE: CVE-2018-5486
Published: 2018-04-25
Description: NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-8833
Published: 2018-04-25
Description: Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.securityfocus.com/bid/103972; https://ics-cert.us-cert.gov/advisories/ICSA-18-114-03; http://www.securityfocus.com/bid/103972
CVE: CVE-2018-8835
Published: 2018-04-25
Description: Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: http://www.securityfocus.com/bid/103972; https://ics-cert.us-cert.gov/advisories/ICSA-18-114-03; http://www.securityfocus.com/bid/103972
CVE: CVE-2018-8837
Published: 2018-04-25
Description: Processing specially crafted .pm3 files in Advantech WebAccess HMI Designer 2.1.7.32 and prior may cause the system to write outside the intended buffer area and may allow remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/103972; https://ics-cert.us-cert.gov/advisories/ICSA-18-114-03; http://www.securityfocus.com/bid/103972
CVE: CVE-2018-10381
Published: 2018-04-26
Description: TunnelBear 3.2.0.6 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "TunnelBearMaintenance" service. This service establishes a NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "OpenVPNConnect" method accepts a server list argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-022.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-022.md
CVE: CVE-2018-10391
Published: 2018-04-26
Description: An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/134; https://github.com/wuzhicms/wuzhicms/issues/134
CVE: CVE-2018-10392
Published: 2018-04-26
Description: mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://access.redhat.com/errata/RHSA-2019:3703; https://gitlab.xiph.org/xiph/vorbis/issues/2335; https://lists.debian.org/debian-lts-announce/2019/11/msg00031.html
CVE: CVE-2018-10393
Published: 2018-04-26
Description: bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:3703; https://gitlab.xiph.org/xiph/vorbis/issues/2334; https://lists.debian.org/debian-lts-announce/2019/11/msg00031.html
CVE: CVE-2018-10422
Published: 2018-04-26
Description: An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Neeke/HongCMS/issues/2; https://github.com/Neeke/HongCMS/issues/2
CVE: CVE-2018-10423
Published: 2018-04-26
Description: mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: https://github.com/bg5sbk/MiniCMS/issues/18; https://github.com/bg5sbk/MiniCMS/issues/18
CVE: CVE-2018-10424
Published: 2018-04-26
Description: mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: https://github.com/bg5sbk/MiniCMS/issues/18; https://github.com/bg5sbk/MiniCMS/issues/18
CVE: CVE-2018-8974
Published: 2018-04-26
Description: Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial 'Source<script type="text/javascript" src=' line. Fix released on 2018-03-28.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://github.com/CDCgov/MicrobeTRACE/releases/tag/v0.1.11; https://github.com/CDCgov/MicrobeTrace/commit/3142b76c082bd83e1506c9840fbe0b6da382e682; https://github.com/wshepherd0010/advisories/blob/master/CVE-2018-8974.md