deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-6127
Published: 2019-01-09
Description: Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6133
Published: 2019-01-09
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-19
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6135
Published: 2019-01-09
Description: Lack of clearing the previous site before loading alerts from a new one in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6137
Published: 2019-01-09
Description: CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6139
Published: 2019-01-09
Description: Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6140
Published: 2019-01-09
Description: Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6141
Published: 2019-01-09
Description: Insufficient validation of an image filter in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6143
Published: 2019-01-09
Description: Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6144
Published: 2019-01-09
Description: Off-by-one error in PDFium in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6147
Published: 2019-01-09
Description: Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104309; http://www.securitytracker.com/id/1041014; https://access.redhat.com/errata/RHSA-2018:1815
CVE: CVE-2018-6151
Published: 2019-01-09
Description: Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html
CVE: CVE-2018-6153
Published: 2019-01-09
Description: A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6158
Published: 2019-01-09
Description: A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6160
Published: 2019-01-09
Description: JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104887; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html; https://crbug.com/839822
CVE: CVE-2018-6162
Published: 2019-01-09
Description: Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-787
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6163
Published: 2019-01-09
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6164
Published: 2019-01-09
Description: Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6165
Published: 2019-01-09
Description: Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6166
Published: 2019-01-09
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6167
Published: 2019-01-09
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6169
Published: 2019-01-09
Description: Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6170
Published: 2019-01-09
Description: A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704, CWE-787
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6172
Published: 2019-01-09
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6173
Published: 2019-01-09
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6174
Published: 2019-01-09
Description: Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6175
Published: 2019-01-09
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6178
Published: 2019-01-09
Description: Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2018-6179
Published: 2019-01-09
Description: Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104887; https://access.redhat.com/errata/RHSA-2018:2282; https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
CVE: CVE-2016-10736
Published: 2019-01-09
Description: The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://advisories.dxw.com/advisories/reflected-xss-in-social-pug-easy-social-share-buttons-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/; https://advisories.dxw.com/advisories/reflected-xss-in-social-pug-easy-social-share-buttons-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/
CVE: CVE-2018-0625
Published: 2019-01-09
Description: Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN00401783/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0626
Published: 2019-01-09
Description: Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN00401783/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0627
Published: 2019-01-09
Description: Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN00401783/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0628
Published: 2019-01-09
Description: Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN00401783/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0629
Published: 2019-01-09
Description: Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN26629618/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0630
Published: 2019-01-09
Description: Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN26629618/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0631
Published: 2019-01-09
Description: Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN26629618/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0632
Published: 2019-01-09
Description: Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN26629618/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0633
Published: 2019-01-09
Description: Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN26629618/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0634
Published: 2019-01-09
Description: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN84825660/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0635
Published: 2019-01-09
Description: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN84825660/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0636
Published: 2019-01-09
Description: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN84825660/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0637
Published: 2019-01-09
Description: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN84825660/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0638
Published: 2019-01-09
Description: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN84825660/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0639
Published: 2019-01-09
Description: Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time parameter, and offset parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN84825660/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0640
Published: 2019-01-09
Description: Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, time parameter, and offset parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN84825660/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0641
Published: 2019-01-09
Description: Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter, time parameter, and offset parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: https://jpn.nec.com/security-info/secinfo/nv18-011.html; https://jvn.jp/en/jp/JVN84825660/index.html; https://jpn.nec.com/security-info/secinfo/nv18-011.html
CVE: CVE-2018-0651
Published: 2019-01-09
Description: Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and earlier, STARDOM FCN/FCJ Simulator R4.20 and earlier, ASTPLANNER R15.01 and earlier, TriFellows V5.04 and earlier) allows remote attackers to stop the license management function or execute an arbitrary program via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105124; https://jvn.jp/vu/JVNVU93845358/; https://web-material3.yokogawa.com/YSAR-18-0006-E.pdf
CVE: CVE-2018-0665
Published: 2019-01-09
Description: Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0666.
CVSS Score: 6.8 (MEDIUM)
References: http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN69967692.html; https://flets-w.com/solution/kiki_info/info/180829.html; https://jvn.jp/en/jp/JVN69967692/index.html
CVE: CVE-2018-0666
Published: 2019-01-09
Description: Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0665.
CVSS Score: 6.8 (MEDIUM)
References: http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN69967692.html; https://flets-w.com/solution/kiki_info/info/180829.html; https://jvn.jp/en/jp/JVN69967692/index.html
CVE: CVE-2018-0667
Published: 2019-01-09
Description: Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.mnc.co.jp/INplc/info_20180907_E.htm; https://jvn.jp/en/jp/JVN59624986/index.html; http://www.mnc.co.jp/INplc/info_20180907_E.htm
CVE: CVE-2018-0668
Published: 2019-01-09
Description: Buffer overflow in INplc-RT 3.08 and earlier allows remote attackers to cause denial-of-service (DoS) condition that may result in executing arbtrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.mnc.co.jp/INplc/info_20180907_E.htm; https://jvn.jp/en/jp/JVN59624986/index.html; http://www.mnc.co.jp/INplc/info_20180907_E.htm
CVE: CVE-2018-0669
Published: 2019-01-09
Description: INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0670.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.mnc.co.jp/INplc/info_20180907_E.htm; https://jvn.jp/en/jp/JVN59624986/index.html; http://www.mnc.co.jp/INplc/info_20180907_E.htm
CVE: CVE-2018-0670
Published: 2019-01-09
Description: INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0669.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.mnc.co.jp/INplc/info_20180907_E.htm; https://jvn.jp/en/jp/JVN59624986/index.html; http://www.mnc.co.jp/INplc/info_20180907_E.htm