deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-17101
Published: 2018-09-16
Description: An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2807; http://www.securityfocus.com/bid/105370; https://access.redhat.com/errata/RHSA-2019:2053
CVE: CVE-2018-17102
Published: 2018-09-16
Description: An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/quickapps/cms/issues/187; https://github.com/quickapps/cms/issues/199; https://github.com/quickapps/cms/issues/187
CVE: CVE-2018-17103
Published: 2018-09-16
Description: An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1295; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1295
CVE: CVE-2018-17104
Published: 2018-09-16
Description: An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/microweber/microweber/commit/982ea9d5efb7d2306a05644ebc3469dadb33767e; https://github.com/microweber/microweber/issues/483; https://github.com/microweber/microweber/issues/484
CVE: CVE-2018-17106
Published: 2018-09-16
Description: In Tinyftp Tinyftpd 1.1, a buffer overflow exists in the text variable of the do_mkd function in the ftpproto.c file. An attacker can overwrite ebp via a long pathname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/vbirds/Tinyftp/issues/4; https://github.com/vbirds/Tinyftp/issues/4
CVE: CVE-2018-17108
Published: 2018-09-16
Description: The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow attackers to perform Account Takeover attacks by intercepting a security-question response during the initial configuration of the application.
CVSS Score: 8.8 (HIGH)
References: https://github.com/magicj3lly/appexploits/blob/master/SBI_Buddy_AuthenticationBypass.pdf; https://github.com/magicj3lly/appexploits/blob/master/SBI_Buddy_AuthenticationBypass.pdf
CVE: CVE-2018-16309
Published: 2018-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-17110
Published: 2018-09-17
Description: Simple POS 4.0.24 allows SQL Injection via a products/get_products/ columns[0][search][value] parameter in the management panel, as demonstrated by products/get_products/1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/45328/; https://www.exploit-db.com/exploits/45328/
CVE: CVE-2018-17113
Published: 2018-09-17
Description: App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/teameasy/EasyCMS/issues/7; https://github.com/teameasy/EasyCMS/issues/7
CVE: CVE-2018-17125
Published: 2018-09-17
Description: CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/AvaterXXX/CScms/blob/master/CScms_dirdel.md; https://www.patec.cn/newsshow.php?cid=24&id=125; https://github.com/AvaterXXX/CScms/blob/master/CScms_dirdel.md
CVE: CVE-2018-17126
Published: 2018-09-17
Description: CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/AvaterXXX/CScms/blob/master/CScms_xss.md#cscms_getshell; https://www.patec.cn/newsshow.php?cid=24&id=125; https://github.com/AvaterXXX/CScms/blob/master/CScms_xss.md#cscms_getshell
CVE: CVE-2018-17127
Published: 2018-09-17
Description: blocking_request.cgi on ASUS GT-AC5300 devices through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (NULL pointer dereference and device crash) via a request that lacks a timestap parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/PAGalaxyLab/VulInfo/tree/master/ASUS/GT-AC5300/dos1; https://github.com/PAGalaxyLab/VulInfo/tree/master/ASUS/GT-AC5300/dos1
CVE: CVE-2018-17128
Published: 2018-09-17
Description: A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/; https://www.exploit-db.com/exploits/45449/; https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/
CVE: CVE-2018-17129
Published: 2018-09-17
Description: MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/panghusec/exploit/issues/2; https://github.com/panghusec/exploit/issues/2
CVE: CVE-2018-17130
Published: 2018-09-17
Description: PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/panghusec/exploit/issues/3; https://github.com/panghusec/exploit/issues/3
CVE: CVE-2018-17131
Published: 2018-09-17
Description: admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/panghusec/exploit/issues/5; https://github.com/panghusec/exploit/issues/5
CVE: CVE-2018-17132
Published: 2018-09-17
Description: admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/panghusec/exploit/issues/4; https://github.com/panghusec/exploit/issues/4
CVE: CVE-2018-17133
Published: 2018-09-17
Description: admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/panghusec/exploit/issues/6; https://github.com/panghusec/exploit/issues/6
CVE: CVE-2018-17134
Published: 2018-09-17
Description: admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/panghusec/exploit/issues/7; https://github.com/panghusec/exploit/issues/7
CVE: CVE-2018-17136
Published: 2018-09-17
Description: zzcms 8.3 contains a SQL Injection vulnerability in /user/check.php via a Client-Ip HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/TEag1e/zzcms; https://github.com/TEag1e/zzcms
CVE: CVE-2018-17137
Published: 2018-09-17
Description: Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SE_DEBUG_PRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/GitHubAssessments/CVE_Assessment_04_2018; https://github.com/GitHubAssessments/CVE_Assessment_04_2018
CVE: CVE-2018-17138
Published: 2018-09-17
Description: The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/45305/; https://www.exploit-db.com/exploits/45305/
CVE: CVE-2018-17139
Published: 2018-09-17
Description: UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/45253/; https://www.exploit-db.com/exploits/45253/
CVE: CVE-2018-17140
Published: 2018-09-17
Description: The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/45307/; https://www.exploit-db.com/exploits/45307/
CVE: CVE-2017-15705
Published: 2018-09-17
Description: A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html; http://www.securityfocus.com/bid/105347; https://access.redhat.com/errata/RHSA-2018:2916
CVE: CVE-2018-11780
Published: 2018-09-17
Description: A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html; http://www.securityfocus.com/bid/105373; https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E
CVE: CVE-2018-11781
Published: 2018-09-17
Description: Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html; https://access.redhat.com/errata/RHSA-2018:2916; https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E
CVE: CVE-2018-17142
Published: 2018-09-17
Description: The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/golang/go/issues/27702; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
CVE: CVE-2018-17143
Published: 2018-09-17
Description: The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/golang/go/issues/27704; https://go-review.googlesource.com/c/net/+/136575; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/
CVE: CVE-2018-8041
Published: 2018-09-17
Description: Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://camel.apache.org/security-advisories.data/CVE-2018-8041.txt.asc?version=1&modificationDate=[PII_REDACTED]00&api=v2; http://www.securityfocus.com/bid/105352; https://access.redhat.com/errata/RHSA-2018:3768
CVE: CVE-2016-9045
Published: 2018-09-17
Description: A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0314; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0314
CVE: CVE-2018-11086
Published: 2018-09-17
Description: Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.
CVSS Score: 8.8 (HIGH)
References: https://pivotal.io/security/cve-2018-11086; https://pivotal.io/security/cve-2018-11086
CVE: CVE-2018-11088
Published: 2018-09-17
Description: Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.
CVSS Score: 8.8 (HIGH)
References: https://pivotal.io/security/cve-2018-11088; https://pivotal.io/security/cve-2018-11088
CVE: CVE-2018-1198
Published: 2018-09-17
Description: Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs could escalate their privileges using this password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532
References: https://pivotal.io/security/cve-2018-1198; https://pivotal.io/security/cve-2018-1198
CVE: CVE-2018-1223
Published: 2018-09-17
Description: Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the ability to read the application logs could use these credentials to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532
References: https://www.cloudfoundry.org/blog/cve-2018-1223/; https://www.cloudfoundry.org/blog/cve-2018-1223/
CVE: CVE-2017-14443
Published: 2018-09-17
Description: An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number of GET parameters supplied, leading to an arbitrarily controlled information leak on the whole device memory. An attacker can send an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0492; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0492
CVE: CVE-2017-2777
Published: 2018-09-17
Description: An exploitable heap overflow vulnerability exists in the ipStringCreate function of Iceni Argus Version 6.6.05. A specially crafted pdf file can cause an integer overflow resulting in heap overflow. An attacker can send file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0271; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0271
CVE: CVE-2017-2874
Published: 2018-09-17
Description: An information disclosure vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10001 can allow for a user to retrieve sensitive information without authentication.
CVSS Score: 7.5 (HIGH)
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0381; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0381
CVE: CVE-2018-14320
Published: 2018-09-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within PdfEncoding::ParseToUnicode. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5673.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://zerodayinitiative.com/advisories/ZDI-18-1046; https://zerodayinitiative.com/advisories/ZDI-18-1046
CVE: CVE-2018-14630
Published: 2018-09-17
Description: moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-94
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880; http://www.securityfocus.com/bid/105354; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630
CVE: CVE-2017-2854
Published: 2018-09-17
Description: An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HTTP server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0357; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0357
CVE: CVE-2017-2856
Published: 2018-09-17
Description: An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HTTP server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0359; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0359
CVE: CVE-2017-2857
Published: 2018-09-17
Description: An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HTTP server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0360; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0360
CVE: CVE-2017-2872
Published: 2018-09-17
Description: Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A HTTP request can allow for a user to perform a firmware upgrade using a crafted image. Before any firmware upgrades in this image are flashed to the device, binaries as well as arguments to shell commands contained in the image are executed with elevated privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0379; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0379
CVE: CVE-2018-14631
Published: 2018-09-17
Description: moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857; http://www.securityfocus.com/bid/105371; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631
CVE: CVE-2018-16952
Published: 2018-09-18
Description: The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal user's password). NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/105350; https://seclists.org/fulldisclosure/2018/Sep/22; http://www.securityfocus.com/bid/105350
CVE: CVE-2018-16953
Published: 2018-09-18
Description: The AjaxView::DisplayResponse() function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105350; https://seclists.org/fulldisclosure/2018/Sep/22; http://www.securityfocus.com/bid/105350
CVE: CVE-2018-16954
Published: 2018-09-18
Description: An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The login function of the portal is vulnerable to insecure redirection (also called an open redirect). The in_hi_redirect parameter is not validated by the application after a successful login. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/105350; https://seclists.org/fulldisclosure/2018/Sep/22; http://www.securityfocus.com/bid/105350
CVE: CVE-2018-16955
Published: 2018-09-18
Description: The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). The content of the in_hi_redirect parameter, when prefixed with the https:// scheme, is unsafely reflected in a HTML META tag in the HTTP response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105350; https://seclists.org/fulldisclosure/2018/Sep/22; http://www.securityfocus.com/bid/105350
CVE: CVE-2018-16956
Published: 2018-09-18
Description: The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be renamed to include characters unsupported for URIs by the web server hosting the WCI Portal software (such as IIS). Renaming pages to include unsupported characters, such as 0x7f, prevents these pages from being accessed over the web server, causing a Denial of Service (DoS) to the page. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105350; https://seclists.org/fulldisclosure/2018/Sep/22; http://www.securityfocus.com/bid/105350