deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3954
Published: 2018-02-06
Description: web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.  NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/; https://usn.ubuntu.com/4030-1/; https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/
CVE: CVE-2016-3957
Published: 2018-02-06
Description: The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryption_key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/; https://github.com/web2py/web2py/blob/R-2.14.1/gluon/utils.py#L200; https://usn.ubuntu.com/4030-1/
CVE: CVE-2018-6758
Published: 2018-02-06
Description: The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html; https://github.com/unbit/uwsgi/commit/cb4636f7c0af2e97a4eef7a3cdcbd85a71247bfe; https://lists.debian.org/debian-lts-announce/2018/02/msg00010.html
CVE: CVE-2018-1299
Published: 2018-02-06
Description: In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, such as Nginx, Apache/mod_wsgi or paster may prevent the attack from succeeding. Others, such as gunicorn do not prevent it and leave Allura vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://allura.apache.org/posts/2018-allura-1.8.0.html; https://lists.apache.org/thread.html/b52069073cf3cb0f84c9e1e2b34d411fc163af39e4f3e50712ac8a4d%40%3Cdev.allura.apache.org%3E; https://allura.apache.org/posts/2018-allura-1.8.0.html
CVE: CVE-2018-4877
Published: 2018-02-06
Description: A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player's quality of service functionality. A successful attack can lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102930; https://access.redhat.com/errata/RHSA-2018:0285; https://helpx.adobe.com/security/products/flash-player/apsb18-03.html
CVE: CVE-2018-4878
Published: 2018-02-06
Description: A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html; http://www.securityfocus.com/bid/102893; http://www.securitytracker.com/id/1040318
CVE: CVE-2018-5457
Published: 2018-02-06
Description: A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior versions. A successful exploit of this vulnerability requires the local user to install a crafted DLL on the target machine. The application loads the DLL and gives the attacker access at the same privilege level as the application.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: http://www.securityfocus.com/bid/102983; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-01; http://www.securityfocus.com/bid/102983
CVE: CVE-2018-6759
Published: 2018-02-06
Description: The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; http://www.securityfocus.com/bid/103030
CVE: CVE-2018-6767
Published: 2018-02-06
Description: A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889276; https://github.com/dbry/WavPack/commit/d5bf76b5a88d044a1be1d5656698e3ba737167e5
CVE: CVE-2018-6768
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008090.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008090; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008090
CVE: CVE-2018-6769
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x99008020.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_99008020; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_99008020
CVE: CVE-2018-6770
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x99008210.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_99008210; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_99008210
CVE: CVE-2018-6771
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x99008224.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_99008224; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_99008224
CVE: CVE-2018-6772
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x99008208.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_99008208; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_99008208
CVE: CVE-2018-6773
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008084.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008084; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008084
CVE: CVE-2018-6774
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008088.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008088; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008088
CVE: CVE-2018-6775
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KrnlCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x990081C8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_990081C8; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KrnlCall_990081C8
CVE: CVE-2018-6776
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A00813C.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A00813C; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A00813C
CVE: CVE-2018-6777
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220400.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KVFG_220400; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KVFG_220400
CVE: CVE-2018-6778
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008268.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008268; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008268
CVE: CVE-2018-6779
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008240.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008240; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008240
CVE: CVE-2018-6780
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A0081E4.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A0081E4; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A0081E4
CVE: CVE-2018-6781
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008264.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008264; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008264
CVE: CVE-2018-6782
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A0081DC.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A0081DC; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A0081DC
CVE: CVE-2018-6783
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A00825C.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A00825C; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A00825C
CVE: CVE-2018-6784
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A00824C.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A00824C; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A00824C
CVE: CVE-2018-6785
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KSysCall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9A008254.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008254; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KSysCall_9A008254
CVE: CVE-2018-6786
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220840.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KVFG_220840; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KVFG_220840
CVE: CVE-2018-6787
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x221808.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KVFG_221808; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KVFG_221808
CVE: CVE-2018-6788
Published: 2018-02-06
Description: In Jiangmin Antivirus 16.0.0.100, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x2208C0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KVFG_2208C0; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Jiangmin_Antivirus_POC/tree/master/KVFG_2208C0
CVE: CVE-2018-6790
Published: 2018-02-07
Description: An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2019:2141; https://cgit.kde.org/plasma-workspace.git/commit/?id=5bc696b5abcdb460c1017592e80b2d7f6ed3107c; https://cgit.kde.org/plasma-workspace.git/commit/?id=8164beac15ea34ec0d1564f0557fe3e742bdd938
CVE: CVE-2018-6791
Published: 2018-02-07
Description: An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://bugs.kde.org/show_bug.cgi?id=389815; https://cgit.kde.org/plasma-workspace.git/commit/?id=9db872df82c258315c6ebad800af59e81ffb9212; https://www.debian.org/security/2018/dsa-4116
CVE: CVE-2018-6792
Published: 2018-02-07
Description: Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.3.1 allow an authenticated user to execute arbitrary SQL commands via multiple parameters to the /cvms-hub/privado/seccionesmib/secciones.xhtml resource. The POST parameters are j_idt118, j_idt120, j_idt122, j_idt124, j_idt126, j_idt128, and j_idt130 under formularioGestionarSecciones:tablaSeccionesMib:*:filter. The GET parameter is nombreAgente.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.tarlogic.com/advisories/Tarlogic-2018-001.txt; https://www.tarlogic.com/advisories/Tarlogic-2018-001.txt
CVE: CVE-2018-6603
Published: 2018-02-07
Description: Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHPSESSID cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-79
References: http://dfdrconsulting.com/cve-2018-6603-promise-technology-webpam-pro-e-http-response-header-injection-xss/; http://dfdrconsulting.com/cve-2018-6603-promise-technology-webpam-pro-e-http-response-header-injection-xss/
CVE: CVE-2018-6794
Published: 2018-02-07
Description: Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-693
References: https://github.com/OISF/suricata/pull/3202/commits/e1ef57c848bbe4e567d5d4b66d346a742e3f77a1; https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html; https://redmine.openinfosecfoundation.org/issues/2427
CVE: CVE-2018-6799
Published: 2018-02-07
Description: The AcquireCacheNexus function in magick/pixel_cache.c in GraphicsMagick before 1.3.28 allows remote attackers to cause a denial of service (heap overwrite) or possibly have unspecified other impact via a crafted image file, because a pixel staging area is not used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b41e2efce6d3; http://www.securityfocus.com/bid/102981; https://lists.debian.org/debian-lts-announce/2018/02/msg00017.html
CVE: CVE-2018-6806
Published: 2018-02-07
Description: Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL. The value of the text parameter can include arbitrary JavaScript code, e.g., making XMLHttpRequest calls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://support.markedapp.com/discussions/questions/9089-reporting-a-vulnerability; http://www.lynxsecurity.io/releases/Local%20File%20Disclosure%20in%20Marked2.pdf; http://support.markedapp.com/discussions/questions/9089-reporting-a-vulnerability
CVE: CVE-2017-17482
Published: 2018-02-07
Description: An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. A malformed DCL command table may result in a buffer overflow allowing a local privilege escalation when a non-privileged account enters a crafted command line. This bug is exploitable on VAX and Alpha and may cause a process crash on IA64. Software was affected regardless of whether it was directly shipped by VMS Software, Inc. (VSI), HPE, HP, Compaq, or Digital Equipment Corporation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openvms.org/node/121; https://groups.google.com/forum/#%21topic/comp.os.vms/BYIUQ0lJ-s0; https://www.theregister.co.uk/2018/02/06/openvms_vulnerability/
CVE: CVE-2018-6822
Published: 2018-02-07
Description: In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected XPC service that can be abused to execute system commands as root.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-002.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-002.md
CVE: CVE-2018-6823
Published: 2018-02-07
Description: In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service that can be abused to execute scripts as root.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-001.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-001.md
CVE: CVE-2016-2540
Published: 2018-02-07
Description: Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted FORMATCHUNK structure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://wiki.audacityteam.org/wiki/Release_Notes_2.1.2; https://fortiguard.com/zeroday/FG-VD-15-116; https://lists.debian.org/debian-lts-announce/2018/02/msg00012.html
CVE: CVE-2016-2541
Published: 2018-02-07
Description: Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP2 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://wiki.audacityteam.org/wiki/Release_Notes_2.1.2; https://fortiguard.com/zeroday/FG-VD-15-118; http://wiki.audacityteam.org/wiki/Release_Notes_2.1.2
CVE: CVE-2016-6168
Published: 2018-02-07
Description: Use-after-free vulnerability in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://fortiguard.com/zeroday/FG-VD-16-021; https://www.foxitsoftware.com/support/security-bulletins.php; https://fortiguard.com/zeroday/FG-VD-16-021
CVE: CVE-2016-6169
Published: 2018-02-07
Description: Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (memory corruption and application crash) or potentially execute arbitrary code via the Bezier data in a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://fortiguard.com/zeroday/FG-VD-16-018; https://www.foxitsoftware.com/support/security-bulletins.php; https://fortiguard.com/zeroday/FG-VD-16-018
CVE: CVE-2017-12412
Published: 2018-02-07
Description: ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted file, which triggers infinite recursion and a stack overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-835
References: https://github.com/cn-uofbasel/ccn-lite/issues/128; https://github.com/cn-uofbasel/ccn-lite/releases/tag/2.0.0; https://github.com/cn-uofbasel/ccn-lite/issues/128