deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-9488
Published: 2018-11-06
Description: In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, with System privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android-9.0 Android ID: A-110107376.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://source.android.com/security/bulletin/2018-09-01; https://www.exploit-db.com/exploits/45379/; https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9489
Published: 2018-11-06
Description: When wifi is switched, function sendNetworkStateChangeBroadcast of WifiStateMachine.java broadcasts an intent including detailed wifi network information. This could lead to information disclosure with no execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-77286245.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securitytracker.com/id/1041590; https://wwws.nightwatchcybersecurity.com/2018/08/29/sensitive-data-exposure-via-wifi-broadcasts-in-android-os-cve-2018-9489/; http://www.securitytracker.com/id/1041590
CVE: CVE-2018-9516
Published: 2018-11-06
Description: In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-71361580.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2019:2029; https://access.redhat.com/errata/RHSA-2019:2043; https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
CVE: CVE-2018-16472
Published: 2018-11-06
Description: A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://hackerone.com/reports/390847; https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html; https://hackerone.com/reports/390847
CVE: CVE-2018-16473
Published: 2018-11-06
Description: A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/403736; https://hackerone.com/reports/403736
CVE: CVE-2018-16474
Published: 2018-11-06
Description: A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/403692; https://hackerone.com/reports/403692
CVE: CVE-2018-16475
Published: 2018-11-06
Description: A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/403707; https://hackerone.com/reports/403707
CVE: CVE-2018-17184
Published: 2018-11-06
Description: A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://syncope.apache.org/security#CVE-2018-17184:_Stored_XSS; https://syncope.apache.org/security#CVE-2018-17184:_Stored_XSS
CVE: CVE-2018-17186
Published: 2018-11-06
Description: An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611
References: https://syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitions; https://syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitions
CVE: CVE-2018-14667
Published: 2018-11-06
Description: The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html; http://seclists.org/fulldisclosure/2020/Mar/21; http://www.securitytracker.com/id/1042037
CVE: CVE-2018-12411
Published: 2018-11-06
Description: The administrative daemon (tibdgadmind) of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: 3.3.0; 3.4.0; 3.5.0, TIBCO ActiveSpaces - Developer Edition: 3.0.0; 3.1.0; 3.3.0; 3.4.0; 3.5.0, and TIBCO ActiveSpaces - Enterprise Edition: 3.0.0; 3.1.0; 3.2.0; 3.3.0; 3.4.0; 3.5.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/105869; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-activespaces
CVE: CVE-2018-12412
Published: 2018-11-06
Description: The realm server (tibrealmserver) component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO FTL - Community Edition: versions up to and including 5.4.0, TIBCO FTL - Developer Edition: versions up to and including 5.4.0, TIBCO FTL - Enterprise Edition: versions up to and including 5.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/105861; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-ftl
CVE: CVE-2018-12413
Published: 2018-11-06
Description: The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition: 1.0.0, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition: 1.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/105874; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-messaging-apache-kafka-distribution-schema-repository
CVE: CVE-2018-12414
Published: 2018-11-06
Description: The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.'s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/105871; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous
CVE: CVE-2018-12415
Published: 2018-11-06
Description: The Central Administration server (emsca) component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Message Service: versions 8.4.0 and below, TIBCO Enterprise Message Service - Community Edition: versions 8.4.0 and below, and TIBCO Enterprise Message Service - Developer Edition: versions 8.4.0 and below.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/105850; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-enterprise-messaging-service
CVE: CVE-2018-19050
Published: 2018-11-07
Description: MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/m3lon/XSS-Expoit/blob/master/METINFO_XSS.md; https://github.com/m3lon/XSS-Expoit/blob/master/METINFO_XSS.md
CVE: CVE-2018-19051
Published: 2018-11-07
Description: MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/m3lon/XSS-Expoit/blob/master/METINFO_XSS.md; https://github.com/m3lon/XSS-Expoit/blob/master/METINFO_XSS.md
CVE: CVE-2018-19047
Published: 2018-11-07
Description: mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HTML without sanitising it, you're asking for trouble.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://github.com/mpdf/mpdf/issues/867; https://github.com/mpdf/mpdf/issues/867
CVE: CVE-2018-19052
Published: 2018-11-07
Description: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.html; https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1; https://lists.debian.org/debian-lts-announce/2022/01/msg00012.html
CVE: CVE-2018-19053
Published: 2018-11-07
Description: PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statement, followed by a SELECT statement containing this PHP code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/Pbootcms/Pbootcms/issues/2; https://github.com/Pbootcms/Pbootcms/issues/2
CVE: CVE-2018-16843
Published: 2018-11-07
Description: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html; http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html; http://seclists.org/fulldisclosure/2021/Sep/36
CVE: CVE-2018-16844
Published: 2018-11-07
Description: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html; http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html; http://seclists.org/fulldisclosure/2021/Sep/36
CVE: CVE-2018-16845
Published: 2018-11-07
Description: nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-400, CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html; http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html; http://seclists.org/fulldisclosure/2021/Sep/36
CVE: CVE-2018-8021
Published: 2018-11-07
Description: Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/apache/incubator-superset/pull/4243; https://www.exploit-db.com/exploits/45933/; https://github.com/apache/incubator-superset/pull/4243
CVE: CVE-2018-19056
Published: 2018-11-07
Description: pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pandao/editor.md/issues/634; https://github.com/pandao/editor.md/issues/634
CVE: CVE-2018-19057
Published: 2018-11-07
Description: SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sparksuite/simplemde-markdown-editor/issues/721; https://github.com/sparksuite/simplemde-markdown-editor/issues/721
CVE: CVE-2018-18590
Published: 2018-11-07
Description: A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.02, 2018.05, 2018.08. This vulnerability could allow for information disclosure.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-200
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416
CVE: CVE-2018-19058
Published: 2018-11-07
Description: An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-670
References: https://access.redhat.com/errata/RHSA-2019:2022; https://gitlab.freedesktop.org/poppler/poppler/issues/659; https://lists.debian.org/debian-lts-announce/2019/03/msg00008.html
CVE: CVE-2018-19059
Published: 2018-11-07
Description: An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:2022; https://gitlab.freedesktop.org/poppler/poppler/issues/661; https://usn.ubuntu.com/3837-1/
CVE: CVE-2018-19060
Published: 2018-11-07
Description: An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2019:2022; https://gitlab.freedesktop.org/poppler/poppler/issues/660; https://usn.ubuntu.com/3837-1/
CVE: CVE-2018-19061
Published: 2018-11-07
Description: DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/moonf1sh/moonf1sh.github.io/blob/master/2018/10/30/DedeCMS-V57-SQL%E6%B3%A8%E5%85%A5/index.html; https://moonf1sh.github.io/2018/10/30/DedeCMS-V57-SQL%E6%B3%A8%E5%85%A5/; https://github.com/moonf1sh/moonf1sh.github.io/blob/master/2018/10/30/DedeCMS-V57-SQL%E6%B3%A8%E5%85%A5/index.html
CVE: CVE-2018-19063
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The admin account has a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19064
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ftpuser1 account has a blank password, which cannot be changed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19065
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded BpP+2R9*Q password in some cases.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19066
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded Pxift* password in some cases.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19067
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. There is a hardcoded Ak47@99 password for the factory~ account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19068
Published: 2018-11-07
Description: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for hidden factory credentials.
CVSS Score: 4.9 (MEDIUM)
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19069
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for the root user with a password of toor.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19070
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow remote attackers to execute arbitrary OS commands via shell metacharacters in the usrName parameter of a CGIProxy.fcgi addAccount action.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19071
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/boot.sh has 0777 permissions, allowing local users to control the commands executed at system start-up.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19072
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/app has 0777 permissions, allowing local users to replace an archive file (within that directory) to control what is extracted to RAM at boot time.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19073
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow attackers to execute arbitrary OS commands via shell metacharacters in the modelName, by leveraging /mnt/mtd/app/config/ProductConfig.xml write access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE: CVE-2018-19074
Published: 2018-11-07
Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The firewall has no effect except for blocking port 443 and partially blocking port 88.
CVSS Score: 7.5 (HIGH)
References: https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt; https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt