deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-6626
Published: 2018-02-05
Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000035.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000035; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000035
CVE: CVE-2018-6627
Published: 2018-02-05
Description: In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/WatchDog_AntiMalware_POC/tree/master/0x80002054; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/WatchDog_AntiMalware_POC/tree/master/0x80002054
CVE: CVE-2018-6628
Published: 2018-02-05
Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8000010c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/8000010c; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/8000010c
CVE: CVE-2018-6629
Published: 2018-02-05
Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000118.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000118; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000118
CVE: CVE-2018-6630
Published: 2018-02-05
Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8000014c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/8000014c; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/8000014c
CVE: CVE-2018-6631
Published: 2018-02-05
Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110009.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000170.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110009/0x80000170; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110009/0x80000170
CVE: CVE-2018-6632
Published: 2018-02-05
Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000110.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000110; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000110
CVE: CVE-2018-6633
Published: 2018-02-05
Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000038.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000038; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000038
CVE: CVE-2018-6635
Published: 2018-02-05
Description: System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.securityfocus.com/bid/102940; http://www.securitytracker.com/id/1040329; https://downloads.avaya.com/css/P8/documents/101038598
CVE: CVE-2018-6582
Published: 2018-02-05
Description: SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43976/; https://www.exploit-db.com/exploits/43976/
CVE: CVE-2018-6604
Published: 2018-02-05
Description: SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetails request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43975/; https://www.exploit-db.com/exploits/43975/
CVE: CVE-2018-6605
Published: 2018-02-05
Description: SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43974/; https://www.exploit-db.com/exploits/43974/
CVE: CVE-2018-6609
Published: 2018-02-05
Description: SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit action, or the id parameter in a statuslist (or prioritylist) edit action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43978; https://www.exploit-db.com/exploits/43978
CVE: CVE-2018-6610
Published: 2018-02-05
Description: Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.exploit-db.com/exploits/43977; https://www.exploit-db.com/exploits/43977
CVE: CVE-2018-6651
Published: 2018-02-05
Description: In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation (accepting an arbitrary substring match) for WebSocket API requests allows remote attackers to bypass intended access restrictions. In Parsec, this means full control over the victim's computer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/Zenexer/ac7601c0e367d876353137e5099b18a7; https://github.com/chrisd1100/uncurl/commit/448cd13e7b18c83855d706c564341ddd1e38e769; https://github.com/chrisd1100/uncurl/releases/tag/0.07
CVE: CVE-2018-6569
Published: 2018-02-06
Description: West Wind Web Server 6.x does not require authentication for /ADMIN.ASP.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://dfdrconsulting.com/cve-2018-6569-west-wind-web-server-unauthenticated-admin-access-process-execution-termination/; http://dfdrconsulting.com/cve-2018-6569-west-wind-web-server-unauthenticated-admin-access-process-execution-termination/
CVE: CVE-2018-6654
Published: 2018-02-06
Description: The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr_-ifr, because the exposure of these tokens is not restricted to any specific web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1527; https://bugs.chromium.org/p/project-zero/issues/detail?id=1527
CVE: CVE-2017-6169
Published: 2018-02-06
Description: In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature may cause the Traffic Management Microkernel (TMM) to produce a core file when it receives malformed URLs during categorization.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1040332; https://support.f5.com/csp/article/K31404801; http://www.securitytracker.com/id/1040332
CVE: CVE-2017-6258
Published: 2018-02-06
Description: NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds write and could lead to local code execution in a privileged process. This issue is rated as high. Product: Android. Version: N/A. Android: A-38027496. Reference: N-CVE-2017-6258.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-02-01; https://source.android.com/security/bulletin/2018-02-01
CVE: CVE-2017-6279
Published: 2018-02-06
Description: NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds write and could lead to local code execution in a privileged process. This issue is rated as high. Product: Android. Version: N/A. Android: A-65023166. Reference: N-CVE-2017-6279.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-02-01; https://source.android.com/security/bulletin/2018-02-01
CVE: CVE-2013-4317
Published: 2018-02-06
Description: In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/oss-sec/2018/q1/1; http://seclists.org/oss-sec/2018/q1/1
CVE: CVE-2016-6813
Published: 2018-02-06
Description: Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.
CVSS Score: 9.8 (CRITICAL)
References: http://mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOYQoNY2BNx86_zauses_MpmpiX8WciO_DEaWp6uNig%40mail.gmail.com%3E; http://www.securityfocus.com/bid/93945; https://s.apache.org/qV5l
CVE: CVE-2018-6466
Published: 2018-02-06
Description: A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_set parameter to wp-admin/options-general.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AntsKnows/CVE/blob/master/WP_Plugin_Flickr-rss; https://github.com/AntsKnows/CVE/blob/master/WP_Plugin_Flickr-rss
CVE: CVE-2018-6467
Published: 2018-02-06
Description: The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/AntsKnows/CVE/blob/master/WP_Plugin_Flickr-rss; https://github.com/AntsKnows/CVE/blob/master/WP_Plugin_Flickr-rss
CVE: CVE-2018-6468
Published: 2018-02-06
Description: A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_id parameter to wp-admin/options-general.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AntsKnows/CVE/blob/master/WP_Plugin_Flickr-rss; https://github.com/AntsKnows/CVE/blob/master/WP_Plugin_Flickr-rss
CVE: CVE-2018-6469
Published: 2018-02-06
Description: A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSS_tags parameter to wp-admin/options-general.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AntsKnows/CVE/blob/master/WP_Plugin_Flickr-rss; https://github.com/AntsKnows/CVE/blob/master/WP_Plugin_Flickr-rss
CVE: CVE-2018-6656
Published: 2018-02-06
Description: Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/zblogcn/zblogphp/commit/c51da34a27798b5fe6d1cb5133a15da6a6384e43; https://github.com/zblogcn/zblogphp/issues/175; https://github.com/zblogcn/zblogphp/commit/c51da34a27798b5fe6d1cb5133a15da6a6384e43
CVE: CVE-2017-15095
Published: 2018-02-06
Description: A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184, CWE-502
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2017-7525
Published: 2018-02-06
Description: A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184, CWE-502
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2018-6288
Published: 2018-02-06
Description: Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://support.kaspersky.com/vulnerability.aspx?el=12430#010218; https://www.coresecurity.com/advisories/kaspersky-secure-mail-gateway-multiple-vulnerabilities; https://support.kaspersky.com/vulnerability.aspx?el=12430#010218
CVE: CVE-2018-6289
Published: 2018-02-06
Description: Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://support.kaspersky.com/vulnerability.aspx?el=12430#010218; https://www.coresecurity.com/advisories/kaspersky-secure-mail-gateway-multiple-vulnerabilities; https://support.kaspersky.com/vulnerability.aspx?el=12430#010218
CVE: CVE-2018-6290
Published: 2018-02-06
Description: Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.
CVSS Score: 7.8 (HIGH)
References: https://support.kaspersky.com/vulnerability.aspx?el=12430#010218; https://www.coresecurity.com/advisories/kaspersky-secure-mail-gateway-multiple-vulnerabilities; https://support.kaspersky.com/vulnerability.aspx?el=12430#010218
CVE: CVE-2018-6291
Published: 2018-02-06
Description: WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.kaspersky.com/vulnerability.aspx?el=12430#010218; https://www.coresecurity.com/advisories/kaspersky-secure-mail-gateway-multiple-vulnerabilities; https://support.kaspersky.com/vulnerability.aspx?el=12430#010218
CVE: CVE-2014-5279
Published: 2018-02-06
Description: The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easier for remote attackers to gain privileges or execute arbitrary code from children containers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://groups.google.com/forum/#%21msg/docker-announce/aQoVmQlcE0A/smPuBNYf8VwJ; https://groups.google.com/forum/#%21msg/docker-announce/aQoVmQlcE0A/smPuBNYf8VwJ
CVE: CVE-2014-5280
Published: 2018-02-06
Description: boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker daemons enabling TCP connections without TLS authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://groups.google.com/forum/#%21msg/docker-announce/aQoVmQlcE0A/smPuBNYf8VwJ; https://groups.google.com/forum/#%21msg/docker-announce/aQoVmQlcE0A/smPuBNYf8VwJ
CVE: CVE-2014-5282
Published: 2018-02-06
Description: Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1168436; https://groups.google.com/forum/#%21msg/docker-announce/aQoVmQlcE0A/smPuBNYf8VwJ; https://bugzilla.redhat.com/show_bug.cgi?id=1168436
CVE: CVE-2015-3618
Published: 2018-02-06
Description: Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://assets.nagios.com/downloads/exchange/nagiosbpi/CHANGELOG.txt; https://fortiguard.com/zeroday/FG-VD-15-011; https://assets.nagios.com/downloads/exchange/nagiosbpi/CHANGELOG.txt
CVE: CVE-2015-3619
Published: 2018-02-06
Description: Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of first_name, last_name and company."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.virtuemart.net/projects/virtuemart/repository/diff/trunk/virtuemart/administrator/components/com_virtuemart/assets/js/vm2admin.js?utf8=%E2%9C%93&rev=8828&rev_to=8670; https://fortiguard.com/zeroday/FG-VD-15-027; https://virtuemart.net/news/470-release-vm3-0-8-2-secured-by-fortinet-s-fortiguard-labs
CVE: CVE-2015-4400
Published: 2018-02-06
Description: Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: https://blog.fortinet.com/2016/01/22/cve-2015-4400-backdoorbot-network-configuration-leak-on-a-connected-doorbell; https://fortiguard.com/zeroday/FG-VD-15-021; https://www.pentestpartners.com/security-blog/steal-your-wi-fi-key-from-your-doorbell-iot-wtf/
CVE: CVE-2016-7394
Published: 2018-02-06
Description: tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/tikiwiki/code/59653/; https://sourceforge.net/p/tikiwiki/code/59653/
CVE: CVE-2017-17996
Published: 2018-02-06
Description: A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2018/Feb/10; http://www.ryantzj.com/flexense-syncbreeze-entreprise-10314-buffer-overflow-seh-bypass.html; http://seclists.org/fulldisclosure/2018/Feb/10
CVE: CVE-2017-6198
Published: 2018-02-06
Description: The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using a large amount of disk space.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/; https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/supervisor.c++#L824; https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/
CVE: CVE-2017-6199
Published: 2018-02-06
Description: A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/; https://github.com/sandstorm-io/sandstorm/blob/v0.202/shell/packages/sandstorm-db/db.js#L1112; https://github.com/sandstorm-io/sandstorm/commit/37bd9a7f4eb776cdc2d3615f0bfea1254b66f59d
CVE: CVE-2017-6200
Published: 2018-02-06
Description: Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed (\n) characters in a directory name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/; https://github.com/sandstorm-io/sandstorm/blob/v0.202/src/sandstorm/backup.c%2B%2B#L271; https://github.com/sandstorm-io/sandstorm/commit/4ea8df7403381d9b657b121b3c98d8081b27414d
CVE: CVE-2017-6201
Published: 2018-02-06
Description: A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could bypass access control such as firewalls that prevent the attackers from accessing the URLs directly.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/; https://github.com/sandstorm-io/sandstorm/commit/164997fb958effbc90c5328c166706280a84aaa1; https://sandstorm.io/news/2017-03-02-security-review
CVE: CVE-2017-17663
Published: 2018-02-06
Description: The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://acme.com/updates/archive/199.html; http://acme.com/updates/archive/199.html
CVE: CVE-2018-6389
Published: 2018-02-06
Description: In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/103060; http://www.securitytracker.com/id/1040347; https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html
CVE: CVE-2016-3952
Published: 2018-02-06
Description: web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify.  NOTE: this issue can be leveraged by remote attackers to gain administrative access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/; https://github.com/web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40; https://usn.ubuntu.com/4030-1/
CVE: CVE-2016-3953
Published: 2018-02-06
Description: The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/; https://github.com/web2py/web2py/blob/R-2.14.1/applications/examples/models/session.py; https://usn.ubuntu.com/4030-1/