deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-16587
Published: 2018-09-28
Description: In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://community.otrs.com/security-advisory-2018-04-security-update-for-otrs-framework/; https://github.com/OTRS/otrs/commit/a4a1a01f84fac7ab032570ee50b660e2ebb15c01; https://github.com/OTRS/otrs/commit/d8cae00b0f78c2a07bb10cedb[PII_REDACTED]95843
CVE: CVE-2018-16659
Published: 2018-09-28
Description: An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/45500/; https://www.exploit-db.com/exploits/45500/
CVE: CVE-2018-17055
Published: 2018-09-28
Description: An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/; https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018; https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/
CVE: CVE-2018-17056
Published: 2018-09-28
Description: Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/; https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018; https://insinuator.net/2018/10/vulnerabilities-in-sitefinity-wcms-a-success-story-of-a-responsible-disclosure-process/
CVE: CVE-2018-17375
Published: 2018-09-28
Description: SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149521/Joomla-Music-Collection-3.0.3-SQL-Injection.html; https://www.exploit-db.com/exploits/45465/; http://packetstormsecurity.com/files/149521/Joomla-Music-Collection-3.0.3-SQL-Injection.html
CVE: CVE-2018-17376
Published: 2018-09-28
Description: SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filter_letter parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149531/Joomla-Reverse-Auction-Factory-4.3.8-SQL-Injection.html; https://www.exploit-db.com/exploits/45475/; http://packetstormsecurity.com/files/149531/Joomla-Reverse-Auction-Factory-4.3.8-SQL-Injection.html
CVE: CVE-2018-17377
Published: 2018-09-28
Description: SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149523/Joomla-Questions-1.4.3-SQL-Injection.html; https://www.exploit-db.com/exploits/45468/; http://packetstormsecurity.com/files/149523/Joomla-Questions-1.4.3-SQL-Injection.html
CVE: CVE-2018-17378
Published: 2018-09-28
Description: SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149522/Joomla-Penny-Auction-Factory-2.0.4-SQL-Injection.html; https://www.exploit-db.com/exploits/45466/; http://packetstormsecurity.com/files/149522/Joomla-Penny-Auction-Factory-2.0.4-SQL-Injection.html
CVE: CVE-2018-17379
Published: 2018-09-28
Description: SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149520/Joomla-Raffle-Factory-3.5.2-SQL-Injection.html; https://www.exploit-db.com/exploits/45464/; http://packetstormsecurity.com/files/149520/Joomla-Raffle-Factory-3.5.2-SQL-Injection.html
CVE: CVE-2018-17380
Published: 2018-09-28
Description: SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_end_date parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149533/Joomla-Article-Factory-Manager-4.3.9-SQL-Injection.html; https://www.exploit-db.com/exploits/45477/; http://packetstormsecurity.com/files/149533/Joomla-Article-Factory-Manager-4.3.9-SQL-Injection.html
CVE: CVE-2018-17382
Published: 2018-09-28
Description: SQL Injection exists in the Jobs Factory 2.0.4 component for Joomla! via the filter_letter parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149524/Joomla-Jobs-Factory-2.0.4-SQL-Injection.html; https://www.exploit-db.com/exploits/45469/; http://packetstormsecurity.com/files/149524/Joomla-Jobs-Factory-2.0.4-SQL-Injection.html
CVE: CVE-2018-17383
Published: 2018-09-28
Description: SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149530/Joomla-Collection-Factory-4.1.9-SQL-Injection.html; https://www.exploit-db.com/exploits/45474/; http://packetstormsecurity.com/files/149530/Joomla-Collection-Factory-4.1.9-SQL-Injection.html
CVE: CVE-2018-17384
Published: 2018-09-28
Description: SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149529/Joomla-Swap-Factory-2.2.1-SQL-Injection.html; https://www.exploit-db.com/exploits/45473/; http://packetstormsecurity.com/files/149529/Joomla-Swap-Factory-2.2.1-SQL-Injection.html
CVE: CVE-2018-17385
Published: 2018-09-28
Description: SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radius] parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149525/Joomla-Social-Factory-3.8.3-SQL-Injection.html; https://www.exploit-db.com/exploits/45470/; http://packetstormsecurity.com/files/149525/Joomla-Social-Factory-3.8.3-SQL-Injection.html
CVE: CVE-2018-17391
Published: 2018-09-28
Description: SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149519/Super-Cms-Blog-Pro-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/45463/; http://packetstormsecurity.com/files/149519/Super-Cms-Blog-Pro-1.0-SQL-Injection.html
CVE: CVE-2018-17394
Published: 2018-09-28
Description: SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149534/Joomla-Timetable-Schedule-3.6.8-SQL-Injection.html; https://www.exploit-db.com/exploits/45478/; http://packetstormsecurity.com/files/149534/Joomla-Timetable-Schedule-3.6.8-SQL-Injection.html
CVE: CVE-2018-17397
Published: 2018-09-28
Description: SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/149532/Joomla-AlphaIndex-Dictionaries-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/45476/; http://packetstormsecurity.com/files/149532/Joomla-AlphaIndex-Dictionaries-1.0-SQL-Injection.html
CVE: CVE-2018-17567
Published: 2018-09-28
Description: Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: https://github.com/jekyll/jekyll/pull/7224; https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/; https://lists.apache.org/thread.html/71da391f584b2fb301d2df0e491b279d87287e2fb4b11309f04ad984%40%3Ccommits.accumulo.apache.org%3E
CVE: CVE-2018-17571
Published: 2018-09-28
Description: Vanilla before 2.6.1 allows XSS via the email field of a profile.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/361957; https://hackerone.com/reports/361957
CVE: CVE-2018-17573
Published: 2018-09-28
Description: The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and fckeditor/editor/filemanager/connectors/uploadtest.html.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/149568/WordPress-WP-Insert-2.4.2-Arbitrary-File-Upload.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2018-17574
Published: 2018-09-28
Description: An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/YMFE/yapi/issues/520; https://github.com/YMFE/yapi/issues/520
CVE: CVE-2018-17575
Published: 2018-09-28
Description: SWA SWA.JACAD 3.1.37 Build 024 has SQL Injection via the /academico/aluno/esqueci-minha-senha/ studentId parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://lab.insightsecurity.com.br/swa-sistemas-academicos-cve/; https://lab.insightsecurity.com.br/swa-sistemas-academicos-cve/
CVE: CVE-2018-17580
Published: 2018-09-28
Description: A heap-based buffer over-read exists in the function fast_edit_packet() in the file send_packets.c of Tcpreplay v4.3.0 beta1. This can lead to Denial of Service (DoS) and potentially Information Exposure when the application attempts to process a crafted pcap file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay; https://github.com/appneta/tcpreplay/issues/485; https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay
CVE: CVE-2018-17581
Published: 2018-09-28
Description: CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/460; https://github.com/SegfaultMasters/covering360/blob/master/Exiv2
CVE: CVE-2018-17582
Published: 2018-09-28
Description: Tcpreplay v4.3.0 beta1 contains a heap-based buffer over-read. The get_next_packet() function in the send_packets.c file uses the memcpy() function unsafely to copy sequences from the source buffer pktdata to the destination (*prev_packet)->pktdata. This will result in a Denial of Service (DoS) and potentially Information Exposure when the application attempts to process a file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay; https://github.com/appneta/tcpreplay/issues/484; https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay
CVE: CVE-2018-17605
Published: 2018-09-28
Description: An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/bertramdev/asset-pipeline/commit/a29533c52e4b60e244082433e116d2a038d01017; https://github.com/grails/grails-core/issues/11068; https://github.com/bertramdev/asset-pipeline/commit/a29533c52e4b60e244082433e116d2a038d01017
CVE: CVE-2018-17607
Published: 2018-09-28
Description: Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17608
Published: 2018-09-28
Description: Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17609
Published: 2018-09-28
Description: Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17610
Published: 2018-09-28
Description: Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17611
Published: 2018-09-28
Description: Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17613
Published: 2018-09-28
Description: Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://seclists.org/oss-sec/2018/q3/280; https://www.inputzero.io/2018/09/telegram-share-password-in-cleartext.html; https://seclists.org/oss-sec/2018/q3/280
CVE: CVE-2018-14648
Published: 2018-09-28
Description: A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://access.redhat.com/errata/RHSA-2018:3127; https://access.redhat.com/errata/RHSA-2018:3507; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14648
CVE: CVE-2018-1702
Published: 2018-09-28
Description: IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 146189.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/146189; https://www.ibm.com/support/docview.wss?uid=ibm10719659; https://exchange.xforce.ibmcloud.com/vulnerabilities/146189
CVE: CVE-2018-1704
Published: 2018-09-28
Description: IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 146339.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/146339; https://www.ibm.com/support/docview.wss?uid=ibm10719671; https://exchange.xforce.ibmcloud.com/vulnerabilities/146339
CVE: CVE-2018-17154
Published: 2018-09-28
Description: In FreeBSD before 11.2-STABLE(r338987), 11.2-RELEASE-p4, and 11.1-RELEASE-p15, due to insufficient memory checking in the freebsd4_getfsstat system call, a NULL pointer dereference can occur. Unprivileged authenticated local users may be able to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://security.FreeBSD.org/advisories/FreeBSD-EN-18:10.syscall.asc; https://security.FreeBSD.org/advisories/FreeBSD-EN-18:10.syscall.asc
CVE: CVE-2018-17155
Published: 2018-09-28
Description: In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient initialization of memory copied to userland in the getcontext and swapcontext system calls, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts privileged kernel data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://security.FreeBSD.org/advisories/FreeBSD-EN-18:12.mem.asc; https://security.FreeBSD.org/advisories/FreeBSD-EN-18:12.mem.asc
CVE: CVE-2018-6925
Published: 2018-09-28
Description: In FreeBSD before 11.2-STABLE(r338986), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338985), and 10.4-RELEASE-p13, due to improper maintenance of IPv6 protocol control block flags through various failure paths, an unprivileged authenticated local user may be able to cause a NULL pointer dereference causing the kernel to crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://security.FreeBSD.org/advisories/FreeBSD-EN-18:11.listen.asc; https://www.flexera.com/company/secunia-research/advisories/SR-2018-21.html; https://security.FreeBSD.org/advisories/FreeBSD-EN-18:11.listen.asc
CVE: CVE-2018-15365
Published: 2018-09-28
Description: A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nixwizard/CVE-2018-15365/; https://success.trendmicro.com/solution/1121079; https://github.com/nixwizard/CVE-2018-15365/
CVE: CVE-2018-5393
Published: 2018-09-28
Description: The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) service for remote control. The RMI interface does not require any authentication before use, so it lacks user authentication for RMI service commands in EAP controller versions 2.5.3 and earlier. Remote attackers can implement deserialization attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target server and execute Java functions or bytecode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://www.securityfocus.com/bid/105402; https://www.kb.cert.org/vuls/id/581311; http://www.securityfocus.com/bid/105402
CVE: CVE-2018-11073
Published: 2018-09-28
Description: RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105410; http://www.securitytracker.com/id/1041697; https://seclists.org/fulldisclosure/2018/Sep/39
CVE: CVE-2018-11074
Published: 2018-09-28
Description: RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105410; http://www.securitytracker.com/id/1041697; https://seclists.org/fulldisclosure/2018/Sep/39
CVE: CVE-2018-11075
Published: 2018-09-28
Description: RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application, which code is then executed by the victim's web browser in the context of the vulnerable web application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105410; http://www.securitytracker.com/id/1041697; https://seclists.org/fulldisclosure/2018/Sep/39
CVE: CVE-2018-1246
Published: 2018-09-28
Description: Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://seclists.org/fulldisclosure/2018/Sep/30; https://seclists.org/fulldisclosure/2018/Sep/30
CVE: CVE-2018-1250
Published: 2018-09-28
Description: Dell EMC Unity and UnityVSA versions prior to 4.3.[PII_REDACTED] contains an Authorization Bypass vulnerability. A remote authenticated user could potentially exploit this vulnerability to read files in NAS server by directly interacting with certain APIs of Unity OE, bypassing Role-Based Authorization control implemented only in Unisphere GUI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://seclists.org/fulldisclosure/2018/Sep/30; https://seclists.org/fulldisclosure/2018/Sep/30
CVE: CVE-2018-1251
Published: 2018-09-28
Description: Dell EMC Unity and UnityVSA versions prior to 4.3.[PII_REDACTED] contains a URL Redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect Unity users to arbitrary web URLs by tricking the victim user to click on a maliciously crafted Unisphere URL. Attacker could potentially phish information, including Unisphere users' credentials, from the victim once they are redirected.
CVSS Score: 8.3 (HIGH)
CWE: CWE-601
References: https://seclists.org/fulldisclosure/2018/Sep/30; https://seclists.org/fulldisclosure/2018/Sep/30