deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15446
Published: 2018-11-08
Description: A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper protections on data that is returned from user meeting requests when the Guest access via ID and passcode option is set to Legacy mode. An attacker could exploit this vulnerability by sending meeting requests to an affected system. A successful exploit could allow the attacker to determine the values of meeting room unique identifiers, possibly allowing the attacker to conduct further exploits.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/105856; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-meeting-server; http://www.securityfocus.com/bid/105856
CVE: CVE-2018-19114
Published: 2018-11-08
Description: An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindoc_id value containing the relative pathname of this uploaded file. For example, the mindoc_id (aka session ID) could be of the form aa/../../uploads/blog/201811/attach_#.jpg where '#' is a hex value displayed in the upload field of a manage/blogs/edit/ screen.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/lifei6671/mindoc/issues/384; https://github.com/lifei6671/mindoc/issues/384
CVE: CVE-2018-15447
Published: 2018-11-08
Description: A vulnerability in the web framework code of Cisco Integrated Management Controller (IMC) Supervisor could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/105855; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cimc-sql-inject; http://www.securityfocus.com/bid/105855
CVE: CVE-2018-15448
Published: 2018-11-08
Description: A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to discover sensitive user information. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to an insecure configuration that allows improper indexing. An attacker could exploit this vulnerability by using a search engine to look for specific data strings. A successful exploit could allow the attacker to discover certain sensitive information about the application, including usernames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://www.securityfocus.com/bid/105862; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-res-info-disc; http://www.securityfocus.com/bid/105862
CVE: CVE-2018-15449
Published: 2018-11-08
Description: A vulnerability in the web-based management interface of Cisco Video Surveillance Media Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to cause the web-based management interface to become unreachable, resulting in a DoS condition.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105863; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-vsms-dos; http://www.securityfocus.com/bid/105863
CVE: CVE-2018-6436
Published: 2018-11-08
Description: A Vulnerability in the firmwaredownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.
CVSS Score: 7.8 (HIGH)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-730; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-730
CVE: CVE-2018-6437
Published: 2018-11-08
Description: A Vulnerability in the help command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.
CVSS Score: 7.8 (HIGH)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-731; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-731
CVE: CVE-2018-6438
Published: 2018-11-08
Description: A Vulnerability in the supportsave command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.
CVSS Score: 7.8 (HIGH)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-731; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-731
CVE: CVE-2018-15450
Published: 2018-11-08
Description: A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files on the file system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a specific UI input field to provide a custom path location. A successful exploit could allow the attacker to overwrite files on the file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-22
References: http://www.securityfocus.com/bid/105864; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-pca-overwrite; http://www.securityfocus.com/bid/105864
CVE: CVE-2018-15451
Published: 2018-11-08
Description: A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/105857; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-psc-xss; http://www.securityfocus.com/bid/105857
CVE: CVE-2018-19044
Published: 2018-11-08
Description: keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-59
References: https://access.redhat.com/errata/RHSA-2019:2285; https://bugzilla.suse.com/show_bug.cgi?id=1015141; https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306
CVE: CVE-2018-19045
Published: 2018-11-08
Description: keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=1015141; https://github.com/acassen/keepalived/commit/5241e4d7b177d0b6f073cfc9ed5444bf51ec89d6; https://github.com/acassen/keepalived/commit/c6247a9ef2c7b33244ab1d3aa5d629ec49f0a067
CVE: CVE-2018-19046
Published: 2018-11-08
Description: keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=1015141; https://github.com/acassen/keepalived/issues/1048; https://security.gentoo.org/glsa/201903-01
CVE: CVE-2018-19115
Published: 2018-11-08
Description: keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2019:0022; https://access.redhat.com/errata/RHSA-2019:1792; https://access.redhat.com/errata/RHSA-2019:1945
CVE: CVE-2018-7718
Published: 2018-11-08
Description: An issue was discovered in Telexy QPath 5.4.462. A low privileged authenticated user supplying a specially crafted serialized request to AdanitDataService.svc may modify user information, including but not limited to email address, username, and password, of other user accounts. The simplest attack approach is for the attacker to intercept their own password-change request and modify the username before the request reaches the server. Also, changing a victim's email address can have a similar account-takeover consequence.
CVSS Score: 6.5 (MEDIUM)
References: https://www.dropbox.com/s/6tlee2uj3t3su8n/Telexy-QPath-CVE-2018-7718.pdf; https://www.dropbox.com/s/6tlee2uj3t3su8n/Telexy-QPath-CVE-2018-7718.pdf
CVE: CVE-2016-9749
Published: 2018-11-09
Description: IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack of input validation. IBM X-Force ID: 120206.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=ibm10738293; https://exchange.xforce.ibmcloud.com/vulnerabilities/120206; http://www.ibm.com/support/docview.wss?uid=ibm10738293
CVE: CVE-2017-1119
Published: 2018-11-09
Description: IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted request to cause an error message to be returned containing the full root path. An attacker could use this information to launch further attacks against the affected system. IBM X-Force ID: 121171.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10738519; https://exchange.xforce.ibmcloud.com/vulnerabilities/121171; http://www.ibm.com/support/docview.wss?uid=ibm10738519
CVE: CVE-2018-1684
Published: 2018-11-09
Description: IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/145456; https://www.ibm.com/support/docview.wss?uid=ibm10734297; https://exchange.xforce.ibmcloud.com/vulnerabilities/145456
CVE: CVE-2018-1774
Published: 2018-11-09
Description: IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IBM X-Force ID: 148692.
CVSS Score: 8.9 (HIGH)
CWE: CWE-1236
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/148692; https://www.ibm.com/support/docview.wss?uid=ibm10737867; https://exchange.xforce.ibmcloud.com/vulnerabilities/148692
CVE: CVE-2018-1780
Published: 2018-11-09
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local db2 instance owner to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148803.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://www.ibm.com/support/docview.wss?uid=ibm10733939; http://www.securityfocus.com/bid/105885; http://www.securitytracker.com/id/1042086
CVE: CVE-2018-1781
Published: 2018-11-09
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148804.
CVSS Score: 8.4 (HIGH)
CWE: CWE-59
References: http://www.ibm.com/support/docview.wss?uid=ibm10733939; http://www.securityfocus.com/bid/105885; http://www.securitytracker.com/id/1042086
CVE: CVE-2018-1799
Published: 2018-11-09
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local unprivileged user to overwrite files on the system which could cause damage to the database. IBM X-Force ID: 149429.
CVSS Score: 6.2 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10733939; http://www.securityfocus.com/bid/105885; http://www.securitytracker.com/id/1042086
CVE: CVE-2018-1802
Published: 2018-11-09
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640.
CVSS Score: 8.4 (HIGH)
CWE: CWE-426
References: http://www.ibm.com/support/docview.wss?uid=ibm10733122; http://www.securityfocus.com/bid/105962; http://www.securitytracker.com/id/1042082
CVE: CVE-2018-1834
Published: 2018-11-09
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to escalate their privileges to root through a symbolic link attack. IBM X-Force ID: 150511.
CVSS Score: 7.4 (HIGH)
CWE: CWE-59
References: http://www.ibm.com/support/docview.wss?uid=ibm10733939; http://www.securityfocus.com/bid/105885; http://www.securitytracker.com/id/1042086
CVE: CVE-2018-1842
Published: 2018-11-09
Description: IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token. IBM X-Force ID: 150902.
CVSS Score: 3.6 (LOW)
CWE: CWE-347
References: http://www.securitytracker.com/id/1042031; https://exchange.xforce.ibmcloud.com/vulnerabilities/150902; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1857
Published: 2018-11-09
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow a user to bypass FGAC control and gain access to data they shouldn't be able to see. IBM X-Force ID: 151155.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10734059; http://www.securityfocus.com/bid/105883; http://www.securitytracker.com/id/1042176
CVE: CVE-2018-19121
Published: 2018-11-09
Description: An issue has been found in libIEC61850 v1.3. It is a SEGV in Ethernet_receivePacket in ethernet_bsd.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: https://github.com/fouzhe/security/tree/master/libiec61850#segv-in-function-ethernet_receivepacket; https://github.com/mz-automation/libiec61850/issues/85; https://github.com/fouzhe/security/tree/master/libiec61850#segv-in-function-ethernet_receivepacket
CVE: CVE-2018-19122
Published: 2018-11-09
Description: An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in Ethernet_sendPacket in ethernet_bsd.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: https://github.com/fouzhe/security/tree/master/libiec61850#segv-in-function-ethernet_sendpacket; https://github.com/mz-automation/libiec61850/issues/86; https://github.com/fouzhe/security/tree/master/libiec61850#segv-in-function-ethernet_sendpacket
CVE: CVE-2018-19124
Published: 2018-11-09
Description: PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://build.prestashop.com/news/prestashop-1-7-4-4-1-6-1-23-maintenance-releases/; https://github.com/PrestaShop/PrestaShop/pull/11285; https://github.com/PrestaShop/PrestaShop/pull/11286
CVE: CVE-2018-19125
Published: 2018-11-09
Description: PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.
CVSS Score: 7.5 (HIGH)
References: http://build.prestashop.com/news/prestashop-1-7-4-4-1-6-1-23-maintenance-releases/; https://github.com/PrestaShop/PrestaShop/pull/11285; https://github.com/PrestaShop/PrestaShop/pull/11286
CVE: CVE-2018-19126
Published: 2018-11-09
Description: PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://build.prestashop.com/news/prestashop-1-7-4-4-1-6-1-23-maintenance-releases/; https://github.com/PrestaShop/PrestaShop/pull/11285; https://github.com/PrestaShop/PrestaShop/pull/11286
CVE: CVE-2018-19128
Published: 2018-11-09
Description: In Libav 12.3, there is a heap-based buffer over-read in decode_frame in libavcodec/lcldec.c that allows an attacker to cause denial-of-service via a crafted avi file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.libav.org/show_bug.cgi?id=1137; https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html; https://bugzilla.libav.org/show_bug.cgi?id=1137
CVE: CVE-2018-19129
Published: 2018-11-09
Description: In Libav 12.3, a NULL pointer dereference (RIP points to zero) issue in ff_mpa_synth_filter_float in libavcodec/mpegaudiodsp_template.c can cause a segmentation fault (application crash) via a crafted mov file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.libav.org/show_bug.cgi?id=1138; https://bugzilla.libav.org/show_bug.cgi?id=1138
CVE: CVE-2018-19130
Published: 2018-11-09
Description: In Libav 12.3, there is an invalid memory access in vc1_decode_frame in libavcodec/vc1dec.c that allows attackers to cause a denial-of-service via a crafted aac file. NOTE: This may be a duplicate of CVE-2017-17127
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.libav.org/show_bug.cgi?id=1139; https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/152819
CVE: CVE-2018-19131
Published: 2018-11-09
Description: Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.squid-cache.org/Advisories/SQUID-2018_4.txt; http://www.squid-cache.org/Versions/v5/changesets/squid-5-6feeb15ff312f3e145763adf8d234ed6a0b3f11d.patch; https://github.com/squid-cache/squid/pull/306
CVE: CVE-2018-19132
Published: 2018-11-09
Description: Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-772
References: http://www.squid-cache.org/Advisories/SQUID-2018_5.txt; http://www.squid-cache.org/Versions/v5/changesets/squid-5-644131ff1e00c1895d77561f561d29c104ba6b11.patch; https://github.com/squid-cache/squid/pull/313
CVE: CVE-2018-19133
Published: 2018-11-09
Description: In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/flarum/core/issues/1628; https://github.com/flarum/core/issues/1628
CVE: CVE-2018-19127
Published: 2018-11-09
Description: A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/ab1gale/phpcms-2008-CVE-2018-19127; https://github.com/ab1gale/phpcms-2008-CVE-2018-19127
CVE: CVE-2018-1872
Published: 2018-11-09
Description: IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 151330.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106140; https://exchange.xforce.ibmcloud.com/vulnerabilities/151330; https://www.ibm.com/support/docview.wss?uid=ibm10737461
CVE: CVE-2018-14644
Published: 2018-11-09
Description: An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached as failing DNSSEC validation. It only arises if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. As a result, subsequent queries from clients requesting DNSSEC validation will be answered with a ServFail.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14644; https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-07.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14644
CVE: CVE-2018-19136
Published: 2018-11-09
Description: DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/domainmod/domainmod/issues/79; https://www.exploit-db.com/exploits/45883/; https://github.com/domainmod/domainmod/issues/79
CVE: CVE-2018-19137
Published: 2018-11-09
Description: DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/domainmod/domainmod/issues/79; https://github.com/domainmod/domainmod/issues/79
CVE: CVE-2018-17612
Published: 2018-11-09
Description: Sennheiser HeadSetup 7.3.4903 places Certification Authority (CA) certificates into the Trusted Root CA store of the local system, and publishes the private key in the SennComCCKey.pem file within the public software distribution, which allows remote attackers to spoof arbitrary web sites or software publishers for several years, even if the HeadSetup product is uninstalled. NOTE: a vulnerability-assessment approach must check all Windows systems for CA certificates with a CN of 127.0.0.1 or SennComRootCA, and determine whether those certificates are unwanted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.securityfocus.com/bid/106045; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV180029; https://www.secorvo.de/publikationen/headsetup-vulnerability-report-secorvo-2018.pdf
CVE: CVE-2018-19138
Published: 2018-11-09
Description: WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yanchongchong/swallow/issues/11; https://www.exploit-db.com/exploits/46036/; https://github.com/yanchongchong/swallow/issues/11