deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-4947
Published: 2018-01-29
Description: VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.securityfocus.com/bid/102852; http://www.securitytracker.com/id/1040289; http://www.securitytracker.com/id/1040290
CVE: CVE-2017-4951
Published: 2018-01-29
Description: VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking users into installing a malicious application on their devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/102849; http://www.securitytracker.com/id/1040288; https://www.vmware.com/security/advisories/VMSA-2018-0006.html
CVE: CVE-2018-1364
Published: 2018-01-29
Description: IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 137449.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg22012595; http://www.securityfocus.com/bid/102864; https://exchange.xforce.ibmcloud.com/vulnerabilities/137449
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-29
Description: Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html; http://www.securityfocus.com/bid/98056; https://jenkins.io/security/advisory/2017-04-26/
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-29
Description: Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login` command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/98065; https://jenkins.io/security/advisory/2017-04-26/; http://www.securityfocus.com/bid/98065
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-29
Description: Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: http://www.securityfocus.com/bid/98066; https://jenkins.io/security/advisory/2017-04-26/; http://www.securityfocus.com/bid/98066
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-29
Description: Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process and allowing a wide variety of impacts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/98062; https://jenkins.io/security/advisory/2017-04-26/; http://www.securityfocus.com/bid/98062
CVE: CVE-2017-12626
Published: 2018-01-29
Description: Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/102879; https://access.redhat.com/errata/RHSA-2018:1322; https://lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b%40%3Cdev.poi.apache.org%3E
CVE: CVE-2018-6381
Published: 2018-01-29
Description: In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2018-6381; https://github.com/gdraheim/zziplib/issues/12; https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html
CVE: CVE-2018-6383
Published: 2018-01-29
Description: Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048.
CVSS Score: 8.8 (HIGH)
CWE: CWE-184
References: http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html; https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-6383-Exploit; https://github.com/monstra-cms/monstra/issues/429
CVE: CVE-2018-6387
Published: 2018-01-29
Description: iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of support for the support account, and a hardcoded password of user for the user account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://blogs.securiteam.com/index.php/archives/3654; https://blogs.securiteam.com/index.php/archives/3654
CVE: CVE-2018-6388
Published: 2018-01-29
Description: iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping test arguments on the Diagnostics page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blogs.securiteam.com/index.php/archives/3654; https://blogs.securiteam.com/index.php/archives/3654
CVE: CVE-2017-15133
Published: 2018-01-29
Description: A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1538763; https://github.com/miekg/dns/issues/627; https://bugzilla.redhat.com/show_bug.cgi?id=1538763
CVE: CVE-2017-17070
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17071
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17072
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17073
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17074
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17075
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17076
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17077
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17078
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-17079
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-3739
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-7516
Published: 2018-01-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-1197. Reason: This candidate is a duplicate of CVE-2015-1197. Notes: All CVE users should reference CVE-2015-1197 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2017-9513
Published: 2018-01-29
Description: Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although they will not receive notifications for the issue, via missing permission checks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-862
References: http://www.securityfocus.com/bid/102869; https://ecosystem.atlassian.net/browse/STRM-2350; http://www.securityfocus.com/bid/102869
CVE: CVE-2018-6390
Published: 2018-01-29
Description: The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of the source memory block before an _copy call, which allows remote attackers to cause a denial of service (access violation and application crash) via a crafted (a) web page, (b) office document, or (c) .rtf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/Khwarezmia/WPS_POC/tree/master/wps_20180129; https://github.com/Khwarezmia/WPS_POC/tree/master/wps_20180129
CVE: CVE-2018-6391
Published: 2018-01-29
Description: A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation List settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://0day.today/exploit/29659; https://packetstormsecurity.com/files/146117/netiswf2419-xsrf.txt; https://www.exploit-db.com/exploits/43919/
CVE: CVE-2018-6392
Published: 2018-01-29
Description: The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102848; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/3f621455d62e[PII_REDACTED]8d915badd5b1e5bcd5; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c6939f65a116b1ffed345d29d8621ee4ffb32235
CVE: CVE-2016-10711
Published: 2018-01-29
Description: Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: http://www.apsis.ch/pound/pound_list/archive/2016/2016-10/[PII_REDACTED]00; https://lists.debian.org/debian-lts-announce/2018/02/msg00015.html; https://lists.debian.org/debian-lts-announce/2020/04/msg00028.html
CVE: CVE-2018-0101
Published: 2018-01-29
Description: A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-415, CWE-415
References: http://www.securityfocus.com/bid/102845; http://www.securitytracker.com/id/1040292; https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618/
CVE: CVE-2018-3835
Published: 2018-01-29
Description: An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX. The vulnerability is present in the reading of a file without proper parameter checking. The value read in, is not verified to be valid and its use can lead to a buffer overflow, potentially resulting in code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0515; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0515
CVE: CVE-2018-6393
Published: 2018-01-29
Description: FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can "directly modify SQL tables ... [or] run shell scripts ... once ... logged in to the administration interface; there is no need to try to find input validation errors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://code610.blogspot.com/2018/01/post-auth-sql-injection-in-freepbx.html; http://www.securityfocus.com/bid/102854; https://github.com/c610/tmp/blob/master/sqlipoc-freepbx-14.0.1.24-req.txt
CVE: CVE-2018-6382
Published: 2018-01-30
Description: MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass
CVSS Score: 3.3 (LOW)
CWE: CWE-89
References: http://archive.is/https:/mantisbt.org/bugs/view.php?id=23908; https://mantisbt.org/bugs/view.php?id=23908; http://archive.is/https:/mantisbt.org/bugs/view.php?id=23908
CVE: CVE-2018-6395
Published: 2018-01-30
Description: SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43933/; https://www.exploit-db.com/exploits/43933/
CVE: CVE-2018-6397
Published: 2018-01-30
Description: Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/43931/; https://www.exploit-db.com/exploits/43931/
CVE: CVE-2018-6398
Published: 2018-01-30
Description: SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43932/; https://www.exploit-db.com/exploits/43932/
CVE: CVE-2017-17969
Published: 2018-01-30
Description: Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securitytracker.com/id/1040831; https://0patch.blogspot.si/2018/02/two-interesting-micropatches-for-7-zip.html; https://github.com/p7zip-project/p7zip/issues/7
CVE: CVE-2014-4705
Published: 2018-01-30
Description: Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 series switches; AR150, AR160, AR200, AR1200, AR2200, AR3200, AR530, NetEngine16EX, SRG1300, SRG2300, and SRG3300 series routers; and WLAN AC6005, AC6605, and ACU2 access controllers allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/59349; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345171.htm; http://secunia.com/advisories/59349
CVE: CVE-2018-6355
Published: 2018-01-30
Description: /goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the lang parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/MayurUdiniya/597169f582e506b610beb4e84fd8c8fc; https://gist.github.com/MayurUdiniya/597169f582e506b610beb4e84fd8c8fc
CVE: CVE-2018-6376
Published: 2018-01-30
Description: In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/102916; http://www.securitytracker.com/id/1040316; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-sqli-vulnerability.html
CVE: CVE-2018-6377
Published: 2018-01-30
Description: In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102917; http://www.securitytracker.com/id/1040316; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-vulnerability.html
CVE: CVE-2018-6379
Published: 2018-01-30
Description: In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102918; http://www.securitytracker.com/id/1040316; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-xss-vulnerability.html
CVE: CVE-2018-6380
Published: 2018-01-30
Description: In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102921; http://www.securitytracker.com/id/1040316; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-xss-vulnerability.html
CVE: CVE-2017-1731
Published: 2018-01-30
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges.
CVSS Score: 8.8 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg22012345&myns=swgws&mynp=OCSSEQTP&mync=R&cm_sp=swgws-_-OCSSEQTP-_-R; http://www.securityfocus.com/bid/102911; http://www.securitytracker.com/id/1040356
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-30
Description: An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-640
References: https://bugs.launchpad.net/mahara/+bug/1422492; https://bugs.launchpad.net/mahara/+bug/1422492
CVE: CVE-2011-2902
Published: 2018-01-30
Description: zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/02/08/5; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=635849; https://security-tracker.debian.org/tracker/CVE-2011-2902/
CVE: CVE-2016-6598
Published: 2018-01-30
Description: BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a method that allows uploading a file to an arbitrary path on the machine that is running Track-It!. This can be used to upload a file to the web root and achieve code execution as NETWORK SERVICE or SYSTEM.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.html; http://seclists.org/fulldisclosure/2018/Jan/92; https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015
CVE: CVE-2016-6599
Published: 2018-01-30
Description: BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.html; http://seclists.org/fulldisclosure/2018/Jan/92; https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015
CVE: CVE-2018-5441
Published: 2018-01-30
Description: An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing an attacker to modify firmware update packages.
CVSS Score: 7.8 (HIGH)
CWE: CWE-354, CWE-20
References: http://www.securityfocus.com/bid/102907; https://cert.vde.com/en-us/advisories/vde-2018-001; https://ics-cert.us-cert.gov/advisories/ICSA-18-030-01