deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11927
Published: 2019-05-24
Description: Improper input validation on input which is used as an array index will lead to an out of bounds issue while processing AP find event from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 625, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24, SM7150
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-11928
Published: 2019-05-24
Description: Lack of check on length parameter may cause buffer overflow while processing WMI commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA8081, QCA9377, QCA9379, QCA9886, QCS605, SD 210/SD 212/SD 205, SD 425, SD 600, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11928; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11928
CVE: CVE-2018-11930
Published: 2019-05-24
Description: Improper input validation on input data which is used to locate and copy the additional IEs in WLAN function can lead to potential integer truncation issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-11936
Published: 2019-05-24
Description: Index of array is processed in a wrong way inside a while loop and result in invalid index (-1 or something else) leads to out of bound memory access. in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9379, QCA9886, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 820, SD 820A, SD 835, SDX20, SDX24, Snapdragon_High_Med_2016
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11936; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11936
CVE: CVE-2018-11937
Published: 2019-05-24
Description: Lack of input validation before copying can lead to a buffer over read in WLAN function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-11940
Published: 2019-05-24
Description: Lack of check in length before using memcpy in WLAN function can lead to OOB access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-11949
Published: 2019-05-24
Description: Failure to initialize the extra buffer can lead to an out of buffer access in WLAN function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-11953
Published: 2019-05-24
Description: While processing ssid IE length from remote AP, possible out-of-bounds access may occur due to crafted ssid IE length in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 650/52, SD 820, SD 820A, SDM439, SDX20
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-11967
Published: 2019-05-24
Description: Signature verification of the skel library could potentially be disabled as the memory region on the remote subsystem in which the library is loaded is allocated from userspace currently in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-11968
Published: 2019-05-24
Description: Improper check before assigning value can lead to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4020, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA8081, QCA9377, QCA9379, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, QCN5502, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11968; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11968
CVE: CVE-2018-11976
Published: 2019-05-24
Description: ECDSA signature code leaks private keys from secure world to non-secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11976; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11976
CVE: CVE-2018-12004
Published: 2019-05-24
Description: Secure keypad is unlocked with secure display still intact in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12004; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12004
CVE: CVE-2018-12005
Published: 2019-05-24
Description: An unprivileged user can issue a binder call and cause a system halt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12005; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12005
CVE: CVE-2018-12012
Published: 2019-05-24
Description: While updating blacklisting region shared buffered memory region is not validated against newly updated black list, causing boot-up to be compromised in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12012; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12012
CVE: CVE-2018-12013
Published: 2019-05-24
Description: Improper authentication in locked memory region can lead to unprivilged access to the memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12013; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-12013
CVE: CVE-2018-13885
Published: 2019-05-24
Description: Possible memory overread may be lead to access of sensitive data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9650, MDM9655, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, SXR1130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13885; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13885
CVE: CVE-2018-13886
Published: 2019-05-24
Description: Unchecked OTA field in GNSS XTRA3 lead to integer overflow and then buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13886; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13886
CVE: CVE-2018-13887
Published: 2019-05-24
Description: Untrusted header fields in GNSS XTRA3 function can lead to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8909W, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13887; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13887
CVE: CVE-2018-13895
Published: 2019-05-24
Description: Due to the missing permissions on several content providers of the RCS app in its android manifest file will lead to an unprivileged access to phone in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13895; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13895
CVE: CVE-2018-13899
Published: 2019-05-24
Description: Processing messages after error may result in user after free memory fault in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-13920
Published: 2019-05-24
Description: Use-after-free condition due to Improper handling of hrtimers when the PMU driver tries to access its events in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM630, SDM660, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
CVE: CVE-2018-13925
Published: 2019-05-24
Description: Error in parsing PMT table frees the memory allocated for the map section but does not reset the context map section reference causing heap use after free issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13925; https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-13925
CVE: CVE-2018-18058
Published: 2019-05-24
Description: An issue was discovered in Bitdefender Engines before 7.76662. A vulnerability has been discovered in the iso.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a division-by-zero circumstance. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-369
References: https://www.bitdefender.com/; https://www.bitdefender.com/support/security-advisories/bitdefender-iso-xmd-iso-parsing-bounds-read-vulnerability/; https://www.bitdefender.com/
CVE: CVE-2018-18059
Published: 2019-05-24
Description: An issue was discovered in Bitdefender Engines before 7.76675. A vulnerability has been discovered in the rar.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://www.bitdefender.com/; https://www.bitdefender.com/support/security-advisories/bitdefender-rar-xmd-rar-parsing-bounds-read-vulnerability/; https://www.bitdefender.com/
CVE: CVE-2018-18060
Published: 2019-05-24
Description: An issue was discovered in Bitdefender Engines before 7.76808. A vulnerability has been discovered in the dalvik.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://www.bitdefender.com/; https://www.bitdefender.com/support/security-advisories/bitdefender-dalvik-xmd-apk-parsing-bounds-read-vulnerability/; https://www.bitdefender.com/
CVE: CVE-2018-19612
Published: 2019-05-24
Description: The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/TheWickerMan/CVE-Disclosures/blob/master/CVE-2018-19612.md; https://www.westermo.us/; https://github.com/TheWickerMan/CVE-Disclosures/blob/master/CVE-2018-19612.md
CVE: CVE-2018-19613
Published: 2019-05-24
Description: Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/TheWickerMan/CVE-Disclosures/blob/master/CVE-2018-19613.md; https://www.westermo.us/; https://github.com/TheWickerMan/CVE-Disclosures/blob/master/CVE-2018-19613.md
CVE: CVE-2019-10143
Published: 2019-05-24
Description: It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."
CVSS Score: 7.0 (HIGH)
CWE: CWE-250, CWE-266, CWE-362
References: http://packetstormsecurity.com/files/155361/FreeRadius-3.0.19-Logrotate-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/Nov/14; https://access.redhat.com/errata/RHSA-2019:3353
CVE: CVE-2019-10847
Published: 2019-05-24
Description: Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/155247/Computrols-CBAS-Web-19.0.0-Cross-Site-Request-Forgery.html; https://applied-risk.com/index.php/download_file/view/196/165; https://applied-risk.com/labs/advisories
CVE: CVE-2019-10848
Published: 2019-05-24
Description: Computrols CBAS 18.0.0 allows Username Enumeration.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://packetstormsecurity.com/files/155266/Computrols-CBAS-Web-19.0.0-Username-Enumeration.html; https://applied-risk.com/index.php/download_file/view/196/165; https://applied-risk.com/labs/advisories
CVE: CVE-2019-11604
Published: 2019-05-24
Description: An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code into the context of the same page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153053/Quest-KACE-Systems-Management-Appliance-9.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/May/40; https://www.rcesecurity.com/