deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-12576
Published: 2018-07-02
Description: TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://software-talk.org/blog/2018/04/tplink-wr841n-clickjacking-https/; https://software-talk.org/blog/2018/04/tplink-wr841n-clickjacking-https/
CVE: CVE-2018-12577
Published: 2018-07-02
Description: The Ping and Traceroute features on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow authenticated blind Command Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://software-talk.org/blog/2018/06/tplink-wr841n-code-exec-cve-2018-12577/; https://software-talk.org/blog/2018/06/tplink-wr841n-code-exec-cve-2018-12577/
CVE: CVE-2018-9276
Published: 2018-07-02
Description: An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html; http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html; http://www.securityfocus.com/archive/1/542103/100/0/threaded
CVE: CVE-2018-10843
Published: 2018-07-02
Description: source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20, CWE-732
References: https://access.redhat.com/errata/RHSA-2018:2013; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10843; https://access.redhat.com/errata/RHSA-2018:2013
CVE: CVE-2018-1212
Published: 2018-07-02
Description: The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A remote authenticated malicious iDRAC user with access to the diagnostics console could potentially exploit this vulnerability to execute arbitrary commands as root on the affected iDRAC system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20487494; http://en.community.dell.com/techcenter/extras/m/white_papers/20487494
CVE: CVE-2018-12426
Published: 2018-07-02
Description: The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/CodeCabin/wp-live-chat-support/blob/master/readme.txt; https://github.com/RiieCco/write-ups/tree/master/CVE-2018-12426; https://wpvulndb.com/vulnerabilities/9697
CVE: CVE-2018-1243
Published: 2018-07-02
Description: Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20487494; http://en.community.dell.com/techcenter/extras/m/white_papers/20487494
CVE: CVE-2018-1244
Published: 2018-07-02
Description: Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated malicious iDRAC user with configuration privileges could potentially exploit this vulnerability to execute arbitrary commands on the iDRAC where SNMP alerting is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20487494; http://www.securityfocus.com/bid/104964; http://en.community.dell.com/techcenter/extras/m/white_papers/20487494
CVE: CVE-2018-1249
Published: 2018-07-02
Description: Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server.
CVSS Score: 6.5 (MEDIUM)
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20487494; http://en.community.dell.com/techcenter/extras/m/white_papers/20487494
CVE: CVE-2018-12891
Published: 2018-07-02
Description: An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86 HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2018/06/27/10; http://www.securityfocus.com/bid/104570; http://www.securitytracker.com/id/1041201
CVE: CVE-2018-12892
Published: 2018-07-02
Description: An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2018/06/27/12; http://www.securityfocus.com/bid/104571; http://www.securitytracker.com/id/1041203
CVE: CVE-2018-12893
Published: 2018-07-02
Description: An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. All Xen systems which have applied the XSA-260 fix are vulnerable. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2018/06/27/11; http://www.securityfocus.com/bid/104572; http://www.securitytracker.com/id/1041202
CVE: CVE-2018-12896
Published: 2018-07-02
Description: An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://bugzilla.kernel.org/show_bug.cgi?id=200189; https://github.com/lcytxw/bug_repro/tree/master/bug_200189; https://github.com/torvalds/linux/commit/78c9c4dfbf8c[PII_REDACTED]5a195276bb4bb92c76
CVE: CVE-2018-13066
Published: 2018-07-02
Description: There is a memory leak in util/parser.c in libming 0.4.8, which will lead to a denial of service via parseSWF_DEFINEBUTTON2, parseSWF_DEFINEFONT, parseSWF_DEFINEFONTINFO, parseSWF_DEFINELOSSLESS, parseSWF_DEFINESPRITE, parseSWF_DEFINETEXT, parseSWF_DOACTION, parseSWF_FILLSTYLEARRAY, parseSWF_FRAMELABEL, parseSWF_LINESTYLEARRAY, parseSWF_PLACEOBJECT2, or parseSWF_SHAPEWITHSTYLE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/libming/libming/issues/146; https://github.com/libming/libming/issues/146
CVE: CVE-2018-13067
Published: 2018-07-02
Description: /upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://whitehatck01.blogspot.com/2018/06/opencart-v3-0-3-0-user-changes-password.html; https://whitehatck01.blogspot.com/2018/06/opencart-v3-0-3-0-user-changes-password.html
CVE: CVE-2017-2615
Published: 2018-07-03
Description: Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-125, CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0309.html; http://rhn.redhat.com/errata/RHSA-2017-0328.html; http://rhn.redhat.com/errata/RHSA-2017-0329.html
CVE: CVE-2018-10596
Published: 2018-07-03
Description: Medtronic 2090 CareLink Programmer 

uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encapsulated IP-based VPN connection to a Medtronic-hosted update network. Once the VPN is established, it makes a request to a HTTP (non-TLS) server across the VPN for updates, which responds and provides any available updates. The programmer-side (client) service responsible for this HTTP request does not check to ensure it is still connected to the VPN before making the HTTP request. Thus, an attacker could cause the VPN connection to terminate (through various methods and attack points) and intercept the HTTP request, responding with malicious updates via a man-in-the-middle attack. The affected products do not verify the origin or integrity of these updates, as it insufficiently relied on the security of the VPN. An attacker with remote network access to the programmer could influence these communications.
CVSS Score: 7.1 (HIGH)
CWE: CWE-923, CWE-200
References: https://global.medtronic.com/xg-en/product-security/security-bulletins/carelink-2090-29901.html; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-058-01; https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-01
CVE: CVE-2018-1080
Published: 2018-07-03
Description: Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/errata/RHSA-2018:1979; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1080; https://pagure.io/freeipa/issue/7453
CVE: CVE-2018-10855
Published: 2018-07-03
Description: Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://access.redhat.com/errata/RHBA-2018:3788; https://access.redhat.com/errata/RHSA-2018:1948; https://access.redhat.com/errata/RHSA-2018:1949
CVE: CVE-2018-10856
Published: 2018-07-03
Description: It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-250, CWE-732
References: https://access.redhat.com/errata/RHSA-2018:2037; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856; https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24
CVE: CVE-2018-1113
Published: 2018-07-03
Description: setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-285, CWE-732
References: https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3249; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1113
CVE: CVE-2018-13068
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for AzurionToken (AZU), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/AzurionToken/AzurionToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/AzurionToken/AzurionToken.md
CVE: CVE-2018-13069
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for DYchain (DYC), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/DYC/DYC.md; https://github.com/VenusADLab/EtherTokens/blob/master/DYC/DYC.md
CVE: CVE-2018-13070
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for EncryptedToken (ECC), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/EncryptedToken/EncryptedToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/EncryptedToken/EncryptedToken.md
CVE: CVE-2018-13071
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for CCindex10 (T10), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/CCindexToken/CCindexToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/CCindexToken/CCindexToken.md
CVE: CVE-2018-13072
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Coffeecoin (COFFEE), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/Coffeecoin/Coffeecoin.md; https://github.com/VenusADLab/EtherTokens/blob/master/Coffeecoin/Coffeecoin.md
CVE: CVE-2018-13073
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for ETHEREUMBLACK (ETCBK), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/ETHEREUMBLACK/ETHEREUMBLACK.md; https://github.com/VenusADLab/EtherTokens/blob/master/ETHEREUMBLACK/ETHEREUMBLACK.md
CVE: CVE-2018-13074
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for FIBToken (FIB), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/FIBToken/FIBToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/FIBToken/FIBToken.md
CVE: CVE-2018-13075
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Carbon Exchange Coin Token (CEC), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/CarbonExchangeCoinToken/CarbonExchangeCoinToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/CarbonExchangeCoinToken/CarbonExchangeCoinToken.md
CVE: CVE-2018-13076
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Betcash (BC), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/Betcash/Betcash.md; https://github.com/VenusADLab/EtherTokens/blob/master/Betcash/Betcash.md
CVE: CVE-2018-13077
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for CTB, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/CTB/CTB.md; https://github.com/VenusADLab/EtherTokens/blob/master/CTB/CTB.md
CVE: CVE-2018-13078
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Jitech (JTH), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/Jitech/Jitech.md; https://github.com/VenusADLab/EtherTokens/blob/master/Jitech/Jitech.md
CVE: CVE-2018-13079
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for GoodTo (GTO), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/GoodTo/GoodTo.md; https://github.com/VenusADLab/EtherTokens/blob/master/GoodTo/GoodTo.md
CVE: CVE-2018-13080
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Goutex (GTX), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/Goutex/Goutex.md; https://github.com/VenusADLab/EtherTokens/blob/master/Goutex/Goutex.md
CVE: CVE-2018-13081
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for GZS Token (GZS), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/GZSToken/GZSToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/GZSToken/GZSToken.md
CVE: CVE-2018-13082
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for MODI Token (MODI), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/ModiTokenERC20/ModiTokenERC20.md; https://github.com/VenusADLab/EtherTokens/blob/master/ModiTokenERC20/ModiTokenERC20.md
CVE: CVE-2018-13083
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Plaza Token (PLAZA), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/PlazaToken/PlazaToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/PlazaToken/PlazaToken.md
CVE: CVE-2018-13084
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Good Time Coin (GTY), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/GoodTimeCoin/GoodTimeCoin.md; https://github.com/VenusADLab/EtherTokens/blob/master/GoodTimeCoin/GoodTimeCoin.md
CVE: CVE-2018-13085
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for FreeCoin (FREE), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/FreeCoin/FreeCoin.md; https://github.com/VenusADLab/EtherTokens/blob/master/FreeCoin/FreeCoin.md
CVE: CVE-2018-13086
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for IADOWR Coin (IAD), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/IADOWR/IADOWR.md; https://github.com/VenusADLab/EtherTokens/blob/master/IADOWR/IADOWR.md