deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-1507
Published: 2018-06-27
Description: IBM DOORS Next Generation (DNG/RRC) 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141415.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22016861; http://www.securityfocus.com/bid/104581; https://exchange.xforce.ibmcloud.com/vulnerabilities/141415
CVE: CVE-2018-1543
Published: 2018-06-27
Description: IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142598.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.ibm.com/support/docview.wss?uid=swg22016346; https://exchange.xforce.ibmcloud.com/vulnerabilities/142598; http://www.ibm.com/support/docview.wss?uid=swg22016346
CVE: CVE-2018-1553
Published: 2018-06-27
Description: IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions by the SAML Web SSO feature. IBM X-Force ID: 142890.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22016218; http://www.securityfocus.com/bid/104585; https://exchange.xforce.ibmcloud.com/vulnerabilities/142890
CVE: CVE-2017-16718
Published: 2018-06-27
Description: Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured routes, that can be edited remotely via ADS. This special command supports encrypted authentication with username/password. The encryption uses a fixed key, that could be extracted by an attacker. Precondition of the exploitation of this weakness is network access at the moment a route is added.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522, CWE-327
References: https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2017-002.pdf; https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2017-002.pdf
CVE: CVE-2017-16726
Published: 2018-06-27
Description: Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve security purposes and therefore does not include any encryption algorithms because of their negative effect on performance and throughput. An attacker can forge arbitrary ADS packets when legitimate ADS traffic is observable.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285, CWE-326
References: https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2017-001.pdf; https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2017-001.pdf
CVE: CVE-2018-1354
Published: 2018-06-27
Description: An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regular user edit the avatar picture of other users with arbitrary content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/104537; http://www.securitytracker.com/id/1041182; http://www.securitytracker.com/id/1041183
CVE: CVE-2018-1355
Published: 2018-06-27
Description: An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during converting a HTML table to a PDF document under the FortiView feature.  An attacker may be able to social engineer an authenticated user into generating a PDF file containing injected malicious URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/104546; http://www.securitytracker.com/id/1041184; http://www.securitytracker.com/id/1041185
CVE: CVE-2018-5527
Published: 2018-06-27
Description: On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel (tmm) to leak memory. As a result, system memory usage increases over time, which may eventually cause a decrease in performance or a system reboot due to memory exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securitytracker.com/id/1041196; https://support.f5.com/csp/article/K20134942; http://www.securitytracker.com/id/1041196
CVE: CVE-2018-5528
Published: 2018-06-27
Description: Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1041197; https://support.f5.com/csp/article/K27044729; http://www.securitytracker.com/id/1041197
CVE: CVE-2018-12920
Published: 2018-06-28
Description: Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#datadelivery URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.seebug.org/vuldb/ssvid-97370; https://www.seebug.org/vuldb/ssvid-97370
CVE: CVE-2018-12921
Published: 2018-06-28
Description: Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meter_information.htm, diag_system.htm, or diag_dnp_lan_wan.htm URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.seebug.org/vuldb/ssvid-97371; https://www.seebug.org/vuldb/ssvid-97371
CVE: CVE-2018-12922
Published: 2018-06-28
Description: Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/configTelnet.htm URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://www.seebug.org/vuldb/ssvid-97372; https://www.seebug.org/vuldb/ssvid-97372
CVE: CVE-2018-12923
Published: 2018-06-28
Description: BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.seebug.org/vuldb/ssvid-97373; https://www.seebug.org/vuldb/ssvid-97373
CVE: CVE-2018-12924
Published: 2018-06-28
Description: Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.seebug.org/vuldb/ssvid-97374; https://www.seebug.org/vuldb/ssvid-97374
CVE: CVE-2018-12925
Published: 2018-06-28
Description: Baseon Lantronix MSS devices do not require a password for TELNET access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://www.seebug.org/vuldb/ssvid-97375; https://www.seebug.org/vuldb/ssvid-97375
CVE: CVE-2018-12926
Published: 2018-06-28
Description: Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.seebug.org/vuldb/ssvid-97376; https://www.seebug.org/vuldb/ssvid-97376
CVE: CVE-2018-12927
Published: 2018-06-28
Description: Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.seebug.org/vuldb/ssvid-97377; https://www.seebug.org/vuldb/ssvid-97377
CVE: CVE-2017-16859
Published: 2018-06-28
Description: The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/104578; https://jira.atlassian.com/browse/CRUC-8212; https://jira.atlassian.com/browse/FE-7061
CVE: CVE-2018-11510
Published: 2018-06-28
Description: The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html; https://github.com/mefulton/CVE-2018-11510; https://github.com/mefulton/CVE-2018-11510/blob/master/admex.py
CVE: CVE-2018-12589
Published: 2018-06-28
Description: Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://packetstormsecurity.com/files/148312/Polaris-Office-2017-8.1-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/44985/; http://packetstormsecurity.com/files/148312/Polaris-Office-2017-8.1-Remote-Code-Execution.html
CVE: CVE-2018-12928
Published: 2018-06-28
Description: In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesystem.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/104593; https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763384; https://marc.info/?l=linux-fsdevel&m=[PII_REDACTED]5766&w=2
CVE: CVE-2018-12929
Published: 2018-06-28
Description: ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://www.securityfocus.com/bid/104588; https://access.redhat.com/errata/RHSA-2019:0641; https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403
CVE: CVE-2018-12930
Published: 2018-06-28
Description: ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104588; https://access.redhat.com/errata/RHSA-2019:0641; https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403
CVE: CVE-2018-12931
Published: 2018-06-28
Description: ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104588; https://access.redhat.com/errata/RHSA-2019:0641; https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403
CVE: CVE-2018-12932
Published: 2018-06-28
Description: PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by triggering a large pAlphaBlend->cbBitsSrc value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719; https://bugs.winehq.org/attachment.cgi?id=61284; https://bugs.winehq.org/show_bug.cgi?id=45105
CVE: CVE-2018-12933
Published: 2018-06-28
Description: PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact because the attacker controls the pCreatePen->ihPen array index.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719; https://bugs.winehq.org/attachment.cgi?id=61285; https://bugs.winehq.org/show_bug.cgi?id=45106
CVE: CVE-2018-12934
Published: 2018-06-28
Description: remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763101; https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85453; https://sourceware.org/bugzilla/show_bug.cgi?id=23059
CVE: CVE-2018-1351
Published: 2018-06-28
Description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed remote devices CLI commands by viewing the remote device CLI config installation log.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104533; http://www.securitytracker.com/id/1041181; https://fortiguard.com/advisory/FG-IR-18-006
CVE: CVE-2018-8016
Published: 2018-06-28
Description: The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066%40%3Cuser.cassandra.apache.org%3E; https://lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066%40%3Cuser.cassandra.apache.org%3E
CVE: CVE-2018-12938
Published: 2018-06-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-17833.  Reason: This candidate is a duplicate of CVE-2017-17833.  Notes: All CVE users should reference CVE-2017-17833 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-12971
Published: 2018-06-29
Description: EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/teameasy/EasyCMS/issues/3; https://github.com/teameasy/EasyCMS/issues/3
CVE: CVE-2018-12972
Published: 2018-06-29
Description: An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/OpenTSDB/opentsdb/issues/1239; https://github.com/OpenTSDB/opentsdb/issues/1239
CVE: CVE-2018-12973
Published: 2018-06-29
Description: An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/OpenTSDB/opentsdb/issues/1240; https://github.com/OpenTSDB/opentsdb/issues/1240
CVE: CVE-2018-12982
Published: 2018-06-29
Description: Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1595689; https://bugzilla.redhat.com/show_bug.cgi?id=1595689
CVE: CVE-2018-12983
Published: 2018-06-29
Description: A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a denial-of-service via a crafted pdf file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1595693; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEJQUDZT4JRJSPZYY3UPSCTFPAC5TUHK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMEMSUUXA3SL3AZAKKCTZFXVPHTBBK3O/
CVE: CVE-2018-12984
Published: 2018-06-29
Description: Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.exploit-db.com/exploits/44954/; https://www.exploit-db.com/exploits/44954/
CVE: CVE-2018-12988
Published: 2018-06-29
Description: GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/GreenCMS/GreenCMS/issues/111; https://github.com/GreenCMS/GreenCMS/issues/111
CVE: CVE-2018-12992
Published: 2018-06-29
Description: An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/lzlzh2016/MaeloStore/blob/master/ccXSS.md; https://github.com/lzlzh2016/MaeloStore/blob/master/ccXSS.md
CVE: CVE-2018-12993
Published: 2018-06-29
Description: onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/rocktronica/OneFileCMS/issues/6; https://github.com/rocktronica/OneFileCMS/issues/6
CVE: CVE-2018-12994
Published: 2018-06-29
Description: onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/rocktronica/OneFileCMS/issues/7; https://github.com/rocktronica/OneFileCMS/issues/7
CVE: CVE-2018-12995
Published: 2018-06-29
Description: onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/rocktronica/OneFileCMS/issues/8; https://github.com/rocktronica/OneFileCMS/issues/8
CVE: CVE-2018-12996
Published: 2018-06-29
Description: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html; http://seclists.org/fulldisclosure/2018/Jul/71; http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-038
CVE: CVE-2018-12997
Published: 2018-06-29
Description: Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html; http://seclists.org/fulldisclosure/2018/Jul/73; http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-037
CVE: CVE-2018-12998
Published: 2018-06-29
Description: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html; http://seclists.org/fulldisclosure/2018/Jul/75; http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-036
CVE: CVE-2018-12999
Published: 2018-06-29
Description: Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html; http://seclists.org/fulldisclosure/2018/Jul/74; http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-035
CVE: CVE-2018-13000
Published: 2018-06-29
Description: An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2123; https://www.vulnerability-lab.com/get_content.php?id=2123
CVE: CVE-2018-13001
Published: 2018-06-29
Description: An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability is non-persistent and the request method to inject/execute is GET with the path, search, rename, or dir parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2122; https://www.vulnerability-lab.com/get_content.php?id=2122
CVE: CVE-2018-13002
Published: 2018-06-29
Description: An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2121; https://www.vulnerability-lab.com/get_content.php?id=2121
CVE: CVE-2018-13003
Published: 2018-06-29
Description: An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/OpenTSDB/opentsdb/issues/1241; https://github.com/OpenTSDB/opentsdb/issues/1241
CVE: CVE-2018-13005
Published: 2018-06-29
Description: An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/gpac/gpac/issues/1088; https://lists.debian.org/debian-lts-announce/2018/07/msg00024.html; https://usn.ubuntu.com/3926-1/