deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-17176
Published: 2018-10-17
Description: The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC00B156, versions earlier before MHA-DL00BC00B156, versions earlier before MHA-TL00BC00B156, versions earlier before LON-AL00BC00B156, versions earlier before LON-CL00BC00B156, versions earlier before LON-DL00BC00B156, versions earlier before LON-TL00BC00B156 has a arbitrary memory read/write vulnerability due to the input parameters validation. An attacker with the root privilege of the Android system could exploit this vulnerability to read and write memory data anywhere or execute arbitrary code in the TrustZone.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170306-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170306-01-smartphone-en
CVE: CVE-2018-7924
Published: 2018-10-17
Description: Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability. Due to improper permission settings for specific commands, attackers who can connect to a mobile phone via the USB interface may exploit this vulnerability to obtain specific device information of the mobile phone.
CVSS Score: 2.4 (LOW)
CWE: CWE-732
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181017-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181017-01-smartphone-en
CVE: CVE-2018-7989
Published: 2018-10-17
Description: Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326(C00) have an improper authentication vulnerability. App Lock is a function to prevent unauthorized use of apps on smartphones, an attacker could directly change the lock password after a series of operations. Successful exploit could allow the attacker to use the application which is locked.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181010-01-applock-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181010-01-applock-en
CVE: CVE-2018-14915
Published: 2018-10-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-14917
Published: 2018-10-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-12813
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105536; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; http://www.securityfocus.com/bid/105536
CVE: CVE-2018-12814
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105536; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; http://www.securityfocus.com/bid/105536
CVE: CVE-2018-12816
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105532; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; http://www.securityfocus.com/bid/105532
CVE: CVE-2018-12818
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105532; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; http://www.securityfocus.com/bid/105532
CVE: CVE-2018-12819
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105532; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; http://www.securityfocus.com/bid/105532
CVE: CVE-2018-12820
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105532; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; http://www.securityfocus.com/bid/105532
CVE: CVE-2018-12821
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105532; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; http://www.securityfocus.com/bid/105532
CVE: CVE-2018-12822
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/105533; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; http://www.securityfocus.com/bid/105533
CVE: CVE-2018-12823
Published: 2018-10-17
Description: Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-27.html
CVE: CVE-2018-15616
Published: 2018-10-17
Description: A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://downloads.avaya.com/css/P8/documents/101052865; https://downloads.avaya.com/css/P8/documents/101052865
CVE: CVE-2018-15969
Published: 2018-10-17
Description: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105576; https://helpx.adobe.com/security/products/experience-manager/apsb18-36.html; http://www.securityfocus.com/bid/105576
CVE: CVE-2018-15970
Published: 2018-10-17
Description: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105574; https://helpx.adobe.com/security/products/experience-manager/apsb18-36.html; http://www.securityfocus.com/bid/105574
CVE: CVE-2018-15971
Published: 2018-10-17
Description: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105575; https://helpx.adobe.com/security/products/experience-manager/apsb18-36.html; http://www.securityfocus.com/bid/105575
CVE: CVE-2018-15972
Published: 2018-10-17
Description: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105577; https://helpx.adobe.com/security/products/experience-manager/apsb18-36.html; http://www.securityfocus.com/bid/105577
CVE: CVE-2018-15973
Published: 2018-10-17
Description: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105578; https://helpx.adobe.com/security/products/experience-manager/apsb18-36.html; http://www.securityfocus.com/bid/105578
CVE: CVE-2018-15974
Published: 2018-10-17
Description: Adobe Framemaker versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/105537; https://helpx.adobe.com/security/products/framemaker/apsb18-37.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/151002
CVE: CVE-2018-15976
Published: 2018-10-17
Description: Adobe Technical Communications Suite versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/105535; http://www.securitytracker.com/id/1041819; http://www.securitytracker.com/id/1041820
CVE: CVE-2018-0388
Published: 2018-10-17
Description: A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/105665; http://www.securitytracker.com/id/1041927; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlan-xss
CVE: CVE-2018-0395
Published: 2018-10-17
Description: A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface on the targeted device. A successful exploit could allow the attacker to cause the switch to reload unexpectedly.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105674; http://www.securitytracker.com/id/1041919; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-fxnx-os-dos
CVE: CVE-2018-0416
Published: 2018-10-17
Description: A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system information that under normal circumstances should be prohibited. The vulnerability is due to incomplete input and validation checking mechanisms in the web-based interface URL request. An attacker could exploit this vulnerability by requesting specific URLs via the web-based interface. A successful exploit could allow the attacker to view sensitive system information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105675; http://www.securitytracker.com/id/1041928; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-id
CVE: CVE-2018-18443
Published: 2018-10-17
Description: OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/IlmThreadPool.cpp, as demonstrated by exrmultiview.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-772
References: https://github.com/openexr/openexr/issues/350; https://github.com/openexr/openexr/releases/tag/v2.4.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5E2OZU4ZSF5W4ODBU4L547HX5A4WOBFV/
CVE: CVE-2018-18444
Published: 2018-10-17
Description: makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possibly unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/openexr/openexr/issues/351; https://github.com/openexr/openexr/releases/tag/v2.4.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5E2OZU4ZSF5W4ODBU4L547HX5A4WOBFV/
CVE: CVE-2018-18445
Published: 2018-10-17
Description: In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b799207e1e1816b09e7a5920fbb2d5fcf6edd681; https://access.redhat.com/errata/RHSA-2019:0512; https://access.redhat.com/errata/RHSA-2019:0514
CVE: CVE-2018-0456
Published: 2018-10-17
Description: A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application of an affected device to restart unexpectedly. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device. A successful exploit could allow the attacker to cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105668; http://www.securitytracker.com/id/1041921; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-nxos-snmp
CVE: CVE-2018-15395
Published: 2018-10-17
Description: A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, adjacent attacker to gain network access to a Cisco TrustSec domain. Under normal circumstances, this access should be prohibited. The vulnerability is due to the dynamic assignment of Security Group Tags (SGTs) during a wireless roam from one Service Set Identifier (SSID) to another within the Cisco TrustSec domain. An attacker could exploit this vulnerability by attempting to acquire an SGT from other SSIDs within the domain. Successful exploitation could allow the attacker to gain privileged network access that should be prohibited under normal circumstances.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/105676; http://www.securitytracker.com/id/1041925; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlan-escalation
CVE: CVE-2018-15402
Published: 2018-10-17
Description: A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a targeted user to follow a URL to a malicious website. An exploit could allow the attacker to take actions within the software with the privileges of the targeted user or gain access to sensitive information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/105662; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-nfvis-csrf; http://www.securityfocus.com/bid/105662
CVE: CVE-2018-18386
Published: 2018-10-17
Description: drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ.
CVSS Score: 3.3 (LOW)
CWE: CWE-704
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=966031f340185eddd05affcf72b740549f056348; https://access.redhat.com/errata/RHSA-2019:0831; https://bugzilla.suse.com/show_bug.cgi?id=1094825
CVE: CVE-2018-0378
Published: 2018-10-17
Description: A vulnerability in the Precision Time Protocol (PTP) feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of protection against PTP frame flood attacks. An attacker could exploit this vulnerability by sending large streams of malicious IPv4 or IPv6 PTP traffic to the affected device. A successful exploit could allow the attacker to cause a DoS condition, impacting the traffic passing through the device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105669; http://www.securitytracker.com/id/1041920; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-nexus-ptp-dos
CVE: CVE-2018-14597
Published: 2018-10-17
Description: CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-200
References: http://www.securityfocus.com/bid/105688; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20181017-01-security-notice-for-ca-identity-governance.html; http://www.securityfocus.com/bid/105688
CVE: CVE-2018-15435
Published: 2018-10-17
Description: A vulnerability in the web-based management interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/105663; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-sm-xss; http://www.securityfocus.com/bid/105663
CVE: CVE-2018-0381
Published: 2018-10-17
Description: A vulnerability in the Cisco Aironet Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a deadlock condition that may occur when an affected AP attempts to dequeue aggregated traffic that is destined to an attacker-controlled wireless client. An attacker who can successfully transition between multiple Service Set Identifiers (SSIDs) hosted on the same AP while replicating the required traffic patterns could trigger the deadlock condition. A watchdog timer that detects the condition will trigger a reload of the device, resulting in a DoS condition while the device restarts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-400, CWE-667
References: http://www.securityfocus.com/bid/105685; http://www.securitytracker.com/id/1041929; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-aironet-dos
CVE: CVE-2018-0417
Published: 2018-10-17
Description: A vulnerability in TACACS authentication with Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to perform certain operations within the GUI that are not normally available to that user on the CLI. The vulnerability is due to incorrect parsing of a specific TACACS attribute received in the TACACS response from the remote TACACS server. An attacker could exploit this vulnerability by authenticating via TACACS to the GUI on the affected device. A successful exploit could allow an attacker to create local user accounts with administrative privileges on an affected WLC and execute other commands that are not allowed from the CLI and should be prohibited.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/105667; http://www.securitytracker.com/id/1041924; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-gui-privesc
CVE: CVE-2018-0420
Published: 2018-10-17
Description: A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive information. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames and pathnames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files on the targeted device, which may contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/105671; http://www.securitytracker.com/id/1041926; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-traversal
CVE: CVE-2018-0441
Published: 2018-10-17
Description: A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by specific roaming events. This corruption will eventually cause a timer crash. An attacker could exploit this vulnerability by sending malicious reassociation events multiple times to the same AP in a short period of time, causing a DoS condition on the affected AP.
CVSS Score: 7.4 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/105680; http://www.securitytracker.com/id/1041918; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-ap-ft-dos