deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-20392
Published: 2018-12-23
Description: S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20393
Published: 2018-12-23
Description: Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712[PII_REDACTED]-TRU, CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC, DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a, TC7110.AR STD3.38.03, TC7110.B STC8.62.02, TC7110.D STDB.79.02, TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT, and TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20394
Published: 2018-12-23
Description: Thomson DWG849 STC0.01.16, DWG850-4 ST9C.05.25, DWG855 ST80.20.26, and TWG870 STB2.01.36 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20395
Published: 2018-12-23
Description: NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20396
Published: 2018-12-23
Description: NET&SYS MNG2120J 5.76.1006c and MNG6300 5.83.6305jrc2 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20397
Published: 2018-12-23
Description: mplus CBC383Z CBC383Z_mplus_MDr026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20398
Published: 2018-12-23
Description: Skyworth CM5100 V1.1.0, CM5100-440 V1.2.1, CM5100-511 4.1.0.14, CM5100-GHD00 V1.2.2, and CM5100.g2 4.1.0.17 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20399
Published: 2018-12-23
Description: Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://www.securityfocus.com/bid/106320; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
CVE: CVE-2018-20400
Published: 2018-12-23
Description: Ubee DVW2108 6.28.1017 and DVW2110 6.28.2012 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20401
Published: 2018-12-23
Description: Zoom 5352 v5.5.8.6Y devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv; https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html; https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
CVE: CVE-2018-20402
Published: 2018-12-23
Description: Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. The passwords to the three accounts are the same as the usernames, which are guest, user, and author. Logging in with these accounts will grant any user the default privilege roles that were also created for each of the accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1188
References: http://docs.safe.com/fme/html/FME_Server_Documentation/Content/AdminGuide/Default_User_Accounts_and_Passwords.htm; http://docs.safe.com/fme/html/FME_Server_Documentation/Content/AdminGuide/Default_User_Accounts_and_Passwords.htm
CVE: CVE-2018-20405
Published: 2018-12-23
Description: BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reasoning: "The issue reported requires full developer level access to the content management system where cross site scripting is not an issue -- you already have full control of the CMS including running arbitrary PHP.
CVSS Score: 2.7 (LOW)
CWE: CWE-639, CWE-639
References: https://github.com/bigtreecms/BigTree-CMS/issues/354; https://github.com/bigtreecms/BigTree-CMS/issues/354
CVE: CVE-2018-20406
Published: 2018-12-23
Description: Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; https://access.redhat.com/errata/RHSA-2019:3725; https://bugs.python.org/issue34656
CVE: CVE-2018-20407
Published: 2018-12-23
Description: An issue was discovered in Bento4 1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42hls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/axiomatic-systems/Bento4/issues/343; https://github.com/axiomatic-systems/Bento4/issues/343
CVE: CVE-2018-20408
Published: 2018-12-23
Description: An issue was discovered in Bento4 1.5.1-627. There is a memory leak in AP4_StdcFileByteStream::Create in System/StdC/Ap4StdCFileByteStream.cpp, as demonstrated by mp42hls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/axiomatic-systems/Bento4/issues/343; https://github.com/axiomatic-systems/Bento4/issues/343
CVE: CVE-2018-20409
Published: 2018-12-23
Description: An issue was discovered in Bento4 1.5.1-627. There is a heap-based buffer over-read in AP4_AvccAtom::Create in Core/Ap4AvccAtom.cpp, as demonstrated by mp42hls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/345; https://github.com/axiomatic-systems/Bento4/issues/345
CVE: CVE-2018-20410
Published: 2018-12-24
Description: WellinTech KingSCADA before 3.7.0.0.1 contains a stack-based buffer overflow. The vulnerability is triggered when sending a specially crafted packet to the AlarmServer (AEserver.exe) service listening on TCP port 12401.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/flypuma/vul/blob/master/kingview/copy_argumengt_overflow/Debugging.md; https://github.com/flypuma/vul/blob/master/kingview/copy_argumengt_overflow/poc.py; https://github.com/flypuma/vul/blob/master/kingview/copy_argumengt_overflow/Debugging.md
CVE: CVE-2018-20419
Published: 2018-12-24
Description: DouCo DouPHP 1.5 has upload/admin/manager.php?rec=insert CSRF to add an administrator account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Jxysir/Douphpcms/blob/master/POC; https://github.com/Jxysir/Douphpcms/blob/master/POC
CVE: CVE-2018-20420
Published: 2018-12-24
Description: In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://github.com/eddietcc/CVEnotes/blob/master/webERP_4.15_Z_CreateCompanyTemplateFile/README.md; https://github.com/eddietcc/CVEnotes/blob/master/webERP_4.15_Z_CreateCompanyTemplateFile/README.md
CVE: CVE-2018-20421
Published: 2018-12-24
Description: Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly { mstore }" followed by a "c[0xC800000] = 0xFF" assignment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/ethereum/go-ethereum/issues/18289; https://github.com/ethereum/go-ethereum/issues/18289
CVE: CVE-2018-20418
Published: 2018-12-24
Description: index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md; https://github.com/rdincel1/Craft-CMS-3.0.25---Cross-Site-Scripting; https://www.exploit-db.com/exploits/46054/
CVE: CVE-2018-20422
Published: 2018-12-24
Description: Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common_member_wechatmp to gain login access to an account via a plugin.php ac=wxregister request (the attacker does not have control over which account will be accessed).
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI; https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI
CVE: CVE-2018-20423
Published: 2018-12-24
Description: Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a non-existing wxopenid value to the plugin.php ac=wxregister query string.
CVSS Score: 8.1 (HIGH)
References: https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI; https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI
CVE: CVE-2018-20424
Published: 2018-12-24
Description: Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data structure via an ac=unbindmp request to plugin.php.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI; https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IPRUI
CVE: CVE-2018-20425
Published: 2018-12-24
Description: libming 0.4.8 has a NULL pointer dereference in the pushdup function of the decompile.c file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/libming/libming/issues/163; https://github.com/libming/libming/issues/163
CVE: CVE-2018-20426
Published: 2018-12-24
Description: libming 0.4.8 has a NULL pointer dereference in the newVar3 function of the decompile.c file, a different vulnerability than CVE-2018-7866.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/libming/libming/issues/162; https://github.com/libming/libming/issues/162
CVE: CVE-2018-20427
Published: 2018-12-24
Description: libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file, a different vulnerability than CVE-2018-9132.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/libming/libming/issues/164; https://github.com/libming/libming/issues/164
CVE: CVE-2018-20428
Published: 2018-12-24
Description: libming 0.4.8 has a NULL pointer dereference in the strlenext function of the decompile.c file, a different vulnerability than CVE-2018-7874.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/libming/libming/issues/161; https://github.com/libming/libming/issues/161
CVE: CVE-2018-20429
Published: 2018-12-24
Description: libming 0.4.8 has a NULL pointer dereference in the getName function of the decompile.c file, a different vulnerability than CVE-2018-7872 and CVE-2018-9165.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/libming/libming/issues/160; https://github.com/libming/libming/issues/160
CVE: CVE-2018-20430
Published: 2018-12-24
Description: GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_extractor.c, related to EXTRACTOR_common_convert_to_utf8 in common/convert.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106300; https://gnunet.org/bugs/view.php?id=5493; https://gnunet.org/git/libextractor.git/commit/?id=b405d707b36e0654900cba78e89f49779efea110
CVE: CVE-2018-20431
Published: 2018-12-24
Description: GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins/ole2_extractor.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/106300; https://gnunet.org/bugs/view.php?id=5494; https://gnunet.org/git/libextractor.git/commit/?id=489c4a540bb2c[PII_REDACTED]425b8932b97a153e7
CVE: CVE-2018-19357
Published: 2018-12-24
Description: XMPlay 3.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted http:// URL in a .m3u file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exploit-db.com/exploits/46020/; https://exploit-db.com/exploits/46020/
CVE: CVE-2018-20433
Published: 2018-12-24
Description: c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b; https://lists.debian.org/debian-lts-announce/2018/12/msg00021.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/
CVE: CVE-2018-15465
Published: 2018-12-24
Description: A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of user privileges when using the web management interface. An attacker could exploit this vulnerability by sending specific HTTP requests via HTTPS to an affected device as an unprivileged user. An exploit could allow the attacker to retrieve files (including the running configuration) from the device or to upload and replace software images on the device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285, CWE-863
References: http://www.securityfocus.com/bid/106256; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181219-asa-privesc; https://www.tenable.com/security/research/tra-2018-46
CVE: CVE-2018-17197
Published: 2018-12-24
Description: A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/106293; https://lists.apache.org/thread.html/7c021a4ea2037e52e74628e17e8e0e2acab1f447160edc8be0eae6d3%40%3Cdev.tika.apache.org%3E; https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
CVE: CVE-2018-8918
Published: 2018-12-24
Description: Cross-site scripting (XSS) vulnerability in info.cgi in Synology Router Manager (SRM) before 1.1.7-6941 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/security/advisory/Synology_SA_18_25; https://www.synology.com/security/advisory/Synology_SA_18_25
CVE: CVE-2018-8917
Published: 2018-12-24
Description: Cross-site scripting (XSS) vulnerability in info.cgi in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/security/advisory/Synology_SA_18_14; https://www.synology.com/security/advisory/Synology_SA_18_14
CVE: CVE-2018-8919
Published: 2018-12-24
Description: Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-200, CWE-200
References: https://www.synology.com/security/advisory/Synology_SA_18_14; https://www.synology.com/security/advisory/Synology_SA_18_14
CVE: CVE-2018-8920
Published: 2018-12-24
Description: Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format.
CVSS Score: 7.2 (HIGH)
CWE: CWE-116, CWE-116
References: https://www.synology.com/security/advisory/Synology_SA_18_14; https://www.synology.com/security/advisory/Synology_SA_18_14
CVE: CVE-2018-7793
Published: 2018-12-24
Description: A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core Services 9.4 (CCS 9.4) and FoxView 10.5.) which could cause unauthorized disclosure, modification, or disruption in service when the password is modified without permission.
CVSS Score: 8.7 (HIGH)
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-353-03/; https://www.schneider-electric.com/en/download/document/SEVD-2018-353-03/
CVE: CVE-2018-7796
Published: 2018-12-24
Description: A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an overflow in the memcpy function, leading to corruption of data and program instability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-351-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-351-01/
CVE: CVE-2018-7800
Published: 2018-12-24
Description: A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/106807; https://ics-cert.us-cert.gov/advisories/ICSA-19-031-01; https://www.schneider-electric.com/en/download/document/SEVD-2018-354-01/
CVE: CVE-2018-7801
Published: 2018-12-24
Description: A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code execution is performed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2021/Jul/32; http://www.securityfocus.com/bid/106807; https://ics-cert.us-cert.gov/advisories/ICSA-19-031-01
CVE: CVE-2018-7802
Published: 2018-12-24
Description: A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/106807; https://ics-cert.us-cert.gov/advisories/ICSA-19-031-01; https://www.schneider-electric.com/en/download/document/SEVD-2018-354-01/
CVE: CVE-2018-7832
Published: 2018-12-24
Description: An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution arbitrary executable when GP-Pro EX is launched.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106441; https://ics-cert.us-cert.gov/advisories/ICSA-19-003-01; https://www.schneider-electric.com/en/download/document/SEVD-2018-354-02/
CVE: CVE-2018-7835
Published: 2018-12-24
Description: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/106484; https://www.schneider-electric.com/en/download/document/SEVD-2018-354-03/; http://www.securityfocus.com/bid/106484
CVE: CVE-2018-7836
Published: 2018-12-24
Description: An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/106484; https://www.schneider-electric.com/en/download/document/SEVD-2018-354-03/; http://www.securityfocus.com/bid/106484
CVE: CVE-2018-7837
Published: 2018-12-24
Description: An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its output and expose restricted information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/106484; https://www.schneider-electric.com/en/download/document/SEVD-2018-354-03/; http://www.securityfocus.com/bid/106484
CVE: CVE-2018-18698
Published: 2018-12-24
Description: An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleartext Wi-Fi passwords in logcat during the process of setting up the phone as a hotspot.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/0x5h1v4m/CVE-ID-s/blob/master/CVE-2018-18698/MI%20A1.txt; https://github.com/0x5h1v4m/CVE-ID-s/blob/master/CVE-2018-18698/MI%20A1.txt