deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-9527
Published: 2018-11-14
Description: In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112159345
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105865; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105865
CVE: CVE-2018-9528
Published: 2018-11-14
Description: In ixheaacd_over_lap_add1_armv8 of ixheaacd_overlap_add1.s there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112551721
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9529
Published: 2018-11-14
Description: In ixheaacd_individual_ch_stream of ixheaacd_channel.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112551874
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9530
Published: 2018-11-14
Description: In ixheaacd_tns_ar_filter_dec of ixheaacd_aac_tns.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112609715
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9531
Published: 2018-11-14
Description: In AudioSpecificConfig_Parse of tpdec_asc.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112661641
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105865; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105865
CVE: CVE-2018-9532
Published: 2018-11-14
Description: In ixheaacd_extract_frame_info_ld of ixheaacd_env_extr.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112765917
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9533
Published: 2018-11-14
Description: In ixheaacd_dec_data_init of ixheaacd_create.c there is a possible out of write read due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112766520
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9534
Published: 2018-11-14
Description: In ixheaacd_mps_getstridemap of ixheaacd_mps_parse.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112857941
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9535
Published: 2018-11-14
Description: In ixheaacd_reset_acelp_data_fix of ixheaacd_lpc.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112858010
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-11-01
CVE: CVE-2018-9536
Published: 2018-11-14
Description: In numerous functions of libFDK, there are possible out of bounds writes due to incorrect bounds checks. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112662184
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105865; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105865
CVE: CVE-2018-9537
Published: 2018-11-14
Description: In CAacDecoder_DecodeFrame of aacdecode.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112891564
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105865; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105865
CVE: CVE-2018-9539
Published: 2018-11-14
Description: In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-113027383
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/105865; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105865
CVE: CVE-2018-9540
Published: 2018-11-14
Description: In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-111450417
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105849; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105849
CVE: CVE-2018-9541
Published: 2018-11-14
Description: In avrc_pars_vendor_rsp of avcr_pars_ct.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-111450531
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105849; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105849
CVE: CVE-2018-9542
Published: 2018-11-14
Description: In avrc_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-111896861
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105849; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105849
CVE: CVE-2018-9543
Published: 2018-11-14
Description: In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset. This could lead to local information disclosure after factory reset with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112868088.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/105849; https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-12-01
CVE: CVE-2018-9544
Published: 2018-11-14
Description: In register_app of btif_hd.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113037220
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105849; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105849
CVE: CVE-2018-9545
Published: 2018-11-14
Description: In BTA_HdRegisterApp of bta_hd_api.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113111784
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105849; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105849
CVE: CVE-2018-9580
Published: 2018-11-14
Description: A Elevation of privilege vulnerability in the HTC bootloader. Product: Android. Versions: Android kernel. Android ID: A-76222002.
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2018-11-01; https://source.android.com/security/bulletin/pixel/2018-11-01
CVE: CVE-2018-5495
Published: 2018-11-14
Description: All StorageGRID Webscale versions are susceptible to a vulnerability which could permit an unauthenticated attacker to communicate with systems on the same network as the StorageGRID Webscale Admin Node via HTTP or to take over services on the Admin Node.
CVSS Score: 9.8 (CRITICAL)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-17960
Published: 2018-11-14
Description: CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109205; https://ckeditor.com/blog/CKEditor-4.11-with-emoji-dropdown-and-auto-link-on-typing-released/; https://ckeditor.com/cke4/release/CKEditor-4.11.0
CVE: CVE-2018-19278
Published: 2018-11-14
Description: Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://downloads.asterisk.org/pub/security/AST-2018-010.html; https://issues.asterisk.org/jira/browse/ASTERISK-28127; https://downloads.asterisk.org/pub/security/AST-2018-010.html
CVE: CVE-2018-19279
Published: 2018-11-14
Description: PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://www.primx.eu/en/security-18a10338/; https://www.primx.eu/en/security-18a10338/
CVE: CVE-2018-19280
Published: 2018-11-14
Description: Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.0.html; https://github.com/centreon/centreon/pull/6626; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.0.html
CVE: CVE-2018-19281
Published: 2018-11-14
Description: Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.0.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.27.html; https://github.com/centreon/centreon/pull/6627
CVE: CVE-2015-9274
Published: 2018-11-15
Description: HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/harfbuzz/harfbuzz/commit/c917965b9e6fe2b21ed6c[PII_REDACTED]8fa3af4b7; https://github.com/harfbuzz/harfbuzz/commit/c917965b9e6fe2b21ed6c[PII_REDACTED]8fa3af4b7
CVE: CVE-2018-19286
Published: 2018-11-15
Description: The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and then creating and sharing a note.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/CCCCCrash/POCs/blob/master/Web/mubu/xss.md; https://github.com/CCCCCrash/POCs/blob/master/Web/mubu/xss.md
CVE: CVE-2018-19287
Published: 2018-11-15
Description: XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/1974335/ninja-forms/trunk/includes/Admin/Menus/Submissions.php; https://wordpress.org/plugins/ninja-forms/#developers; https://www.exploit-db.com/exploits/45880/
CVE: CVE-2018-19288
Published: 2018-11-15
Description: Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105960; https://www.manageengine.com/network-monitoring/help/read-me.html; http://www.securityfocus.com/bid/105960
CVE: CVE-2018-19289
Published: 2018-11-15
Description: An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xCss/Valine/issues/127; https://github.com/xCss/Valine/issues/127
CVE: CVE-2018-19291
Published: 2018-11-15
Description: An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/chekun/DiliCMS/issues/60; https://github.com/chekun/DiliCMS/issues/60
CVE: CVE-2018-12480
Published: 2018-11-15
Description: Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.microfocus.com/kb/doc.php?id=7023513; https://www.netiq.com/documentation/access-manager-44/accessmanager443-release-notes/data/accessmanager443-release-notes.html#b149i4n6; https://support.microfocus.com/kb/doc.php?id=7023513
CVE: CVE-2018-0673
Published: 2018-11-15
Description: Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN12583112/index.html; https://cs.cybozu.co.jp/2018/006717.html; http://jvn.jp/en/jp/JVN12583112/index.html
CVE: CVE-2018-0679
Published: 2018-11-15
Description: Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions) allows attacker with administrator rights to inject arbitrary web script or HTML via the administrative page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN68528150/index.html; https://www.fxc.jp/news/20171228.html; http://jvn.jp/en/jp/JVN68528150/index.html
CVE: CVE-2018-0680
Published: 2018-11-15
Description: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to read/send mail or change the configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://jvn.jp/en/jp/JVN00344155/index.html; https://www.denbun.com/en/imap/support/security/181003.html; https://www.denbun.com/en/pop/support/security/181003.html
CVE: CVE-2018-0681
Published: 2018-11-15
Description: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to login to the Management page and change the configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://jvn.jp/en/jp/JVN00344155/index.html; https://www.denbun.com/en/imap/support/security/181003.html; https://www.denbun.com/en/pop/support/security/181003.html
CVE: CVE-2018-0682
Published: 2018-11-15
Description: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) does not properly manage sessions, which allows remote attackers to read/send mail or change the configuration via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://jvn.jp/en/jp/JVN00344155/index.html; https://www.denbun.com/en/imap/support/security/181003.html; https://www.denbun.com/en/pop/support/security/181003.html
CVE: CVE-2018-0683
Published: 2018-11-15
Description: Buffer overflow in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote attackers to execute arbitrary code or cause a denial-of-service (DoS) condition via Cookie data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN00344155/index.html; https://www.denbun.com/en/imap/support/security/181003.html; https://www.denbun.com/en/pop/support/security/181003.html
CVE: CVE-2018-0684
Published: 2018-11-15
Description: Buffer overflow in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R3.0 and earlier, Denbun IMAP version V3.3I R3.0 and earlier) allows remote attackers to execute arbitrary code or cause a denial-of-service (DoS) condition via multipart/form-data format data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN00344155/index.html; https://www.denbun.com/en/imap/support/security/181003.html; https://www.denbun.com/en/pop/support/security/181003.html
CVE: CVE-2018-0685
Published: 2018-11-15
Description: SQL injection vulnerability in the Denbun POP version V3.3P R4.0 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via HTTP requests for mail search.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN00344155/index.html; https://www.denbun.com/en/imap/support/security/181003.html; https://www.denbun.com/en/pop/support/security/181003.html
CVE: CVE-2018-0686
Published: 2018-11-15
Description: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated attackers to upload and execute any executable files via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://jvn.jp/en/jp/JVN00344155/index.html; https://www.denbun.com/en/imap/support/security/181003.html; https://www.denbun.com/en/pop/support/security/181003.html
CVE: CVE-2018-0687
Published: 2018-11-15
Description: Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN00344155/index.html; https://www.denbun.com/en/imap/support/security/181003.html; https://www.denbun.com/en/pop/support/security/181003.html
CVE: CVE-2018-0690
Published: 2018-11-15
Description: An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to tamper with an update file and inject executable files.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN36623716/index.html; https://musiccenter.sony.net/en/downloads/update.php; http://jvn.jp/en/jp/JVN36623716/index.html
CVE: CVE-2018-0691
Published: 2018-11-15
Description: Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN37288228/index.html; https://www.au.com/information/notice_mobile/service/2018-002/; https://www.nttdocomo.co.jp/info/notice/page/180927_00.html
CVE: CVE-2018-0692
Published: 2018-11-15
Description: Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN77885134/index.html; http://jvn.jp/en/jp/JVN77885134/index.html
CVE: CVE-2018-0693
Published: 2018-11-15
Description: Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in the specific directory in FileZen via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN95355683/index.html; https://www.soliton.co.jp/support/2018/003328.html; http://jvn.jp/en/jp/JVN95355683/index.html
CVE: CVE-2018-0694
Published: 2018-11-15
Description: FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN95355683/index.html; https://www.soliton.co.jp/support/2018/003328.html; http://jvn.jp/en/jp/JVN95355683/index.html
CVE: CVE-2018-0695
Published: 2018-11-15
Description: Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN73794686/index.html; http://www.usvn.info/2018/10/02/usvn-1.0.8; http://jvn.jp/en/jp/JVN73794686/index.html