deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-8493
Published: 2018-10-10
Description: An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information Disclosure Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/105456; http://www.securitytracker.com/id/1041843; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8493
CVE: CVE-2018-8494
Published: 2018-10-10
Description: A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/105457; http://www.securitytracker.com/id/1041844; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8494
CVE: CVE-2018-8495
Published: 2018-10-10
Description: A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/105461; https://leucosite.com/Microsoft-Edge-RCE/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8495
CVE: CVE-2018-8497
Published: 2018-10-10
Description: An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/105478; http://www.securitytracker.com/id/1041828; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8497
CVE: CVE-2018-8498
Published: 2018-10-10
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480, CVE-2018-8488, CVE-2018-8518.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105495; http://www.securitytracker.com/id/1041835; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8498
CVE: CVE-2018-8500
Published: 2018-10-10
Description: A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105463; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8500; http://www.securityfocus.com/bid/105463
CVE: CVE-2018-8501
Published: 2018-10-10
Description: A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protected View, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Office 365 ProPlus, PowerPoint Viewer, Microsoft Office, Microsoft PowerPoint.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/105497; http://www.securitytracker.com/id/1041838; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8501
CVE: CVE-2018-8502
Published: 2018-10-10
Description: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/105498; http://www.securitytracker.com/id/1041839; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8502
CVE: CVE-2018-8503
Published: 2018-10-10
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8505, CVE-2018-8510, CVE-2018-8511, CVE-2018-8513.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105464; http://www.securitytracker.com/id/1041825; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8503
CVE: CVE-2018-8504
Published: 2018-10-10
Description: A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View, aka "Microsoft Word Remote Code Execution Vulnerability." This affects Microsoft SharePoint Server, Office 365 ProPlus, Microsoft Office, Microsoft Word.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/105499; http://www.securitytracker.com/id/1041840; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8504
CVE: CVE-2018-8505
Published: 2018-10-10
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8510, CVE-2018-8511, CVE-2018-8513.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105468; http://www.securitytracker.com/id/1041825; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8505
CVE: CVE-2018-8506
Published: 2018-10-10
Description: An Information Disclosure vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka "Microsoft Windows Codecs Library Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/105466; http://www.securitytracker.com/id/1041833; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8506
CVE: CVE-2018-8509
Published: 2018-10-10
Description: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8473.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105462; http://www.securitytracker.com/id/1041825; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8509
CVE: CVE-2018-8510
Published: 2018-10-10
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8505, CVE-2018-8511, CVE-2018-8513.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105470; http://www.securitytracker.com/id/1041825; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8510
CVE: CVE-2018-8511
Published: 2018-10-10
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8505, CVE-2018-8510, CVE-2018-8513.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105471; http://www.securitytracker.com/id/1041825; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8511
CVE: CVE-2018-8512
Published: 2018-10-10
Description: A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8530.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105486; http://www.securitytracker.com/id/1041825; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8512
CVE: CVE-2018-8513
Published: 2018-10-10
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8505, CVE-2018-8510, CVE-2018-8511.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105473; http://www.securitytracker.com/id/1041825; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8513
CVE: CVE-2018-8518
Published: 2018-10-10
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480, CVE-2018-8488, CVE-2018-8498.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105496; http://www.securitytracker.com/id/1041835; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8518
CVE: CVE-2018-8527
Published: 2018-10-10
Description: An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8532, CVE-2018-8533.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/105474; http://www.securitytracker.com/id/1041826; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8527
CVE: CVE-2018-8530
Published: 2018-10-10
Description: A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypass Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8512.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/105487; http://www.securitytracker.com/id/1041825; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8530
CVE: CVE-2018-8531
Published: 2018-10-10
Description: A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka "Azure IoT Device Client SDK Memory Corruption Vulnerability." This affects Hub Device Client SDK, Azure IoT Edge.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105472; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8531; http://www.securityfocus.com/bid/105472
CVE: CVE-2018-8532
Published: 2018-10-10
Description: An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8527, CVE-2018-8533.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/105475; http://www.securitytracker.com/id/1041826; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8532
CVE: CVE-2018-8533
Published: 2018-10-10
Description: An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8527, CVE-2018-8532.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/105476; http://www.securitytracker.com/id/1041826; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8533
CVE: CVE-2018-12131
Published: 2018-10-10
Description: Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an authenticated user to potentially escalate privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00154.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00154.html
CVE: CVE-2018-15311
Published: 2018-10-10
Description: When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (LRO) feature enabled, TMM may crash, leading to a failover event. This vulnerability is not exposed unless LRO is enabled, so most affected customers will be on 13.1.x. LRO has been available since 11.4.0 but is not enabled by default until 13.1.0.
CVSS Score: 5.9 (MEDIUM)
References: https://support.f5.com/csp/article/K07550539; https://support.f5.com/csp/article/K07550539
CVE: CVE-2018-8006
Published: 2018-10-10
Description: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://activemq.apache.org/security-advisories.data/CVE-2018-8006-announcement.txt; http://www.securityfocus.com/bid/105156; https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1%40%3Cdev.activemq.apache.org%3E
CVE: CVE-2018-17915
Published: 2018-10-10
Description: All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or impersonate the update server with malicious update code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-311, CWE-311
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06; https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06
CVE: CVE-2018-17917
Published: 2018-10-10
Description: All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attacker can discover and connect to valid devices using one of the supported apps.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-341, CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06; https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06
CVE: CVE-2018-17919
Published: 2018-10-10
Description: All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-912, CWE-798
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06; https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06
CVE: CVE-2018-18207
Published: 2018-10-10
Description: Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://0day.today/exploit/description/31282; https://0day.today/exploit/description/31282
CVE: CVE-2018-18208
Published: 2018-10-10
Description: Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://0day.today/exploit/description/31282; https://0day.today/exploit/description/31282
CVE: CVE-2018-18209
Published: 2018-10-10
Description: XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_type parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chekun/DiliCMS/issues/59; https://github.com/chekun/DiliCMS/issues/59
CVE: CVE-2018-18210
Published: 2018-10-10
Description: XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_url parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chekun/DiliCMS/issues/59; https://github.com/chekun/DiliCMS/issues/59
CVE: CVE-2018-18211
Published: 2018-10-10
Description: PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/Pbootcms/Pbootcms/issues/1; https://github.com/Pbootcms/Pbootcms/issues/1
CVE: CVE-2018-13800
Published: 2018-10-10
Description: A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions < V4.2.3). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who must be authenticated to the web interface. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. This could allow the attacker to read or modify parts of the device configuration.
CVSS Score: 7.3 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/105542; https://cert-portal.siemens.com/productcert/pdf/ssa-507847.pdf; http://www.securityfocus.com/bid/105542
CVE: CVE-2018-13801
Published: 2018-10-10
Description: A vulnerability has been identified in ROX II (All versions < V2.12.1). An attacker with network access to port 22/tcp and valid low-privileged user credentials for the target device could perform a privilege escalation and gain root privileges. Successful exploitation requires user privileges of a low-privileged user but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-269
References: http://www.securityfocus.com/bid/105545; https://cert-portal.siemens.com/productcert/pdf/ssa-493830.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-18-282-03
CVE: CVE-2018-13802
Published: 2018-10-10
Description: A vulnerability has been identified in ROX II (All versions < V2.12.1). An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network access to the SSH interface in on port 22/tcp. The attacker must be authenticated to exploit the vulnerability. The vulnerability could allow an attacker to execute arbitrary code on the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264, CWE-269
References: http://www.securityfocus.com/bid/105545; https://cert-portal.siemens.com/productcert/pdf/ssa-493830.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-18-282-03
CVE: CVE-2018-13805
Published: 2018-10-10
Description: A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software Controller (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 incl. F (All versions >= V2.0 and < V2.5). An attacker can cause a denial-of-service condition on the network stack by sending a large number of specially crafted packets to the PLC. The PLC will lose its ability to communicate over the network. This vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no privileges and no user interaction. An attacker could use this vulnerability to compromise availability of the network connectivity. At the time of advisory publication no public exploitation of this vulnerability was known.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-347726.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-347726.pdf
CVE: CVE-2018-17925
Published: 2018-10-10
Description: Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft. Only the independent use of the Gigasoft charting package outside the iFIX product may expose users to the reported vulnerability. The reported method shown to impact Internet Explorer is not exposed in the iFIX product, nor is the core functionality of the iFIX product known to be impacted.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-623
References: http://www.securityfocus.com/bid/105540; https://ics-cert.us-cert.gov/advisories/ICSA-18-282-01; http://www.securityfocus.com/bid/105540
CVE: CVE-2018-0043
Published: 2018-10-10
Description: Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuously sending specific MPLS packets, an attacker can repeatedly crash the RPD process causing a sustained Denial of Service. This issue affects both IPv4 and IPv6. This issue can only be exploited from within the MPLS domain. End-users connected to the CE device cannot cause this crash. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on QFX/EX Series; 14.1X53 versions prior to 14.1X53-D130 on QFabric Series; 15.1F6 versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9 15.1R7; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D471 15.1X53-D490 on NFX Series; 16.1 versions prior to 16.1R3-S8 16.1R4-S8 16.1R5-S4 16.1R6-S4 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R1-S6 16.2R3; 17.1 versions prior to 17.1R1-S7 17.1R2-S6 17.1R3; 17.2 versions prior to 17.2R1-S6 17.2R2-S3 17.2R3; 17.2X75 versions prior to 17.2X75-D100 17.2X75-D42 17.2X75-D91; 17.3 versions prior to 17.3R1-S4 17.3R2-S2 17.3R3; 17.4 versions prior to 17.4R1-S3 17.4R2 . No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1041847; https://kb.juniper.net/JSA10877; http://www.securitytracker.com/id/1041847
CVE: CVE-2018-0044
Published: 2018-10-10
Description: An insecure SSHD configuration in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices may allow remote unauthenticated access if any of the passwords on the system are empty. The affected SSHD configuration has the PermitEmptyPasswords option set to "yes". Affected releases are Juniper Networks Junos OS: 18.1 versions prior to 18.1R4 on NFX Series.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/105565; https://kb.juniper.net/JSA10878; http://www.securityfocus.com/bid/105565