deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11224
Published: 2018-05-17
Description: An issue was discovered in Libav 12.3. A read access violation in the in_table_init16 function in libavcodec/aacsbr.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.libav.org/show_bug.cgi?id=1129; https://docs.google.com/document/d/16_HC-FjFuBNMbaoR397z_3EwpDP6wb1DNWrfkD4qRDE/edit; https://bugzilla.libav.org/show_bug.cgi?id=1129
CVE: CVE-2018-11225
Published: 2018-05-17
Description: The dcputs function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://docs.google.com/document/d/1gTd44AjxkCNkoDDh28NwiSeLDa5poBYROEoLEG4JVCA/edit; https://github.com/libming/libming/issues/143; https://docs.google.com/document/d/1gTd44AjxkCNkoDDh28NwiSeLDa5poBYROEoLEG4JVCA/edit
CVE: CVE-2018-11226
Published: 2018-05-17
Description: The getString function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://docs.google.com/document/d/1NtI3PiiL55SMj-kmdwJhMViIALGHPnLZYRxOgNCfhYA/edit; https://github.com/libming/libming/issues/144; https://docs.google.com/document/d/1NtI3PiiL55SMj-kmdwJhMViIALGHPnLZYRxOgNCfhYA/edit
CVE: CVE-2018-10027
Published: 2018-05-17
Description: ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installing it in a specific directory: %PROGRAMFILES%\ESTsoft\ALZip\Formats, %PROGRAMFILES%\ESTsoft\ALZip\Coders, %PROGRAMFILES(X86)%\ESTsoft\ALZip\Formats, or %PROGRAMFILES(X86)%\ESTsoft\ALZip\Coders.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://pastebin.com/XHMeS7pQ; https://www.altools.co.kr/Support/Notice_Contents.aspx?idx=1640&page=1&t=2; https://pastebin.com/XHMeS7pQ
CVE: CVE-2018-11230
Published: 2018-05-17
Description: jbig2_add_page in jbig2enc.cc in libjbig2enc.a in jbig2enc 0.29 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://github.com/agl/jbig2enc/issues/61; https://github.com/agl/jbig2enc/issues/61
CVE: CVE-2017-15533
Published: 2018-05-17
Description: Symantec SSL Visibility (SSLV) 3.8.4FC, 3.10 prior to 3.10.4.1, 3.11, and 3.12 prior to 3.12.2.1 are vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. All affected SSLV versions act as weak oracles according the oracle classification used in the ROBOT research paper. A remote attacker, who has captured a pre-recorded SSL session inspected by SSLV, can establish multiple millions of crafted SSL connections to the target and obtain the session keys required to decrypt the pre-recorded SSL session.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: http://www.securityfocus.com/bid/104163; https://www.symantec.com/security-center/network-protection-security-advisories/SA160; http://www.securityfocus.com/bid/104163
CVE: CVE-2017-18268
Published: 2018-05-17
Description: Symantec IntelligenceCenter 3.3 is vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. A remote attacker, who has captured a pre-recorded SSL session inspected by SSLV, can establish large numbers of crafted SSL connections to the target and obtain the session keys required to decrypt the pre-recorded SSL session.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: http://www.securityfocus.com/bid/104164; https://www.symantec.com/security-center/network-protection-security-advisories/SA160; http://www.securityfocus.com/bid/104164
CVE: CVE-2018-11117
Published: 2018-05-17
Description: Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ILIAS-eLearning/ILIAS/commit/ff9bf29858f2dbffe828711a6f8bf37038c00d77; https://www.ilias.de/docu/goto.php?target=st_229; https://github.com/ILIAS-eLearning/ILIAS/commit/ff9bf29858f2dbffe828711a6f8bf37038c00d77
CVE: CVE-2018-11118
Published: 2018-05-17
Description: The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ILIAS-eLearning/ILIAS/commit/6b2217c31b6974788a5c[PII_REDACTED]75687b44bb; https://github.com/ILIAS-eLearning/ILIAS/commit/d0dcad1b1e729f694acd0582bc626c7c8e62b519; https://www.ilias.de/docu/goto.php?target=st_229
CVE: CVE-2018-11119
Published: 2018-05-17
Description: ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/ILIAS-eLearning/ILIAS/commit/01a24cf04fe8dddf1da59ca[PII_REDACTED]73482b6; https://www.ilias.de/docu/goto.php?target=st_229; https://github.com/ILIAS-eLearning/ILIAS/commit/01a24cf04fe8dddf1da59ca[PII_REDACTED]73482b6
CVE: CVE-2018-11120
Published: 2018-05-17
Description: Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ILIAS-eLearning/ILIAS/commit/[PII_REDACTED]eb981976b64fee363cf950603924ed; https://www.ilias.de/docu/goto.php?target=st_229; https://github.com/ILIAS-eLearning/ILIAS/commit/[PII_REDACTED]eb981976b64fee363cf950603924ed
CVE: CVE-2018-7158
Published: 2018-05-17
Description: The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-185
References: https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/; https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/
CVE: CVE-2018-7159
Published: 2018-05-17
Description: The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-115, CWE-20
References: https://access.redhat.com/errata/RHSA-2019:2258; https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/; https://support.f5.com/csp/article/K27228191?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2018-7160
Published: 2018-05-17
Description: The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-350, CWE-290
References: https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/; https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS; https://www.oracle.com//security-alerts/cpujul2021.html
CVE: CVE-2018-10473
Published: 2018-05-17
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D CLOD Base Mesh Continuation structures. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5392.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-383; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10474
Published: 2018-05-17
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Shading objects. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5393.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-384; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10475
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Light Node structures. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5394.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-385; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10476
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Model Node structures. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5395.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-386; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10477
Published: 2018-05-17
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Chain Index objects. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5396.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-387; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10478
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Texture Coord Dimensions objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5397.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-388; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10479
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Key Frame structures. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5399.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-389; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10480
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the U3D Node Name buffer. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5401.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-390; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10481
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D Texture Resource structures. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5408.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-391; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10482
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the U3D Texture Image Format object. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5409.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-392; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10483
Published: 2018-05-17
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Clod Progressive Mesh objects. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5410.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-393; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10484
Published: 2018-05-17
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Node objects. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5411.
CVSS Score: 8.8 (HIGH)
CWE: CWE-665, CWE-824
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-394; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10485
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within U3D Texture Height structures. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5412.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-395; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10486
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of the U3D Image Index. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5418.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-396; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10487
Published: 2018-05-17
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files embedded inside PDF documents. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5419.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-397; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10488
Published: 2018-05-17
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Texture Width structures. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5420.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-119
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-398; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-10489
Published: 2018-05-17
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Clod Progressive Mesh Declaration structures. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5421.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-399; https://www.foxitsoftware.com/support/security-bulletins.php