deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0357
Published: 2018-06-07
Description: A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvi71274.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104420; http://www.securitytracker.com/id/1041063; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-webex-xss1
CVE: CVE-2018-3758
Published: 2018-06-07
Description: Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: https://hackerone.com/reports/343726; https://hackerone.com/reports/343726
CVE: CVE-2018-11228
Published: 2018-06-08
Description: Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/105051; https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01; https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet
CVE: CVE-2018-11229
Published: 2018-06-08
Description: Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in Crestron Toolbox Protocol (CTP).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.securityfocus.com/bid/105051; https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01; https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet
CVE: CVE-2018-12041
Published: 2018-06-08
Description: An issue was discovered on the MediaTek AWUS036NH wireless USB adapter through 5.1.25.0. Attackers can remotely deny service by sending specially constructed 802.11 frames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://wiattack.net/IcECo1OR/fuzzdot.py; http://wiattack.net/Testprocess.pdf; http://wiattack.net/IcECo1OR/fuzzdot.py
CVE: CVE-2018-12045
Published: 2018-06-08
Description: DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/SukaraLin/php_code_audit_project/blob/master/dedecms/dedecms%20v5.7%20sp2%20%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md; https://github.com/SukaraLin/php_code_audit_project/blob/master/dedecms/dedecms%20v5.7%20sp2%20%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md
CVE: CVE-2018-12046
Published: 2018-06-08
Description: DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/SukaraLin/php_code_audit_project/blob/master/dedecms/dedecms%20v5.7%20sp2%20%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md; https://github.com/SukaraLin/php_code_audit_project/blob/master/dedecms/dedecms%20v5.7%20sp2%20%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md
CVE: CVE-2018-12047
Published: 2018-06-08
Description: xfind/search in Ximdex 4.0 has XSS via the filter[n][value] parameters for non-negative values of n, as demonstrated by n equal to 0 through 12.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/XIMDEX/ximdex/issues/147; https://github.com/XIMDEX/ximdex/issues/147
CVE: CVE-2018-12048
Published: 2018-06-08
Description: A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gist.github.com/huykha/455e7d3b86eb6629066d921f46bfcee3; https://www.exploit-db.com/exploits/44885/; https://gist.github.com/huykha/455e7d3b86eb6629066d921f46bfcee3
CVE: CVE-2018-12049
Published: 2018-06-08
Description: A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gist.github.com/huykha/0381acb2dc580c728a79452b60fa082c; https://www.exploit-db.com/exploits/44886/; https://gist.github.com/huykha/0381acb2dc580c728a79452b60fa082c
CVE: CVE-2018-9177
Published: 2018-06-08
Description: Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/prafagr/bd641fcfe71661065e659672c737173b; https://gist.github.com/prafagr/bd641fcfe71661065e659672c737173b
CVE: CVE-2018-9182
Published: 2018-06-08
Description: Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/priyanksethi/08fb93341cf7e61344aad5c4fee3aa9b; https://gist.github.com/priyanksethi/08fb93341cf7e61344aad5c4fee3aa9b
CVE: CVE-2018-9246
Published: 2018-06-08
Description: The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: https://archive.ledgersmb.org/ledger-smb-announce/msg00280.html; https://archive.ledgersmb.org/ledger-smb-announce/msg00280.html
CVE: CVE-2018-12051
Published: 2018-06-08
Description: Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/unh3x/just4cve/issues/5; https://github.com/unh3x/just4cve/issues/5
CVE: CVE-2018-12052
Published: 2018-06-08
Description: SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/unh3x/just4cve/issues/3; https://www.exploit-db.com/exploits/44873/; https://github.com/unh3x/just4cve/issues/3
CVE: CVE-2018-12053
Published: 2018-06-08
Description: Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/unh3x/just4cve/issues/6; https://www.exploit-db.com/exploits/44870/; https://github.com/unh3x/just4cve/issues/6
CVE: CVE-2018-12054
Published: 2018-06-08
Description: Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/unh3x/just4cve/issues/4; https://www.exploit-db.com/exploits/44874/; https://github.com/unh3x/just4cve/issues/4
CVE: CVE-2018-12055
Published: 2018-06-08
Description: Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.php, faq.php, about.php, photo_gallery.php, privacy.php, and so on.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/unh3x/just4cve/issues/2; https://www.exploit-db.com/exploits/44866/; https://github.com/unh3x/just4cve/issues/2
CVE: CVE-2018-10088
Published: 2018-06-08
Description: Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/bitfu/uc-httpd-1.0.0-buffer-overflow-exploit; https://www.exploit-db.com/exploits/44864/; https://github.com/bitfu/uc-httpd-1.0.0-buffer-overflow-exploit
CVE: CVE-2018-11409
Published: 2018-06-08
Description: Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1041148; https://github.com/kofa2002/splunk; https://www.exploit-db.com/exploits/44865/
CVE: CVE-2018-12064
Published: 2018-06-08
Description: tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_7953aea; https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_7953aea
CVE: CVE-2018-12065
Published: 2018-06-08
Description: A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files (execute PHP code) or read non-PHP files by replacing a helper.json file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/Creatiwity/wityCMS/issues/152; https://xkklq.coding.me/2018/06/07/wityCMS-LFI/; https://github.com/Creatiwity/wityCMS/issues/152
CVE: CVE-2011-3172
Published: 2018-06-08
Description: A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-304, CWE-264
References: https://bugzilla.suse.com/show_bug.cgi?id=707645; https://build.opensuse.org/request/show/80346; https://bugzilla.suse.com/show_bug.cgi?id=707645
CVE: CVE-2017-12075
Published: 2018-06-08
Description: Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.synology.com/en-global/support/security/Synology_SA_18_24; https://www.synology.com/en-global/support/security/Synology_SA_18_24
CVE: CVE-2017-12078
Published: 2018-06-08
Description: Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary command via the username parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.synology.com/en-global/support/security/Synology_SA_17_79; https://www.synology.com/en-global/support/security/Synology_SA_17_79
CVE: CVE-2017-1405
Published: 2018-06-08
Description: IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM X-Force ID: 127392.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-345
References: http://www.ibm.com/support/docview.wss?uid=swg22013617; https://exchange.xforce.ibmcloud.com/vulnerabilities/127392; http://www.ibm.com/support/docview.wss?uid=swg22013617
CVE: CVE-2018-1453
Published: 2018-06-08
Description: IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can be automatically processed within the environment. IBM X-Force ID: 140055.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://www.ibm.com/support/docview.wss?uid=swg22013617; http://www.securitytracker.com/id/1041383; https://exchange.xforce.ibmcloud.com/vulnerabilities/140055
CVE: CVE-2018-8916
Published: 2018-06-08
Description: Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-620, CWE-640
References: https://www.synology.com/en-global/support/security/Synology_SA_18_24; https://www.synology.com/en-global/support/security/Synology_SA_18_24
CVE: CVE-2018-8925
Published: 2018-06-08
Description: Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the (1) username, (2) password, (3) admin, (4) action, (5) uid, or (6) modify_admin parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.synology.com/zh-tw/support/security/Synology_SA_18_15; https://www.synology.com/zh-tw/support/security/Synology_SA_18_15
CVE: CVE-2018-8926
Published: 2018-06-08
Description: Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-625
References: https://www.synology.com/zh-tw/support/security/Synology_SA_18_15; https://www.synology.com/zh-tw/support/security/Synology_SA_18_15
CVE: CVE-2018-10358
Published: 2018-06-08
Description: A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within the processing of IOCTL 0x2200B4 in the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://success.trendmicro.com/solution/1119961; https://www.zerodayinitiative.com/advisories/ZDI-18-565/; https://success.trendmicro.com/solution/1119961
CVE: CVE-2018-10359
Published: 2018-06-08
Description: A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within the processing of IOCTL 0x220078 in the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://success.trendmicro.com/solution/1119961; https://www.zerodayinitiative.com/advisories/ZDI-18-564/; https://success.trendmicro.com/solution/1119961
CVE: CVE-2018-10505
Published: 2018-06-08
Description: A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within the processing of IOCTL 0x220008 in the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://success.trendmicro.com/solution/1119961; https://www.zerodayinitiative.com/advisories/ZDI-18-563/; https://success.trendmicro.com/solution/1119961
CVE: CVE-2018-10506
Published: 2018-06-08
Description: A out-of-bounds read information disclosure vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to disclose sensitive information on vulnerable installations due to a flaw within the processing of IOCTL 0x220004 by the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-125
References: https://success.trendmicro.com/solution/1119961; https://www.zerodayinitiative.com/advisories/ZDI-18-566/; https://success.trendmicro.com/solution/1119961
CVE: CVE-2018-12066
Published: 2018-06-08
Description: BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in birdc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://bird.network.cz; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900967; https://gitlab.labs.nic.cz/labs/bird/blob/v1.6.4/NEWS#L11
CVE: CVE-2011-4190
Published: 2018-06-08
Description: The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-306, CWE-310
References: https://bugzilla.suse.com/show_bug.cgi?id=722440; https://www.suse.com/security/cve/CVE-2011-4190/; https://bugzilla.suse.com/show_bug.cgi?id=722440
CVE: CVE-2012-0433
Published: 2018-06-08
Description: The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data.
CVSS Score: 3.3 (LOW)
CWE: CWE-732, CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=783195; https://www.suse.com/security/cve/CVE-2012-0433/; https://bugzilla.suse.com/show_bug.cgi?id=783195
CVE: CVE-2013-3703
Published: 2018-06-08
Description: The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-275
References: https://bugzilla.suse.com/show_bug.cgi?id=828256; https://github.com/openSUSE/open-build-service/commit/06ad7fdbdd7eb2fef8947d14c4cdd00d8f6387b1; https://bugzilla.suse.com/show_bug.cgi?id=828256
CVE: CVE-2014-0593
Published: 2018-06-08
Description: The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=866966; https://github.com/openSUSE/obs-service-set_version/commit/10d5bddcea29f74a175f7f550924bf6407e52e93; https://lists.opensuse.org/opensuse-buildservice/2014-03/msg00014.html
CVE: CVE-2014-0594
Published: 2018-06-08
Description: In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://bugzilla.suse.com/show_bug.cgi?id=870606; https://github.com/openSUSE/open-build-service/commit/2188c059b67b82171d0e28ef59f77e62d22a09d8; https://bugzilla.suse.com/show_bug.cgi?id=870606
CVE: CVE-2014-5220
Published: 2018-06-08
Description: The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary commands as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://bugzilla.suse.com/show_bug.cgi?id=910500; https://lists.opensuse.org/opensuse-updates/2015-02/msg00069.html; https://bugzilla.suse.com/show_bug.cgi?id=910500
CVE: CVE-2018-4141
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1041027; https://support.apple.com/HT208849; http://www.securitytracker.com/id/1041027
CVE: CVE-2018-4159
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Graphics Drivers" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1041027; https://support.apple.com/HT208849; http://www.securitytracker.com/id/1041027
CVE: CVE-2018-4171
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Bluetooth" component. It allows attackers to obtain sensitive kernel memory-layout information via a crafted app that leverages device properties.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1041027; https://support.apple.com/HT208849; http://www.securitytracker.com/id/1041027
CVE: CVE-2018-4184
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Speech" component. It allows attackers to bypass a sandbox protection mechanism to obtain microphone access.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1041027; https://support.apple.com/HT208849; http://www.securitytracker.com/id/1041027
CVE: CVE-2018-4187
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update 2018-001 is affected. The issue involves the "LinkPresentation" component. It allows remote attackers to spoof the UI via a crafted URL in a text message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103957; http://www.securityfocus.com/bid/103958; http://www.securitytracker.com/id/1040744
CVE: CVE-2018-4188
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1041029; https://support.apple.com/HT208848; https://support.apple.com/HT208850
CVE: CVE-2018-4190
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://www.securitytracker.com/id/1041029; https://security.gentoo.org/glsa/201808-04; https://support.apple.com/HT208848
CVE: CVE-2018-4192
Published: 2018-06-08
Description: An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a race condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://www.securitytracker.com/id/1041029; https://security.gentoo.org/glsa/201808-04; https://support.apple.com/HT208848