deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10297
Published: 2018-04-22
Description: Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of IMG elements associated with remote images.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://laworigin.github.io/2018/04/22/Discuz-x-portal-Stored-XSS/; https://laworigin.github.io/2018/04/22/Discuz-x-portal-Stored-XSS/
CVE: CVE-2018-10298
Published: 2018-04-22
Description: Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1_diy_portal_view.tpl.php does not restrict the content.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://laworigin.github.io/2018/04/22/Discuz-x-portal-Stored-XSS/; https://laworigin.github.io/2018/04/22/Discuz-x-portal-Stored-XSS/
CVE: CVE-2018-10299
Published: 2018-04-23
Description: An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two _receivers arguments in conjunction with a large _value argument, as exploited in the wild in April 2018, aka the "batchOverflow" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://dasp.co/#item-3; https://medium.com/secbit-media/a-disastrous-vulnerability-found-in-smart-contracts-of-beautychain-bec-dbf24ddbc30e; https://peckshield.com/2018/04/22/batchOverflow/
CVE: CVE-2017-1473
Published: 2018-04-23
Description: IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 128605.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=swg22012268; https://exchange.xforce.ibmcloud.com/vulnerabilities/128605; http://www.ibm.com/support/docview.wss?uid=swg22012268
CVE: CVE-2017-1486
Published: 2018-04-23
Description: IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128624.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22014202; https://exchange.xforce.ibmcloud.com/vulnerabilities/128624; http://www.ibm.com/support/docview.wss?uid=swg22014202
CVE: CVE-2017-1701
Published: 2018-04-23
Description: IBM Team Concert (RTC) 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 stores credentials for users using a weak encryption algorithm, which could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 134393.
CVSS Score: 8.8 (HIGH)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=swg22015454; https://exchange.xforce.ibmcloud.com/vulnerabilities/134393; http://www.ibm.com/support/docview.wss?uid=swg22015454
CVE: CVE-2017-1764
Published: 2018-04-23
Description: IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user. IBM X-Force ID: 136149.
CVSS Score: 7.0 (HIGH)
CWE: CWE-522
References: http://www.ibm.com/support/docview.wss?uid=swg22014202; https://exchange.xforce.ibmcloud.com/vulnerabilities/136149; http://www.ibm.com/support/docview.wss?uid=swg22014202
CVE: CVE-2017-1786
Published: 2018-04-23
Description: IBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 under special circumstances could allow an authenticated user to consume all resources due to a memory leak resulting in service loss. IBM X-Force ID: 136975.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-772
References: http://www.ibm.com/support/docview.wss?uid=swg22013023; https://exchange.xforce.ibmcloud.com/vulnerabilities/136975; http://www.ibm.com/support/docview.wss?uid=swg22013023
CVE: CVE-2017-13073
Published: 2018-04-23
Description: Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/nas-201804-23; https://www.qnap.com/zh-tw/security-advisory/nas-201804-23
CVE: CVE-2018-10233
Published: 2018-04-23
Description: The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/RiieCco/write-ups/tree/master/CVE-2018-10233; https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9611
CVE: CVE-2018-10234
Published: 2018-04-23
Description: Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/RiieCco/write-ups/tree/master/CVE-2018-10234; https://wordpress.org/plugins/ultimate-member/#developers; https://github.com/RiieCco/write-ups/tree/master/CVE-2018-10234
CVE: CVE-2017-14458
Published: 2018-04-23
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 8.3.2.25013. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103942; http://www.securitytracker.com/id/1040733; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0506
CVE: CVE-2018-3850
Published: 2018-04-23
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If a browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103942; http://www.securitytracker.com/id/1040733; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0532
CVE: CVE-2018-4847
Published: 2018-04-23
Description: A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session key for accessing server) in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read unencrypted data from the app's directory. Siemens provides mitigations to resolve the security issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-538, CWE-311
References: http://www.securityfocus.com/bid/103941; https://cert-portal.siemens.com/productcert/pdf/ssa-597741.pdf; http://www.securityfocus.com/bid/103941
CVE: CVE-2016-9586
Published: 2018-04-23
Description: curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-122, CWE-119
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/95019; http://www.securitytracker.com/id/1037515
CVE: CVE-2017-17833
Published: 2018-04-23
Description: OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://support.lenovo.com/us/en/solutions/LEN-18247; https://access.redhat.com/errata/RHSA-2018:2240; https://access.redhat.com/errata/RHSA-2018:2308
CVE: CVE-2018-10300
Published: 2018-04-23
Description: Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40squeal/wd-instagram-feed-1-3-0-xss-vulnerabilities-cve-2018-10300-and-cve-2018-10301-7173ffc4c271; https://wpvulndb.com/vulnerabilities/9393; https://medium.com/%40squeal/wd-instagram-feed-1-3-0-xss-vulnerabilities-cve-2018-10300-and-cve-2018-10301-7173ffc4c271
CVE: CVE-2018-10301
Published: 2018-04-23
Description: Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40squeal/wd-instagram-feed-1-3-0-xss-vulnerabilities-cve-2018-10300-and-cve-2018-10301-7173ffc4c271; https://wpvulndb.com/vulnerabilities/9393; https://medium.com/%40squeal/wd-instagram-feed-1-3-0-xss-vulnerabilities-cve-2018-10300-and-cve-2018-10301-7173ffc4c271
CVE: CVE-2018-8880
Published: 2018-04-23
Description: Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://sadfud.me/explotos/deviceip.txt; https://www.exploit-db.com/exploits/44488/; http://sadfud.me/explotos/deviceip.txt
CVE: CVE-2018-9921
Published: 2018-04-23
Description: In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98; https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98
CVE: CVE-2016-9594
Published: 2018-04-23
Description: curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-665, CWE-665
References: http://www.securityfocus.com/bid/95094; http://www.securitytracker.com/id/1037528; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9594
CVE: CVE-2018-10302
Published: 2018-04-23
Description: A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-jyb51g3mv9.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://srcincite.io/advisories/src-2018-0019/; https://www.foxitsoftware.com/support/security-bulletins.php; https://srcincite.io/advisories/src-2018-0019/
CVE: CVE-2018-8781
Published: 2018-04-23
Description: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2018:2948; https://access.redhat.com/errata/RHSA-2018:3083; https://access.redhat.com/errata/RHSA-2018:3096
CVE: CVE-2018-1106
Published: 2018-04-23
Description: An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.openwall.com/lists/oss-security/2018/04/23/3; https://access.redhat.com/errata/RHSA-2018:1224; https://bugzilla.redhat.com/show_bug.cgi?id=1565992
CVE: CVE-2017-7893
Published: 2018-04-23
Description: In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
CVSS Score: 9.8 (CRITICAL)
References: https://docs.saltstack.com/en/2017.7/topics/releases/2016.3.6.html; https://docs.saltstack.com/en/2017.7/topics/releases/2016.3.6.html
CVE: CVE-2018-10303
Published: 2018-04-23
Description: A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-y0nqfutlf3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://srcincite.io/advisories/src-2018-0020/; https://www.foxitsoftware.com/support/security-bulletins.php; https://srcincite.io/advisories/src-2018-0020/
CVE: CVE-2016-9599
Published: 2018-04-24
Description: puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could use these open ports to gain access to unauthorized resources.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284, CWE-284
References: http://rhn.redhat.com/errata/RHSA-2017-0025.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9599; http://rhn.redhat.com/errata/RHSA-2017-0025.html
CVE: CVE-2016-9601
Published: 2018-04-24
Description: ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a JBIG2 image. A document (PostScript or PDF) with an embedded, specially crafted, jbig2 image could trigger a segmentation fault in ghostscript.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190, CWE-119
References: http://git.ghostscript.com/?p=jbig2dec.git%3Ba=commit%3Bh=e698d5c11d27212aa1098bc5b1673a[PII_REDACTED]; http://www.securityfocus.com/bid/97095; https://bugs.ghostscript.com/show_bug.cgi?id=697457
CVE: CVE-2018-6491
Published: 2018-04-24
Description: Local Escalation of Privilege vulnerability to Micro Focus Universal CMDB, versions 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.00. The vulnerability could be remotely exploited to Local Escalation of Privilege.
CVSS Score: 8.1 (HIGH)
References: http://www.securitytracker.com/id/1040680; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03141180; http://www.securitytracker.com/id/1040680
CVE: CVE-2018-10305
Published: 2018-04-24
Description: The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum (SMF) before 2.0.15 does not properly use the possible_users variable in a query, which might allow attackers to bypass intended access restrictions.
CVSS Score: 9.8 (CRITICAL)
References: https://www.simplemachines.org/community/index.php?topic=557176.0; https://www.simplemachines.org/community/index.php?topic=557176.0
CVE: CVE-2018-10309
Published: 2018-04-24
Description: The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/B0UG/f0cfb356e23be3cd6ebea69566d6100a; https://wordpress.org/plugins/responsive-cookie-consent/#developers; https://wpvulndb.com/vulnerabilities/9067
CVE: CVE-2018-10311
Published: 2018-04-24
Description: A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tag[pinyin] parameter to the /index.php?m=tags&f=index&v=add URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/131; https://www.exploit-db.com/exploits/44618/; https://github.com/wuzhicms/wuzhicms/issues/131
CVE: CVE-2018-10312
Published: 2018-04-24
Description: index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/wuzhicms/wuzhicms/issues/132; https://www.exploit-db.com/exploits/44504/; https://github.com/wuzhicms/wuzhicms/issues/132
CVE: CVE-2018-10313
Published: 2018-04-24
Description: WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set_iframe=1 URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/133; https://www.exploit-db.com/exploits/44617/; https://github.com/wuzhicms/wuzhicms/issues/133
CVE: CVE-2018-10316
Published: 2018-04-24
Description: Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a globallineno integer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html; https://bugzilla.nasm.us/show_bug.cgi?id=3392474
CVE: CVE-2018-10318
Published: 2018-04-24
Description: Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/philippe/FrogCMS/issues/6; https://github.com/philippe/FrogCMS/issues/6
CVE: CVE-2018-10319
Published: 2018-04-24
Description: Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/philippe/FrogCMS/issues/7; https://github.com/philippe/FrogCMS/issues/7
CVE: CVE-2018-10320
Published: 2018-04-24
Description: Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/philippe/FrogCMS/issues/8; https://github.com/philippe/FrogCMS/issues/8
CVE: CVE-2018-10321
Published: 2018-04-24
Description: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/philippe/FrogCMS/issues/5; https://www.exploit-db.com/exploits/44551/; https://github.com/philippe/FrogCMS/issues/5
CVE: CVE-2018-10322
Published: 2018-04-24
Description: The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103960; https://access.redhat.com/errata/RHSA-2018:2948; https://access.redhat.com/errata/RHSA-2018:3083
CVE: CVE-2018-10323
Published: 2018-04-24
Description: The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103959; https://bugzilla.kernel.org/show_bug.cgi?id=199423; https://usn.ubuntu.com/3752-1/
CVE: CVE-2018-10328
Published: 2018-04-24
Description: Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.
CVSS Score: 7.4 (HIGH)
CWE: CWE-798
References: https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf; https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE: CVE-2018-10329
Published: 2018-04-24
Description: app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/phpipam/phpipam/issues/1903; https://github.com/phpipam/phpipam/issues/1903
CVE: CVE-2018-7751
Published: 2018-04-24
Description: The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/103956; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/a6cba062051f345e8ebfdff34aba071ed73d923f; https://security.gentoo.org/glsa/202003-65
CVE: CVE-2018-5228
Published: 2018-04-24
Description: The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104006; https://jira.atlassian.com/browse/CRUC-8201; https://jira.atlassian.com/browse/FE-7035
CVE: CVE-2017-1700
Published: 2018-04-24
Description: IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational Engineering Lifecycle Manager (RELM), Rational Team Concert (RTC), Rational Quality Manager (RQM), Rational Rhapsody Design Manager (Rhapsody DM), and Rational Software Architect (RSA DM) could allow an authenticated user to cause a denial of service due to incorrect authorization for resource intensive scenarios. IBM X-Force ID: 134392.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://www.ibm.com/support/docview.wss?uid=swg22015635; https://exchange.xforce.ibmcloud.com/vulnerabilities/134392; http://www.ibm.com/support/docview.wss?uid=swg22015635
CVE: CVE-2017-1725
Published: 2018-04-24
Description: IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational Engineering Lifecycle Manager (RELM), Rational Team Concert (RTC), Rational Quality Manager (RQM), Rational Rhapsody Design Manager (Rhapsody DM), and Rational Software Architect (RSA DM) contain an undisclosed vulnerability with the potential for information disclosure. IBM X-Force ID: 134820.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22015635; https://exchange.xforce.ibmcloud.com/vulnerabilities/134820; http://www.ibm.com/support/docview.wss?uid=swg22015635
CVE: CVE-2017-1734
Published: 2018-04-24
Description: IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational Engineering Lifecycle Manager (RELM), Rational Team Concert (RTC), Rational Quality Manager (RQM), Rational Rhapsody Design Manager (Rhapsody DM), and Rational Software Architect (RSA DM) stores potentially sensitive information in a cache that could be read by authenticated users. IBM X-Force ID: 134915.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22015635; https://exchange.xforce.ibmcloud.com/vulnerabilities/134915; http://www.ibm.com/support/docview.wss?uid=swg22015635
CVE: CVE-2017-7651
Published: 2018-04-24
Description: In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-789, CWE-400
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=529754; https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html; https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html