deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11717
Published: 2018-07-16
Description: An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depending on the modules configured) the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the EAS account (an AD account used to send mail), the cleartext password of recovery_password of Android devices, the cleartext password of account "set", the location of devices enrolled in the platform (with UUID and information related to the name of the person at the location), critical information about all enrolled devices such as Serial Number, UUID, Model, Name, and auth_session_token (usable to spoof a terminal identity on the platform), etc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: https://blog.netxp.fr/manageengine-deep-exploitation/; https://www.manageengine.com/products/desktop-central/vulnerability-in-log-files.html; https://blog.netxp.fr/manageengine-deep-exploitation/
CVE: CVE-2018-13980
Published: 2018-07-16
Description: The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html; https://www.exploit-db.com/exploits/45016/; https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/
CVE: CVE-2018-13981
Published: 2018-07-16
Description: The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files, because the formmailer widget blocks .php files but not .php5 or .phtml files. This is related to /assets/php/formmailer/SendEmail.php and /assets/php/formmailer/functions.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html; https://www.exploit-db.com/exploits/45016/; https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/
CVE: CVE-2018-0341
Published: 2018-07-16
Description: A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remote attacker to perform a command injection and execute commands with the privileges of the web server. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including arbitrary shell commands in a specific user input field. Cisco Bug IDs: CSCvi51426.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: http://www.securityfocus.com/bid/104731; http://www.securitytracker.com/id/1041285; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-phone-webui-inject
CVE: CVE-2018-0360
Published: 2018-07-16
Description: ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.securitytracker.com/id/1041367; https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html; https://lists.debian.org/debian-lts-announce/2018/08/msg00020.html
CVE: CVE-2018-0361
Published: 2018-07-16
Description: ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://www.securitytracker.com/id/1041367; https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html; https://lists.debian.org/debian-lts-announce/2018/08/msg00020.html
CVE: CVE-2018-0366
Published: 2018-07-16
Description: A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf03514.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104724; http://www.securitytracker.com/id/1041282; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-wsa-xss
CVE: CVE-2018-0368
Published: 2018-07-16
Description: A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive information on an affected system. The vulnerability is due to insufficient security restrictions imposed by the affected software. An attacker could exploit this vulnerability by accessing unprotected log files. A successful exploit could allow the attacker to access sensitive log files, which may include system credentials, on the affected device. Cisco Bug IDs: CSCvi22400.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104729; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-dnac-id; http://www.securityfocus.com/bid/104729
CVE: CVE-2018-0369
Published: 2018-07-16
Description: A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacker to trigger a reload of the npusim process, resulting in a denial of service (DoS) condition. There are four instances of the npusim process running per Service Function (SF) instance, each handling a subset of all traffic flowing across the device. It is possible to trigger a reload of all four instances of the npusim process around the same time. The vulnerability is due to improper handling of fragmented IPv4 packets containing options. An attacker could exploit this vulnerability by sending a malicious IPv4 packet across an affected device. An exploit could allow the attacker to trigger a restart of the npusim process, which will result in all traffic queued toward this instance of the npusim process to be dropped while the process is restarting. The npusim process typically restarts within less than a second. This vulnerability affects: Cisco Virtualized Packet Core-Single Instance (VPC-SI), Cisco Virtualized Packet Core-Distributed Instance (VPC-DI), Cisco Ultra Packet Core (UPC). Cisco Bug IDs: CSCvh29613.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/104723; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-staros-dos; http://www.securityfocus.com/bid/104723
CVE: CVE-2018-0370
Published: 2018-07-16
Description: A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of the detection engine processes to run out of memory and thus slow down traffic processing. The vulnerability is due to improper handling of traffic when the Secure Sockets Layer (SSL) inspection policy is enabled. An attacker could exploit this vulnerability by sending malicious traffic through an affected device. An exploit could allow the attacker to increase the resource consumption of a single instance of the Snort detection engine on an affected device. This will lead to performance degradation and eventually the restart of the affected Snort process. Cisco Bug IDs: CSCvi09219, CSCvi29845.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/104728; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firepower-dos; http://www.securityfocus.com/bid/104728
CVE: CVE-2018-0383
Published: 2018-07-16
Description: A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the transfer of files to an affected system via FTP. The vulnerability exists because the affected software incorrectly handles FTP control connections. An attacker could exploit this vulnerability by sending a maliciously crafted FTP connection to transfer a file to an affected device. A successful exploit could allow the attacker to bypass a file policy that is configured to apply the Block upload with reset action to FTP traffic. Cisco Bug IDs: CSCvh70130.
CVSS Score: 8.6 (HIGH)
CWE: CWE-693, CWE-693
References: http://www.securityfocus.com/bid/104726; http://www.securitytracker.com/id/1041283; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firesight-file-bypass
CVE: CVE-2018-0384
Published: 2018-07-16
Description: A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because the affected software incorrectly handles TCP packets that are received out of order when a TCP SYN retransmission is issued. An attacker could exploit this vulnerability by sending a maliciously crafted connection through an affected device. A successful exploit could allow the attacker to bypass a URL-based access control policy that is configured to block traffic for the affected system. Cisco Bug IDs: CSCvh84511.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-693, CWE-693
References: http://www.securityfocus.com/bid/104725; http://www.securitytracker.com/id/1041284; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firesight-url-bypass
CVE: CVE-2018-0385
Published: 2018-07-16
Description: A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper input handling of the SSL traffic. An attacker could exploit this vulnerability by sending a crafted SSL traffic to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped. Cisco Bug IDs: CSCvi36434.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-20
References: http://www.securityfocus.com/bid/104727; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firepwr-ssl-dos; http://www.securityfocus.com/bid/104727
CVE: CVE-2018-5239
Published: 2018-07-16
Description: Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access.
CVSS Score: 6.2 (MEDIUM)
References: http://www.securityfocus.com/bid/104693; https://support.symantec.com/en_US/article.SYMSA1455.html; http://www.securityfocus.com/bid/104693
CVE: CVE-2018-10859
Published: 2018-07-16
Description: git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10859; https://lists.debian.org/debian-lts-announce/2018/09/msg00004.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10859
CVE: CVE-2018-14324
Published: 2018-07-16
Description: The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a "jmx_rmi remote monitoring and control problem." NOTE: this is not an Oracle supported product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securitytracker.com/id/1041292; https://github.com/eclipse-ee4j/glassfish/issues/22500; http://www.securitytracker.com/id/1041292
CVE: CVE-2018-14325
Published: 2018-07-16
Description: In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: http://www.openwall.com/lists/oss-security/2018/07/16/1; https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE/
CVE: CVE-2018-14326
Published: 2018-07-16
Description: In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2018/07/16/1; https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE/
CVE: CVE-2018-10886
Published: 2018-07-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: this candidate is not about any specific product, protocol, or design, that falls into the scope of the assigning CNA. Notes: None
CVE: CVE-2017-15137
Published: 2018-07-16
Description: The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://access.redhat.com/errata/RHBA-2018:0489; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15137; https://access.redhat.com/errata/RHBA-2018:0489
CVE: CVE-2017-17541
Published: 2018-07-16
Description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1041246; http://www.securitytracker.com/id/1041247; https://fortiguard.com/advisory/FG-IR-17-305
CVE: CVE-2018-1046
Published: 2018-07-16
Description: pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1046; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1046
CVE: CVE-2018-10840
Published: 2018-07-16
Description: Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-122, CWE-787
References: http://www.securityfocus.com/bid/104858; https://access.redhat.com/errata/RHSA-2019:0162; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10840
CVE: CVE-2018-10857
Published: 2018-07-16
Description: git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10857; https://lists.debian.org/debian-lts-announce/2018/09/msg00004.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10857
CVE: CVE-2018-12584
Published: 2018-07-16
Description: The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cause a denial of service (buffer overflow) or possibly execute arbitrary code when TLS communication is enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://joachimdezutter.webredirect.org/advisory.html; http://seclists.org/bugtraq/2018/Aug/14; https://github.com/resiprocate/resiprocate/commit/2cb291191c93c7c4e371e22cb89805a5b31d6608
CVE: CVE-2018-13832
Published: 2018-07-16
Description: Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://hackpuntes.com/cve-2018-13832-wordpress-plugin-all-in-one-favicon-4-6-autenticado-multiples-cross-site-scripting-persistentes/; https://www.exploit-db.com/exploits/45056/; https://hackpuntes.com/cve-2018-13832-wordpress-plugin-all-in-one-favicon-4-6-autenticado-multiples-cross-site-scripting-persistentes/
CVE: CVE-2011-4891
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2011.  Notes: none
CVE: CVE-2011-4892
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2011.  Notes: none
CVE: CVE-2011-4893
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2011.  Notes: none
CVE: CVE-2012-0721
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012.  Notes: none
CVE: CVE-2013-0516
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-0528
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-0550
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-2971
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-2973
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-2986
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-2990
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-2991
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2013-3022
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013.  Notes: none
CVE: CVE-2015-0154
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015.  Notes: none
CVE: CVE-2015-0155
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015.  Notes: none
CVE: CVE-2015-0163
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015.  Notes: none
CVE: CVE-2015-1990
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015.  Notes: none
CVE: CVE-2015-1991
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015.  Notes: none
CVE: CVE-2015-4968
Published: 2018-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015.  Notes: none
CVE: CVE-2018-0706
Published: 2018-07-17
Description: Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html; http://seclists.org/fulldisclosure/2018/Jul/45; https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities
CVE: CVE-2018-0707
Published: 2018-07-17
Description: Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html; http://seclists.org/fulldisclosure/2018/Jul/45; https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities
CVE: CVE-2018-0708
Published: 2018-07-17
Description: Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html; http://seclists.org/fulldisclosure/2018/Jul/45; https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities