deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-17358
Published: 2018-09-23
Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; https://seclists.org/bugtraq/2020/Jan/25
CVE: CVE-2018-17359
Published: 2018-09-23
Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; https://sourceware.org/bugzilla/show_bug.cgi?id=23686
CVE: CVE-2018-17360
Published: 2018-09-23
Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; https://sourceware.org/bugzilla/show_bug.cgi?id=23685
CVE: CVE-2018-17361
Published: 2018-09-23
Description: Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/alterebro/WeaselCMS/issues/7; https://github.com/alterebro/WeaselCMS/issues/7
CVE: CVE-2018-17364
Published: 2018-09-23
Description: OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-362
References: https://xiaohuihui1.blogspot.com/2018/09/otcms-361-command-execution.html; https://xiaohuihui1.blogspot.com/2018/09/otcms-361-command-execution.html
CVE: CVE-2018-17366
Published: 2018-09-23
Description: An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gitee.com/mingSoft/MCMS/issues/IM1DA; https://gitee.com/mingSoft/MCMS/issues/IM1DA
CVE: CVE-2018-17407
Published: 2018-09-23
Description: An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/TeX-Live/texlive-source/commit/6ed0077520e2b0da1fd060c7f88db7b2e6068e4c; https://lists.debian.org/debian-security-announce/2018/msg00230.html; https://usn.ubuntu.com/3788-1/
CVE: CVE-2018-17368
Published: 2018-09-23
Description: An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, which makes it easier to conduct brute-force attacks.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/sanluan/PublicCMS/issues/18; https://github.com/sanluan/PublicCMS/issues/18
CVE: CVE-2018-17369
Published: 2018-09-23
Description: An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/qzw1210/springboot_authority/issues/4; https://github.com/qzw1210/springboot_authority/issues/4
CVE: CVE-2018-17400
Published: 2018-09-23
Description: The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by intercepting the user name and PIN during the initial configuration of the application.  NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots
CVSS Score: 7.0 (HIGH)
References: https://github.com/magicj3lly/appexploits/blob/master/PhonePe-%20Authentication%20Bypass-1.pdf; https://github.com/magicj3lly/appexploits/blob/master/PhonePe-%20Authentication%20Bypass-1.pdf
CVE: CVE-2018-17401
Published: 2018-09-23
Description: The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature.  NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots
CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20Authentication%20Bypass-2.pdf; https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20Authentication%20Bypass-2.pdf
CVE: CVE-2018-17402
Published: 2018-09-23
Description: The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiration date, and CVV number.  NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20-%20Credit%20and%20Debit%20Card%20Leak.pdf; https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20-%20Credit%20and%20Debit%20Card%20Leak.pdf
CVE: CVE-2018-17403
Published: 2018-09-23
Description: The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to impersonate a user and set up their account without their knowledge.  NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots
CVSS Score: 8.8 (HIGH)
References: https://github.com/magicj3lly/appexploits/blob/master/PhonePe-%20User%20Impersonation.pdf; https://github.com/magicj3lly/appexploits/blob/master/PhonePe-%20User%20Impersonation.pdf
CVE: CVE-2018-17404
Published: 2018-09-23
Description: The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private information such as mobile number, PAN number (from a government-issued ID), and date of birth.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/magicj3lly/appexploits/blob/master/SBI_PrivacyViolation.pdf; https://github.com/magicj3lly/appexploits/blob/master/SBI_PrivacyViolation.pdf
CVE: CVE-2018-15615
Published: 2018-09-24
Description: A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/105392; https://downloads.avaya.com/css/P8/documents/101052300; http://www.securityfocus.com/bid/105392
CVE: CVE-2018-6682
Published: 2018-09-24
Description: Cross Site Scripting Exposure in McAfee True Key (TK) 4.0.0.0 and earlier allows local users to expose confidential data via a crafted web site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102825; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102825
CVE: CVE-2017-5639
Published: 2018-09-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2018-6700
Published: 2018-09-24
Description: DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via specially crafted malware.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102846; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102846
CVE: CVE-2018-17432
Published: 2018-09-24
Description: A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln6#null-pointer-dereference-in-h5o_sdspace_encode; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln6#null-pointer-dereference-in-h5o_sdspace_encode
CVE: CVE-2018-17433
Published: 2018-09-24
Description: A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln8#heap-overflow-in-readgifimagedesc; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln8#heap-overflow-in-readgifimagedesc
CVE: CVE-2018-17434
Published: 2018-09-24
Description: A SIGFPE signal is raised in the function apply_filters() of h5repack_filters.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln4#divided-by-zero---poc_apply_filters_h5repack_filters; https://lists.debian.org/debian-lts-announce/2023/08/msg00009.html; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln4#divided-by-zero---poc_apply_filters_h5repack_filters
CVE: CVE-2018-17435
Published: 2018-09-24
Description: A heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting an HDF file to GIF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln7#heap-overflow-in-h5o_attr_decode; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln7#heap-overflow-in-h5o_attr_decode
CVE: CVE-2018-17436
Published: 2018-09-24
Description: ReadCode() in decompress.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (invalid write access) via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln8#invalid-write-memory-access-in-decompressc; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln8#invalid-write-memory-access-in-decompressc
CVE: CVE-2018-17437
Published: 2018-09-24
Description: Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln5#memory-leak-in-h5o_dtype_decode_helper; https://lists.debian.org/debian-lts-announce/2023/08/msg00009.html; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln5#memory-leak-in-h5o_dtype_decode_helper
CVE: CVE-2018-17438
Published: 2018-09-24
Description: A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln4#divided-by-zero---poc_h5d__select_io_h5dselect; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln4#divided-by-zero---poc_h5d__select_io_h5dselect
CVE: CVE-2018-17439
Published: 2018-09-24
Description: An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically, this issue occurs while converting an HDF5 file to a GIF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln5#stack-overflow-in-h5s_extent_get_dims; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln5#stack-overflow-in-h5s_extent_get_dims
CVE: CVE-2015-8298
Published: 2018-09-24
Description: Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/134525/RXTEC-RXAdmin-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Nov/90; https://github.com/sbaresearch/advisories/tree/public/2015/RXTEC_20150513
CVE: CVE-2018-14825
Published: 2018-09-24
Description: On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android OS 6.0, CN75 running Android OS 6.0, CN75e running Android OS 6.0, CT50 running Android OS 6.0, D75e running Android OS 6.0, CT50 running Android OS 4.4, D75e running Android OS 4.4, CN51 running Android OS 6.0, EDA50k running Android 4.4, EDA50 running Android OS 7.1, EDA50k running Android OS 7.1, EDA70 running Android OS 7.1, EDA60k running Android OS 7.1, and EDA51 running Android OS 8.1), a skilled attacker with advanced knowledge of the target system could exploit this vulnerability by creating an application that would successfully bind to the service and gain elevated system privileges. This could enable the attacker to obtain access to keystrokes, passwords, personal identifiable information, photos, emails, or business-critical documents.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-269, CWE-732
References: http://www.securityfocus.com/bid/105767; https://cert.vde.com/de-de/advisories/vde-2018-016; https://ics-cert.us-cert.gov/advisories/ICSA-18-256-01
CVE: CVE-2018-12975
Published: 2018-09-24
Description: The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as timestamp, the current block's blockhash, and a private variable (which can be read with a getStorageAt call). Therefore, attackers can precompute the random number and manipulate the game (e.g., get powerful characters or get critical damages).
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://medium.com/%40jonghyk.song/create-legendary-champs-by-breaking-prng-of-cryptosaga-an-ethereum-rpg-game-cve-2018-12975-8de733ff8255; https://medium.com/%40jonghyk.song/create-legendary-champs-by-breaking-prng-of-cryptosaga-an-ethereum-rpg-game-cve-2018-12975-8de733ff8255
CVE: CVE-2018-13140
Published: 2018-09-24
Description: Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation packages.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/149468/Antidote-9.5.1-Code-Execution.html; http://seclists.org/fulldisclosure/2018/Sep/38; https://sysdream.com/news/lab/2018-09-21-cve-2018-13140-antidote-remote-code-execution-against-the-update-component/
CVE: CVE-2018-16283
Published: 2018-09-24
Description: The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/Sep/32; https://github.com/springjk/wordpress-wechat-broadcast/issues/14; https://wpvulndb.com/vulnerabilities/9132
CVE: CVE-2018-16299
Published: 2018-09-24
Description: The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/Sep/33; https://github.com/julianburr/wp-plugin-localizemypost/issues/1; https://packetstormsecurity.com/files/149433/WordPress-Localize-My-Post-1.0-Local-File-Inclusion.html
CVE: CVE-2018-17107
Published: 2018-09-24
Description: In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/tgstation/tgstation-server/issues/690; https://github.com/tgstation/tgstation-server/issues/690
CVE: CVE-2018-17281
Published: 2018-09-24
Description: There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://downloads.asterisk.org/pub/security/AST-2018-009.html; http://packetstormsecurity.com/files/149453/Asterisk-Project-Security-Advisory-AST-2018-009.html; http://seclists.org/fulldisclosure/2018/Sep/31
CVE: CVE-2018-10496
Published: 2018-09-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Internet Browser Fixed in version 6.4.0.15. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TypedArray objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5326.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-20
References: https://zerodayinitiative.com/advisories/ZDI-18-555; https://zerodayinitiative.com/advisories/ZDI-18-555
CVE: CVE-2018-10497
Published: 2018-09-24
Description: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of EML files. The issue results from the lack of proper validation of user-supplied data, which can allow arbitrary JavaScript to execute. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5328.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://zerodayinitiative.com/advisories/ZDI-18-556; https://zerodayinitiative.com/advisories/ZDI-18-556
CVE: CVE-2018-10498
Published: 2018-09-24
Description: This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of file:/// URIs. The issue lies in the lack of proper validation of user-supplied data, which can allow for reading arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges. Was ZDI-CAN-5329.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-37, CWE-200
References: https://zerodayinitiative.com/advisories/ZDI-18-557; https://zerodayinitiative.com/advisories/ZDI-18-557
CVE: CVE-2018-10499
Published: 2018-09-24
Description: This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue lies in the lack of proper validation of user-supplied data, which can allow arbitrary JavaScript to execute. An attacker can leverage this vulnerability to install applications under the context of the current user. Was ZDI-CAN-5330.
CVSS Score: 7.0 (HIGH)
CWE: CWE-20, CWE-20
References: https://zerodayinitiative.com/advisories/ZDI-18-558; https://zerodayinitiative.com/advisories/ZDI-18-558
CVE: CVE-2018-10500
Published: 2018-09-24
Description: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of push messages. The issue lies in the ability to start an activity with controlled arguments. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5331.
CVSS Score: 7.0 (HIGH)
CWE: CWE-284
References: https://zerodayinitiative.com/advisories/ZDI-18-559; https://zerodayinitiative.com/advisories/ZDI-18-559
CVE: CVE-2018-10501
Published: 2018-09-24
Description: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in version 2.0.02.31. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5358.
CVSS Score: 7.0 (HIGH)
CWE: CWE-22, CWE-22
References: https://zerodayinitiative.com/advisories/ZDI-18-561; https://zerodayinitiative.com/advisories/ZDI-18-561