deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-6194
Published: 2018-01-30
Description: A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/146109/WordPress-Splashing-Images-2.1-Cross-Site-Scripting-PHP-Object-Injection.html; http://seclists.org/fulldisclosure/2018/Jan/91; https://plugins.trac.wordpress.org/changeset/1807349/wp-splashing-images
CVE: CVE-2018-6195
Published: 2018-01-30
Description: admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1321
References: http://packetstormsecurity.com/files/146109/WordPress-Splashing-Images-2.1-Cross-Site-Scripting-PHP-Object-Injection.html; http://seclists.org/fulldisclosure/2018/Jan/91; https://plugins.trac.wordpress.org/changeset/1807349/wp-splashing-images
CVE: CVE-2009-1193
Published: 2018-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2012-3878
Published: 2018-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-6405
Published: 2018-01-30
Description: In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/964; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/964
CVE: CVE-2018-6406
Published: 2018-01-30
Description: The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm through 2018-01-30 does not validate the child_frame_length data obtained from a .webm file, which allows remote attackers to cause an information leak or a denial of service (heap-based buffer over-read and later out-of-bounds write), or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://bugs.chromium.org/p/webm/issues/detail?id=1492; https://github.com/dwfault/PoCs/blob/master/libwebm%20ParseVP9SuperFrameIndex%20memory%20corruption/libwebm%20ParseVP9SuperFrameIndex%20OOB%20read.md; https://bugs.chromium.org/p/webm/issues/detail?id=1492
CVE: CVE-2018-6407
Published: 2018-01-30
Description: An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/dreadlocked/ConceptronicIPCam_MultipleVulnerabilities/; https://github.com/dreadlocked/ConceptronicIPCam_MultipleVulnerabilities/
CVE: CVE-2018-6408
Published: 2018-01-30
Description: An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. CSRF exists in hy-cgi/user.cgi, as demonstrated by changing an administrator password or adding a new administrator account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/dreadlocked/ConceptronicIPCam_MultipleVulnerabilities/; https://github.com/dreadlocked/ConceptronicIPCam_MultipleVulnerabilities/
CVE: CVE-2018-6412
Published: 2018-01-31
Description: In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=250c6c49e3b68756b14983c[PII_REDACTED]36e2bde; https://github.com/torvalds/linux/commit/250c6c49e3b68756b14983c[PII_REDACTED]36e2bde; https://marc.info/?l=linux-fbdev&m=[PII_REDACTED]1499&w=2
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-31
Description: OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, Anil Vishnoi contain a flaw when multiple 'expired' flows take up the memory resource of CONFIG DATASTORE which leads to CONTROLLER shutdown. If multiple different flows with 'idle-timeout' and 'hard-timeout' are sent to the Openflow Plugin REST API, the expired flows will eventually crash the controller once its resource allocations set with the JVM size are exceeded. Although the installed flows (with timeout set) are removed from network (and thus also from controller's operations DS), the expired entries are still present in CONFIG DS. The attack can originate both from NORTH or SOUTH. The above description is for a north bound attack. A south bound attack can originate when an attacker attempts a flow flooding attack and since flows come with timeouts, the attack is not successful. However, the attacker will now be successful in CONTROLLER overflow attack (resource consumption). Although, the network (actual flow tables) and operational DS are only (~)1% occupied, the controller requests for resource consumption. This happens because the installed flows get removed from the network upon timeout.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: http://seclists.org/oss-sec/2018/q1/52; http://www.securityfocus.com/bid/102736; http://seclists.org/oss-sec/2018/q1/52
CVE: CVE-2017-15698
Published: 2018-01-31
Description: When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates that should have been rejected (if the OCSP check had been made) to be accepted. Users not using OCSP checks are not affected by this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securitytracker.com/id/1040390; https://access.redhat.com/errata/RHSA-2018:0465; https://access.redhat.com/errata/RHSA-2018:0466
CVE: CVE-2017-15706
Published: 2018-01-31
Description: As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-358
References: http://www.securityfocus.com/bid/103069; https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E; https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
CVE: CVE-2017-16858
Published: 2018-01-31
Description: The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given the following situation: the Crowd application is bound to directory 1 and has a user called admin and the Google Apps application is bound to directory 2, which also has a user called admin, it was possible to authenticate REST requests using the credentials of the user coming from directory 2 and impersonate the user from directory 1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863, CWE-287
References: https://jira.atlassian.com/browse/CWD-5009; https://jira.atlassian.com/browse/CWD-5009
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-31
Description: In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/oss-sec/2018/q1/38; http://www.securityfocus.com/bid/102525; http://www.securitytracker.com/id/1040162
CVE: CVE-2017-1233
Published: 2018-01-31
Description: IBM Remote Control v9 could allow a local user to use the component to replace files to which he does not have write access and which he can cause to be executed with Local System or root privileges. IBM X-Force ID: 123912.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-863
References: http://www.ibm.com/support/docview.wss?uid=swg22011765; https://exchange.xforce.ibmcloud.com/vulnerabilities/123912; http://www.ibm.com/support/docview.wss?uid=swg22011765
CVE: CVE-2017-1773
Published: 2018-01-31
Description: IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform DNS cache poisoning and redirect Internet traffic. IBM X-Force ID: 136817.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-345
References: http://www.ibm.com/support/docview.wss?uid=swg22012758; https://exchange.xforce.ibmcloud.com/vulnerabilities/136817; http://www.ibm.com/support/docview.wss?uid=swg22012758
CVE: CVE-2017-8916
Published: 2018-01-31
Description: In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-640
References: https://www.cisecurity.org/cis-security-updates/incorrect-access-control-cve-2017-8916/; https://www.cisecurity.org/cis-security-updates/incorrect-access-control-cve-2017-8916/
CVE: CVE-2018-6384
Published: 2018-01-31
Description: Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with elevated privileges on the system via a malicious program.exe executable in the %SYSTEMDRIVE% folder.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://nsclient.org/blog/2018/01/30/CVE-2018-6384-0.3.9/; https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_nsclient_-_cve-2018-6384.pdf; https://nsclient.org/blog/2018/01/30/CVE-2018-6384-0.3.9/
CVE: CVE-2018-6460
Published: 2018-01-31
Description: Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including configuration. User controlled input is not sufficiently filtered: an unauthenticated attacker can send a POST request to /status.js with the parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including whether the user is connected to a VPN, to which VPN he/she is connected, and what is their real IP address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blogs.securiteam.com/index.php/archives/3604; https://www.exploit-db.com/exploits/44042/; https://blogs.securiteam.com/index.php/archives/3604
CVE: CVE-2014-1631
Published: 2018-01-31
Description: Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-275
References: http://bazaar.launchpad.net/~eventum-developers/eventum/trunk/revision/4666; http://www.securityfocus.com/archive/1/530891/100/0/threaded; https://bugs.launchpad.net/eventum/+bug/1271499
CVE: CVE-2014-1632
Published: 2018-01-31
Description: htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-275
References: http://bazaar.launchpad.net/~eventum-developers/eventum/trunk/revision/4665; http://www.securityfocus.com/archive/1/530891/100/0/threaded; https://bugs.launchpad.net/eventum/+bug/1271499
CVE: CVE-2018-5701
Published: 2018-01-31
Description: In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x00226003.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/146165/System-Shield-5.0.0.136-Privilege-Escalation.html; https://www.exploit-db.com/exploits/43929/; https://www.greyhathacker.net/?p=1006
CVE: CVE-2018-5996
Published: 2018-01-31
Description: Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040831; https://0patch.blogspot.si/2018/02/two-interesting-micropatches-for-7-zip.html; https://github.com/p7zip-project/p7zip/issues/32
CVE: CVE-2018-6462
Published: 2018-01-31
Description: Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 bpc instead of 8 bpc, which might allow remote attackers to execute arbitrary code via a crafted PDF document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://herolab.usd.de/wp-content/uploads/sites/4/2018/07/usd20180019.txt; https://www.tracker-software.com/company/news_press_events/view/179; https://herolab.usd.de/wp-content/uploads/sites/4/2018/07/usd20180019.txt
CVE: CVE-2018-6464
Published: 2018-01-31
Description: Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Heartway/simditor/blob/master/simditor.docx; https://github.com/Heartway/simditor/blob/master/simditor.docx
CVE: CVE-2018-6465
Published: 2018-01-31
Description: The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/146174/WordPress-Propertyhive-1.4.14-Cross-Site-Scripting.html; https://wordpress.org/plugins/propertyhive/#developers; https://wordpress.org/support/topic/wordpress-propertyhive-1-4-14-cross-site-scripting/
CVE: CVE-2018-6471
Published: 2018-01-31
Description: In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402078.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C402078; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C402078
CVE: CVE-2018-6472
Published: 2018-01-31
Description: In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40204c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C40204c; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C40204c
CVE: CVE-2018-6473
Published: 2018-01-31
Description: In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402080.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C402080; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C402080
CVE: CVE-2018-6474
Published: 2018-01-31
Description: In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402148.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C402148; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C402148
CVE: CVE-2018-6475
Published: 2018-01-31
Description: In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/getshell; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/getshell
CVE: CVE-2018-6476
Published: 2018-01-31
Description: In SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYSTEM because of not validating input values from IOCtl 0x9C402114 or 0x9C402124 or 0x9C40207c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C402114_9C402124_9C40207c; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/SUPERAntiSpyware_POC/tree/master/0x9C402114_9C402124_9C40207c
CVE: CVE-2017-15653
Published: 2018-01-31
Description: Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized user to execute any action knowing administrator session token by using a specific User-Agent string.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html; http://seclists.org/fulldisclosure/2018/Jan/63; http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
CVE: CVE-2017-15654
Published: 2018-01-31
Description: Highly predictable session tokens in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allow gaining administrative router access.
CVSS Score: 8.3 (HIGH)
CWE: CWE-330
References: http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html; http://seclists.org/fulldisclosure/2018/Jan/63; http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
CVE: CVE-2017-15655
Published: 2018-01-31
Description: Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html; http://seclists.org/fulldisclosure/2018/Jan/63; http://sploit.tech/2018/01/16/ASUS-part-I.html
CVE: CVE-2017-15656
Published: 2018-01-31
Description: Password are stored in plaintext in nvram in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html; http://seclists.org/fulldisclosure/2018/Jan/63; http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
CVE: CVE-2017-16928
Published: 2018-01-31
Description: The arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted update URL, as demonstrated by file:///tmp/blah/Arq.zip.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://packetstormsecurity.com/files/146158/Arq-5.10-Local-Privilege-Escalation.html; https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.html; https://www.exploit-db.com/exploits/43925/
CVE: CVE-2017-16945
Published: 2018-01-31
Description: The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted restore path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://packetstormsecurity.com/files/146159/Arq-5.10-Local-Privilege-Escalation.html; https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.html; https://www.exploit-db.com/exploits/43926/
CVE: CVE-2017-18043
Published: 2018-01-31
Description: Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2018/01/19/1; http://www.securityfocus.com/bid/102759; https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=2098b073f398cd628c09c5a78537a6854
CVE: CVE-2018-0136
Published: 2018-01-31
Description: A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series could allow an unauthenticated, remote attacker to trigger a reload of one or more Trident-based line cards, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect handling of IPv6 packets with a fragment header extension. An attacker could exploit this vulnerability by sending IPv6 packets designed to trigger the issue either to or through the Trident-based line card. A successful exploit could allow the attacker to trigger a reload of Trident-based line cards, resulting in a DoS during the period of time the line card takes to restart. This vulnerability affects Cisco Aggregation Services Router (ASR) 9000 Series when the following conditions are met: The router is running Cisco IOS XR Software Release 5.3.4, and the router has installed Trident-based line cards that have IPv6 configured. A software maintenance upgrade (SMU) has been made available that addresses this vulnerability. The fix has also been incorporated into service pack 7 for Cisco IOS XR Software Release 5.3.4. Cisco Bug IDs: CSCvg46800.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102905; http://www.securitytracker.com/id/1040315; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180131-ipv6
CVE: CVE-2018-6479
Published: 2018-01-31
Description: An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI.
CVSS Score: 7.5 (HIGH)
References: https://github.com/dreadlocked/netwave-dosvulnerability; https://github.com/dreadlocked/netwave-dosvulnerability