deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-0304
Published: 2017-12-21
Description: A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live firewall rules in use are not affected.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/102332; http://www.securitytracker.com/id/1040041; https://support.f5.com/csp/article/K39428424
CVE: CVE-2017-6129
Published: 2017-12-21
Description: In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or cause TMM to stop responding with a "flow not in use" assertion. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1040047; https://support.f5.com/csp/article/K20087443; http://www.securitytracker.com/id/1040047
CVE: CVE-2017-6132
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners (primary and/or secondary IP) may cause TMM to restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102333; http://www.securitytracker.com/id/1040049; https://support.f5.com/csp/article/K12044607
CVE: CVE-2017-6133
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102467; http://www.securitytracker.com/id/1040048; https://support.f5.com/csp/article/K25033460
CVE: CVE-2017-6134
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102466; http://www.securitytracker.com/id/1040044; http://www.securitytracker.com/id/1040045
CVE: CVE-2017-6135
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclosed IPv4 or IPv6 packets sent to BIG-IP management port or self IP addresses may lead to out of memory (OOM) conditions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securitytracker.com/id/1040050; https://support.f5.com/csp/article/K43322910; http://www.securitytracker.com/id/1040050
CVE: CVE-2017-6136
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause a disruption of service to the Traffic Management Microkernel (TMM).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1040046; https://support.f5.com/csp/article/K81137982; http://www.securitytracker.com/id/1040046
CVE: CVE-2017-6138
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1040051; https://support.f5.com/csp/article/K34514540; http://www.securitytracker.com/id/1040051
CVE: CVE-2017-6139
Published: 2017-12-21
Description: In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Details in the log file can vary; customers running debug mode logging with BIG-IP APM are at highest risk.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-532
References: http://www.securityfocus.com/bid/106186; http://www.securitytracker.com/id/1040055; https://support.f5.com/csp/article/K45432295
CVE: CVE-2017-6140
Published: 2017-12-21
Description: On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 or 12.1.2 of BIG-IP LTM, AAM, AFM, Analytics, ASM, DNS, GTM or PEM, an undisclosed sequence of packets sent to Virtual Servers with client or server SSL profiles may cause disruption of data plane services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1040042; https://support.f5.com/csp/article/K55102452; http://www.securitytracker.com/id/1040042
CVE: CVE-2017-6151
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, undisclosed requests made to BIG-IP virtual servers which make use of the "HTTP/2 profile" may result in a disruption of service to TMM.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1040052; https://support.f5.com/csp/article/K07369970; http://www.securitytracker.com/id/1040052
CVE: CVE-2017-6164
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1 and 11.5.0 - 11.5.4, in some circumstances, Traffic Management Microkernel (TMM) does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service (DoS) or possible remote command execution on the BIG-IP system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1040054; https://support.f5.com/csp/article/K02714910; http://www.securitytracker.com/id/1040054
CVE: CVE-2017-6167
Published: 2017-12-21
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://www.securitytracker.com/id/1040053; https://support.f5.com/csp/article/K24465120; http://www.securitytracker.com/id/1040053
CVE: CVE-2017-17692
Published: 2017-12-21
Description: Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/145510/Samsung-Internet-Browser-SOP-Bypass.html; https://datarift.blogspot.in/p/samsung-interent-browser-sop-bypass-cve.html; https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/samsung_browser_sop_bypass.rb
CVE: CVE-2017-14363
Published: 2017-12-21
Description: Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03060545; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03060545
CVE: CVE-2017-16727
Published: 2017-12-22
Description: A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is empty on the device. An unauthorized user can access the device without a password. An unauthorized user has the ability to completely compromise the confidentiality and integrity of the wireless traffic.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-255, CWE-521
References: http://www.securityfocus.com/bid/102254; https://ics-cert.us-cert.gov/advisories/ICSA-17-355-01; http://www.securityfocus.com/bid/102254
CVE: CVE-2017-10868
Published: 2017-12-22
Description: H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/h2o/h2o/issues/1459; https://jvn.jp/en/jp/JVN84182676/index.html; https://github.com/h2o/h2o/issues/1459
CVE: CVE-2017-10869
Published: 2017-12-22
Description: Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/h2o/h2o/issues/1460; https://jvn.jp/en/jp/JVN84182676/index.html; https://github.com/h2o/h2o/issues/1460
CVE: CVE-2017-10872
Published: 2017-12-22
Description: H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-118
References: https://github.com/h2o/h2o/issues/1543; https://jvn.jp/en/jp/JVN84182676/index.html; https://github.com/h2o/h2o/issues/1543
CVE: CVE-2017-10907
Published: 2017-12-22
Description: Directory traversal vulnerability in OneThird CMS Show Off v1.85 and earlier. Show Off v1.85 en and earlier allows an attacker to read arbitrary files via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN93333702/index.html; https://onethird.net/en/p1307.html; https://jvn.jp/en/jp/JVN93333702/index.html
CVE: CVE-2017-10908
Published: 2017-12-22
Description: H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/h2o/h2o/issues/1544; https://jvn.jp/en/jp/JVN84182676/index.html; https://github.com/h2o/h2o/issues/1544
CVE: CVE-2017-10909
Published: 2017-12-22
Description: Untrusted search path vulnerability in Music Center for PC version 1.0.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN60695371/index.html; https://jvn.jp/en/jp/JVN60695371/index.html
CVE: CVE-2017-16766
Published: 2017-12-22
Description: An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-74
References: https://www.synology.com/en-global/support/security/Synology_SA_17_74; https://www.synology.com/en-global/support/security/Synology_SA_17_74
CVE: CVE-2017-15307
Published: 2017-12-22
Description: Huawei Honor 8 smartphone with software versions earlier than FRD-L04C567B389 and earlier than FRD-L14C567B389 have a permission control vulnerability due to improper authorization configuration on specific device information.
CVSS Score: 2.3 (LOW)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171030-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171030-01-smartphone-en
CVE: CVE-2017-15308
Published: 2017-12-22
Description: Huawei iReader app before 8.0.2.301 has an input validation vulnerability due to insufficient validation on the URL used for loading network data. An attacker can control app access and load malicious websites created by the attacker, and the code in webpages would be loaded and run.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en
CVE: CVE-2017-15309
Published: 2017-12-22
Description: Huawei iReader app before 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths. An attacker can exploit this vulnerability to store downloaded malicious files in an arbitrary directory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en
CVE: CVE-2017-15310
Published: 2017-12-22
Description: Huawei iReader app before 8.0.2.301 has an arbitrary file deletion vulnerability due to the lack of input validation. An attacker can exploit this vulnerability to delete specific files from the SD card.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en
CVE: CVE-2017-15311
Published: 2017-12-22
Description: The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(SP2C00), before MHA-AL00B 8.0.0.334(C00), and before LON-AL00B 8.0.0.334(C00) have a stack overflow vulnerability due to the lack of parameter validation. An attacker could send malicious packets to the smart phones within radio range by special wireless device, which leads stack overflow when the baseband module handles these packets. The attacker could exploit this vulnerability to perform a denial of service attack or remote code execution in baseband module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171125-01-baseband-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171125-01-baseband-en
CVE: CVE-2017-15312
Published: 2017-12-22
Description: Huawei SmartCare V200R003C10 has a stored XSS (cross-site scripting) vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171201-01-smartcare-en; http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171201-01-smartcare-en
CVE: CVE-2017-15313
Published: 2017-12-22
Description: Huawei SmartCare V200R003C10 has a CSV injection vulnerability. An remote authenticated attacker could inject malicious CSV expression to the affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171201-01-smartcare-en; http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171201-01-smartcare-en
CVE: CVE-2017-15316
Published: 2017-12-22
Description: The GPU driver of Mate 9 Huawei smart phones with software before MHA-AL00B 8.0.0.334(C00) and Mate 9 Pro Huawei smart phones with software before LON-AL00B 8.0.0.334(C00) has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which triggers double free and causes a system crash or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171201-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171201-01-smartphone-en
CVE: CVE-2017-15317
Published: 2017-12-22
Description: AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; AR150-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR160 V200R006C10, V200R006C12, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; AR200 V200R006C10, V200R007C00, V200R007C01, V200R008C20, V200R008C30; AR200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR2200 V200R006C10, V200R006C13, V200R006C16, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; AR2200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR3200 V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30; AR510 V200R006C10, V200R006C12, V200R006C13, V200R006C15, V200R006C16, V200R006C17, V200R007C00, V200R008C20, V200R008C30; SRG1300 V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30; SRG2300 V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30; SRG3300 V200R006C10, V200R007C00, V200R008C20, V200R008C30 have an input validation vulnerability in Huawei multiple products. Due to the insufficient input validation, an unauthenticated, remote attacker may craft a malformed Stream Control Transmission Protocol (SCTP) packet and send it to the device, causing the device to read out of bounds and restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-sctp-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-sctp-en
CVE: CVE-2017-15318
Published: 2017-12-22
Description: RP200 V500R002C00, V600R006C00; TE30 V100R001C10, V500R002C00, V600R006C00; TE40 V500R002C00, V600R006C00; TE50 V500R002C00, V600R006C00; TE60 V100R001C10, V500R002C00, V600R006C00 have an out-of-bounds read vulnerabilities in some Huawei products. Due to insufficient input validation, a remote attacker could exploit these vulnerabilities by sending specially crafted SS7 related packets to the target devices. Successful exploit will cause out-of-bounds read and possibly crash the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171101-01-sccpx-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171101-01-sccpx-en
CVE: CVE-2017-15319
Published: 2017-12-22
Description: RP200 V500R002C00, V600R006C00; TE30 V100R001C10, V500R002C00, V600R006C00; TE40 V500R002C00, V600R006C00; TE50 V500R002C00, V600R006C00; TE60 V100R001C10, V500R002C00, V600R006C00 have an out-of-bounds read vulnerabilities in some Huawei products. Due to insufficient input validation, a remote attacker could exploit these vulnerabilities by sending specially crafted SS7 related packets to the target devices. Successful exploit will cause out-of-bounds read and possibly crash the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171101-01-sccpx-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171101-01-sccpx-en
CVE: CVE-2017-15320
Published: 2017-12-22
Description: RP200 V500R002C00, V600R006C00; TE30 V100R001C10, V500R002C00, V600R006C00; TE40 V500R002C00, V600R006C00; TE50 V500R002C00, V600R006C00; TE60 V100R001C10, V500R002C00, V600R006C00 have an out-of-bounds read vulnerabilities in some Huawei products. Due to insufficient input validation, a remote attacker could exploit these vulnerabilities by sending specially crafted SS7 related packets to the target devices. Successful exploit will cause out-of-bounds read and possibly crash the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171101-01-sccpx-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171101-01-sccpx-en
CVE: CVE-2017-15321
Published: 2017-12-22
Description: Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default. An attacker could intercept packets transferred by a target device. Successful exploit could cause an information leak.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-01-fusionsphere-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-01-fusionsphere-en
CVE: CVE-2017-15322
Published: 2017-12-22
Description: Some Huawei smartphones with software of BGO-L03C158B003CUSTC158D001 and BGO-L03C331B009CUSTC331D001 have a DoS vulnerability due to insufficient input validation. An attacker could exploit this vulnerability by sending specially crafted NFC messages to the target device. Successful exploit could make a service crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-01-nfc-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-01-nfc-en
CVE: CVE-2017-15324
Published: 2017-12-22
Description: Huawei S5700 and S6700 with software of V200R005C00 have a DoS vulnerability due to insufficient validation of the Network Quality Analysis (NQA) packets. A remote attacker could exploit this vulnerability by sending malformed NQA packets to the target device. Successful exploitation could make the device restart.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-nqa-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-nqa-en
CVE: CVE-2017-15328
Published: 2017-12-22
Description: Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://support.huawei.com/carrier/docview%21docview?nid=DOC[PII_REDACTED]&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623; https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/; http://support.huawei.com/carrier/docview%21docview?nid=DOC[PII_REDACTED]&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623
CVE: CVE-2017-14022
Published: 2017-12-23
Description: An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker with remote access to a network with FactoryTalk Alarms and Events can send a specially crafted set of packets packet to Port 403/TCP (the history archiver service), causing the service to either stall or terminate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/102114; https://ics-cert.us-cert.gov/advisories/ICSA-17-341-02; http://www.securityfocus.com/bid/102114
CVE: CVE-2017-13847
Published: 2017-12-25
Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102097; http://www.securitytracker.com/id/1039953; http://www.securitytracker.com/id/1039966
CVE: CVE-2017-13848
Published: 2017-12-25
Description: An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102099; http://www.securitytracker.com/id/1039966; https://support.apple.com/HT208331