deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-20
Description: Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can result in DoS (packet of death), possible leak of uninitialized memory. This attack appear to be exploitable via A malformed packet is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client). Could be triggered by multiplayer opponent. This vulnerability appears to have been fixed in 2.1.5, 3.0.6, master branch after commit feaf03421dda0213382b51aff07bd5a96b29487b.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131, CWE-190, CWE-681, CWE-908, CWE-909
References: https://github.com/godotengine/godot/issues/20558; https://godotengine.org/article/maintenance-release-godot-2-1-5; https://godotengine.org/article/maintenance-release-godot-3-0-6
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-20
Description: Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cobbler/cobbler/issues/1917; https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/; https://github.com/cobbler/cobbler/issues/1917
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-20
Description: Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://github.com/cobbler/cobbler/issues/1916; https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/; https://github.com/cobbler/cobbler/issues/1916
CVE: CVE-2018-14077
Published: 2018-08-20
Description: Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to backup the device configuration via a direct request to /Maintenance/configfile.cfg.
CVSS Score: 7.5 (HIGH)
References: https://vulncode.com/advisory/CVE-2018-14077; https://vulncode.com/advisory/CVE-2018-14077
CVE: CVE-2018-14078
Published: 2018-08-20
Description: Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to reset the admin password via the /ConfigWizard/ChangePwd.esp?2admin URL (Attackers can login using the "admin" username with password "admin" after a successful attack).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://vulncode.com/advisory/CVE-2018-14078; https://vulncode.com/advisory/CVE-2018-14078
CVE: CVE-2018-14079
Published: 2018-08-20
Description: Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to obtain sensitive information via /Status/SystemStatusRpm.esp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://vulncode.com/advisory/CVE-2018-14079; https://vulncode.com/advisory/CVE-2018-14079
CVE: CVE-2015-5160
Published: 2018-08-20
Description: libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-2577.html; http://www.openwall.com/lists/oss-security/2017/07/21/3; https://bugs.launchpad.net/ossn/+bug/1686743
CVE: CVE-2015-5243
Published: 2018-08-20
Description: phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://blog.nettitude.com/uk/cve-2015-5243-phpwhois-remote-code-execution; https://github.com/Gemorroj/phpwhois/commit/91c937e03c876ba1290b6de2a3ad953d2105fdd0; https://github.com/jsmitty12/phpWhois/blob/master/CHANGELOG.md
CVE: CVE-2016-7048
Published: 2018-08-20
Description: The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1378043; https://www.postgresql.org/support/security/; https://bugzilla.redhat.com/show_bug.cgi?id=1378043
CVE: CVE-2017-16744
Published: 2018-08-20
Description: A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform (administrator) credentials.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/105101; https://ics-cert.us-cert.gov/advisories/ICSA-18-191-03; https://ics-cert.us-cert.gov/advisories/ICSA-19-022-01
CVE: CVE-2017-16748
Published: 2018-08-20
Description: An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/105101; https://ics-cert.us-cert.gov/advisories/ICSA-18-191-03; https://ics-cert.us-cert.gov/advisories/ICSA-19-022-01
CVE: CVE-2017-1753
Published: 2018-08-20
Description: Multiple IBM Rational products are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 135655.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/135655; https://www.ibm.com/support/docview.wss?uid=ibm10713739; https://exchange.xforce.ibmcloud.com/vulnerabilities/135655
CVE: CVE-2018-1394
Published: 2018-08-20
Description: Multiple IBM Rational products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138425.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/138425; https://www.ibm.com/support/docview.wss?uid=ibm10713739; https://exchange.xforce.ibmcloud.com/vulnerabilities/138425
CVE: CVE-2018-1517
Published: 2018-08-20
Description: A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data. IBM X-Force ID: 141681.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=ibm10719653; http://www.securityfocus.com/bid/105117; https://access.redhat.com/errata/RHSA-2018:2568
CVE: CVE-2018-1656
Published: 2018-08-20
Description: The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
CVSS Score: 7.4 (HIGH)
CWE: CWE-22
References: http://www.ibm.com/support/docview.wss?uid=ibm10719653; http://www.securityfocus.com/bid/105118; http://www.securitytracker.com/id/1041765
CVE: CVE-2018-12579
Published: 2018-08-20
Description: An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An attacker could gain access to the admin panel or a customer account when using the password reset function. To do so, it is required to own a domain name similar to the one the victim uses for their e-mail accounts.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: https://bugs.oxid-esales.com/view.php?id=6818; https://oxidforge.org/en/security-bulletin-2018-002.html; https://bugs.oxid-esales.com/view.php?id=6818
CVE: CVE-2018-14020
Published: 2018-08-20
Description: An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one that is not verified by the Paymorrow module.
CVSS Score: 5.3 (MEDIUM)
References: https://bugs.oxid-esales.com/view.php?id=6801; https://oxidforge.org/en/security-bulletin-2018-003.html; https://bugs.oxid-esales.com/view.php?id=6801
CVE: CVE-2018-14023
Published: 2018-08-20
Description: Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://n0sign4l.blogspot.com/2018/08/advisory-id-n0sign4l-002-risk-level-4-5.html?m=1; https://www.youtube.com/watch?v=oSJscEei5SE&app=desktop; http://n0sign4l.blogspot.com/2018/08/advisory-id-n0sign4l-002-risk-level-4-5.html?m=1
CVE: CVE-2018-0501
Published: 2018-08-21
Description: The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-347
References: https://mirror.fail; https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec; https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47
CVE: CVE-2018-15598
Published: 2018-08-21
Description: Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/containous/traefik/pull/3790; https://github.com/containous/traefik/pull/3790/commits/113250ce5735d554c502ca16fb03bb9119ca79f1; https://github.com/containous/traefik/pull/3790/commits/368bd[PII_REDACTED]2bde58160f92f202f370278b
CVE: CVE-2018-15599
Published: 2018-08-21
Description: The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html; http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002109.html; https://lists.debian.org/debian-lts-announce/2018/08/msg00026.html
CVE: CVE-2018-15601
Published: 2018-08-21
Description: apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/jbroadway/elefant/commit/afb3346e50b992bcba143660ca2149e563430e05; https://github.com/jbroadway/elefant/commit/afb3346e50b992bcba143660ca2149e563430e05
CVE: CVE-2018-15603
Published: 2018-08-21
Description: An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/VictorAlagwu/CMSsite/issues/2; https://github.com/VictorAlagwu/CMSsite/issues/2
CVE: CVE-2018-12115
Published: 2018-08-21
Description: In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/105127; https://access.redhat.com/errata/RHSA-2018:2552; https://access.redhat.com/errata/RHSA-2018:2553
CVE: CVE-2018-7166
Published: 2018-08-21
Description: In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-226, CWE-908
References: https://access.redhat.com/errata/RHSA-2018:2553; https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/; https://access.redhat.com/errata/RHSA-2018:2553
CVE: CVE-2017-17305
Published: 2018-08-21
Description: Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbacher RSA padding oracle. Cause a Bleichenbacher oracle attack. Successful exploit this vulnerability can impact IPSec tunnel security.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180813-01-Bleichenbacher-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180813-01-Bleichenbacher-en
CVE: CVE-2017-17311
Published: 2018-08-21
Description: Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Due to improper handling of the malformed messages, an attacker may sent crafted packets to the affected device to exploit these vulnerabilities. Successful exploit the vulnerability could lead to device deny of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180813-01-Bleichenbacher-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180813-01-Bleichenbacher-en
CVE: CVE-2017-17312
Published: 2018-08-21
Description: Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Due to improper handling of the malformed messages, an attacker may sent crafted packets to the affected device to exploit these vulnerabilities. Successful exploit the vulnerability could lead to device deny of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180813-01-Bleichenbacher-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180813-01-Bleichenbacher-en
CVE: CVE-2018-14793
Published: 2018-08-21
Description: DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable to a buffer overflow exploit through an open communication port to allow arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/105105; https://ics-cert.us-cert.gov/advisories/ICSA-18-228-01; http://www.securityfocus.com/bid/105105
CVE: CVE-2018-14795
Published: 2018-08-21
Description: DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace executable files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: http://www.securityfocus.com/bid/105105; https://ics-cert.us-cert.gov/advisories/ICSA-18-228-01; http://www.securityfocus.com/bid/105105
CVE: CVE-2018-6692
Published: 2018-08-21
Description: Stack-based Buffer Overflow vulnerability in libUPnPHndlr.so in Belkin Wemo Insight Smart Plug allows remote attackers to bypass local security protection via a crafted HTTP post packet.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-787
References: https://securingtomorrow.mcafee.com/mcafee-labs/insight-into-home-automation-reveals-vulnerability-in-simple-iot-product; https://securingtomorrow.mcafee.com/mcafee-labs/insight-into-home-automation-reveals-vulnerability-in-simple-iot-product
CVE: CVE-2018-15607
Published: 2018-08-21
Description: In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/105137; https://github.com/ImageMagick/ImageMagick/issues/1255; https://usn.ubuntu.com/4034-1/
CVE: CVE-2018-15481
Published: 2018-08-21
Description: Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices using firmware version 5.1.x before 5.1.13 allows authenticated remote attackers to escape the shell and escalate their privileges by adding a LocalCommand to the SSH configuration file in the user home folder.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://securite.intrinsec.com/2018/08/20/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13/; https://securite.intrinsec.com/2018/08/20/cve-2018-15481-ucopia-wireless-appliance-restricted-shell-escape-5-1-13/
CVE: CVE-2018-15528
Published: 2018-08-21
Description: Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "select_sso()" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?[XSS] link and then clicks the "Login" button.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/149007/BMC-MyIT-Java-System-Solutions-SSO-Plugin-4.0.13.1-Cross-Site-Scripting.html; http://seclists.org/bugtraq/2018/Aug/41; http://packetstormsecurity.com/files/149007/BMC-MyIT-Java-System-Solutions-SSO-Plugin-4.0.13.1-Cross-Site-Scripting.html
CVE: CVE-2018-15533
Published: 2018-08-21
Description: A reflected cross-site scripting vulnerability exists in Geutebrueck re_porter 16 before 7.8.974.20 by appending a query string to /modifychannel/exec or /images/*.png on TCP port 12005.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/149003/Geutebruck-re_porter-16-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/45242/; http://packetstormsecurity.com/files/149003/Geutebruck-re_porter-16-Cross-Site-Scripting.html
CVE: CVE-2018-15534
Published: 2018-08-21
Description: Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information including usernames and hashes via a direct request for /statistics/gscsetup.xml on TCP port 12003.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://packetstormsecurity.com/files/149002/Geutebruck-re_porter-16-Credential-Disclosure.html; https://www.exploit-db.com/exploits/45240/; http://packetstormsecurity.com/files/149002/Geutebruck-re_porter-16-Credential-Disclosure.html
CVE: CVE-2018-6557
Published: 2018-08-21
Description: The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1ubuntu2.2, and Ubuntu 18.10 before 10.1ubuntu6 incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled.
CVSS Score: 7.0 (HIGH)
CWE: CWE-59
References: http://www.securityfocus.com/bid/105148; http://www.securitytracker.com/id/1041530; https://usn.ubuntu.com/3748-1/
CVE: CVE-2018-15660
Published: 2018-08-21
Description: An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions, then the attacker can read certain Ola Money data such as a credit card number, expiration date, bank account number, and transaction history. NOTE: the vendor does not agree that this is a security issue requiring a fix
CVSS Score: 5.9 (MEDIUM)
References: https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf; https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf
CVE: CVE-2018-15661
Published: 2018-08-21
Description: An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions and the ability to read SMS messages, then the Forgot Password screen can be used to bypass authentication. NOTE: the vendor does not agree that this is a security issue requiring a fix
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf; https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf
CVE: CVE-2018-10932
Published: 2018-08-21
Description: lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-117, CWE-119
References: https://access.redhat.com/errata/RHSA-2019:3673; https://bugzilla.redhat.com/show_bug.cgi?id=1551623; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10932
CVE: CVE-2018-10902
Published: 2018-08-21
Description: It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-415
References: http://www.securityfocus.com/bid/105119; http://www.securitytracker.com/id/1041529; https://access.redhat.com/errata/RHSA-2018:3083
CVE: CVE-2018-15667
Published: 2018-08-21
Description: An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. It registers and uses the airmail:// URL scheme. The "send" command in the URL scheme allows an external application to send arbitrary emails from an active account without authentication. The handler has no restriction on who can use its functionality. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an attacker crafted email from the target account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://versprite.com/advisories/airmail-3-for-mac/; https://versprite.com/advisories/airmail-3-for-mac/