deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-12944
Published: 2018-07-31
Description: Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG; https://www.contextis.com/resources/advisories/cve-2018-12944; https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG
CVE: CVE-2018-14432
Published: 2018-07-31
Description: In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2018/07/25/2; http://www.securityfocus.com/bid/104930; https://access.redhat.com/errata/RHSA-2018:2523
CVE: CVE-2018-14533
Published: 2018-07-31
Description: read_tmp and write_tmp in Inteno IOPSYS allow attackers to gain privileges after writing to /tmp/etc/smb.conf because /var is a symlink to /tmp.
CVSS Score: 7.8 (HIGH)
References: https://neonsea.uk/blog/2018/07/21/tmp-to-rce.html; https://www.exploit-db.com/exploits/45089/; https://neonsea.uk/blog/2018/07/21/tmp-to-rce.html
CVE: CVE-2018-14581
Published: 2018-07-31
Description: Redgate .NET Reflector before 10.0.7.774 and SmartAssembly before 6.12.5 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or EXE file) with a specific embedded resource file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://documentation.red-gate.com/ref10/release-notes-and-other-versions/net-reflector-10-0-release-notes; https://documentation.red-gate.com/sa6/release-notes-and-other-versions/smartassembly-6-12-release-notes; https://www.nccgroup.trust/us/our-research/technical-advisory-code-execution-by-viewing-resource-files-in-.net-reflector/?research=Technical+advisories
CVE: CVE-2018-5543
Published: 2018-07-31
Description: The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the container.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://www.securityfocus.com/bid/104944; https://support.f5.com/csp/article/K58935003; http://www.securityfocus.com/bid/104944
CVE: CVE-2018-5544
Published: 2018-07-31
Description: When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages (pages with a logon agent or a confirm box), the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104932; http://www.securitytracker.com/id/1041398; https://support.f5.com/csp/article/K23024812
CVE: CVE-2018-7934
Published: 2018-07-31
Description: Some Huawei mobile phone with the versions before BLA-L29 8.0.0.145(C432) have a denial of service (DoS) vulnerability because they do not adapt to specific screen gestures. An attacker may trick users into installing a malicious app. As a result, apps running on the frontend crash after the users make specific screen gestures.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180705-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180705-01-smartphone-en
CVE: CVE-2018-7947
Published: 2018-07-31
Description: Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause some malicious applications to be installed in the mobile phones.
CVSS Score: 3.9 (LOW)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180720-01-mobile-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180720-01-mobile-en
CVE: CVE-2018-7957
Published: 2018-07-31
Description: Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization correctly, attackers can exploit an application with the authorization of phone state to obtain user location additionally.
CVSS Score: 3.3 (LOW)
CWE: CWE-863
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180704-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180704-01-smartphone-en
CVE: CVE-2018-7992
Published: 2018-07-31
Description: Mdapt Driver of Huawei MediaPad M3 BTV-W09C128B353CUSTC128D001; Mate 9 Pro versions earlier than 8.0.0.356(C00); P10 Plus versions earlier than 8.0.0.357(C00) has a buffer overflow vulnerability. The driver does not sufficiently validate the input, an attacker could trick the user to install a malicious application which would send crafted parameters to the driver. Successful exploit could cause a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180725-01-dos-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180725-01-dos-en
CVE: CVE-2018-7993
Published: 2018-07-31
Description: HUAWEI Mate 10 smartphones with versions earlier than ALP-AL00 8.1.0.311 have a use after free vulnerability on mediaserver component. An attacker tricks the user install a malicious application, which make the software to reference memory after it has been freed. Successful exploit could cause execution of arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180711-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180711-01-smartphone-en
CVE: CVE-2018-7994
Published: 2018-07-31
Description: Some Huawei products IPS Module V500R001C50; NGFW Module V500R001C50; V500R002C10; NIP6300 V500R001C50; NIP6600 V500R001C50; NIP6800 V500R001C50; Secospace USG6600 V500R001C50; USG9500 V500R001C50 have a memory leak vulnerability. The software does not release allocated memory properly when processing Protal questionnaire. A remote attacker could send a lot questionnaires to the device, successful exploit could cause the device to reboot since running out of memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180704-01-firewall-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180704-01-firewall-en
CVE: CVE-2017-13652
Published: 2018-07-31
Description: NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perform an unintended action in the user interface.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-10592
Published: 2018-07-31
Description: Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/104376; https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03; https://web-material3.yokogawa.com/1/6712/details/YSAR-18-0004-E.pdf
CVE: CVE-2018-10603
Published: 2018-07-31
Description: Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior do not perform authentication of IEC-104 control commands, which may allow a rogue node a remote control of the industrial process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-287
References: http://www.securityfocus.com/bid/104286; https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01; http://www.securityfocus.com/bid/104286
CVE: CVE-2018-10607
Published: 2018-07-31
Description: Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more IOAs, without closing them properly, which may cause a denial of service within the industrial process control channel.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://martem.eu/csa/Martem_CSA_Telem_1805184.pdf; http://www.securityfocus.com/bid/104286; https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01
CVE: CVE-2018-10609
Published: 2018-07-31
Description: Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket which may allow cross-site scripting and client-side code execution with target user privileges.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://martem.eu/csa/Martem_CSA_Telem_1805181.pdf; http://www.securityfocus.com/bid/104286; https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01
CVE: CVE-2016-8626
Published: 2018-07-31
Description: A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-2815.html; http://rhn.redhat.com/errata/RHSA-2016-2816.html; http://rhn.redhat.com/errata/RHSA-2016-2847.html
CVE: CVE-2016-8657
Published: 2018-07-31
Description: It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jboss init script and its content executed with root privileges when jboss service is started, stopped, or restarted.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2017-0826.html; http://rhn.redhat.com/errata/RHSA-2017-0827.html; http://rhn.redhat.com/errata/RHSA-2017-0828.html
CVE: CVE-2017-5693
Published: 2018-07-31
Description: Firmware in the Intel Puma 5, 6, and 7 Series might experience resource depletion or timeout, which allows a network attacker to create a denial of service via crafted network traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/104941; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-000097.html; http://www.securityfocus.com/bid/104941
CVE: CVE-2016-8611
Published: 2018-07-31
Description: A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-20
References: http://seclists.org/oss-sec/2016/q4/266; http://www.securityfocus.com/bid/94378; http://www.securitytracker.com/id/1037312
CVE: CVE-2016-8613
Published: 2018-07-31
Description: A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/93859; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8613; https://github.com/theforeman/foreman_remote_execution/pull/208
CVE: CVE-2016-8628
Published: 2018-07-31
Description: Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
CVSS Score: 7.6 (HIGH)
CWE: CWE-77, CWE-77
References: http://www.securityfocus.com/bid/94109; https://access.redhat.com/errata/RHSA-2016:2778; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8628
CVE: CVE-2016-8631
Published: 2018-07-31
Description: The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/94110; https://access.redhat.com/errata/RHSA-2016:2696; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8631
CVE: CVE-2018-11617
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Format events for ComboBox fields. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5415.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-694; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-11618
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the resetForm method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5416.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-695; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-11619
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the setFocus method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5417.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-696; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-11620
Published: 2018-07-31
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5756.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-697; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-11621
Published: 2018-07-31
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-5896.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-698; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-11622
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-5873.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-699; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-11623
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAdLayer method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6003.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-700; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-14241
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAnnot method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6004.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-701; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-14242
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addField method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6005.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-702; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-14243
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addPageOpenJSMessage method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6006.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-703; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-14244
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the calculateNow method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6007.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-704; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-14245
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the closeDoc method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6008.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-705; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-14246
Published: 2018-07-31
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the convertTocPDF method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. The attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6009.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-706; https://www.foxitsoftware.com/support/security-bulletins.php