deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7480
Published: 2018-02-25
Description: The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b54d816e00425c3a517514e0d677bb3cec49258; https://github.com/torvalds/linux/commit/9b54d816e00425c3a517514e0d677bb3cec49258; https://usn.ubuntu.com/3654-1/
CVE: CVE-2017-15696
Published: 2018-02-26
Description: When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f%40%3Cdev.geode.apache.org%3E; https://lists.apache.org/thread.html/28989e6ed0d3c29e46a489ae508302a50407a40691d5dc968f78cd3f%40%3Cdev.geode.apache.org%3E
CVE: CVE-2018-7484
Published: 2018-02-26
Description: An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT Authority\SYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified path, the application will first try to load the library from the directory from which the application is started. As the residing directory of PureVPNService.exe is writable to all users, this makes the application susceptible to privilege escalation through DLL hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.defensecode.com/advisories/DC-2018-02-001-PureVPN-Windows-Privilege-Escalation.pdf; https://www.securityfocus.com/archive/1/541803; http://www.defensecode.com/advisories/DC-2018-02-001-PureVPN-Windows-Privilege-Escalation.pdf
CVE: CVE-2017-18200
Published: 2018-02-26
Description: The f2fs implementation in the Linux kernel before 4.14 mishandles reference counts associated with f2fs_wait_discard_bios calls, which allows local users to cause a denial of service (BUG), as demonstrated by fstrim.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=638164a2718f337ea224b747cf5977ef143166a4; https://github.com/torvalds/linux/commit/638164a2718f337ea224b747cf5977ef143166a4; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=638164a2718f337ea224b747cf5977ef143166a4
CVE: CVE-2018-7479
Published: 2018-02-26
Description: YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://github.com/kongxin520/YzmCMS/blob/master/YzmCMS_3.6_bug.md; https://kongxin.gitbook.io/yzmcms-3-6-bug/; https://github.com/kongxin520/YzmCMS/blob/master/YzmCMS_3.6_bug.md
CVE: CVE-2017-9425
Published: 2018-02-26
Description: The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://touhidshaikh.com/blog/poc/facetag-ext-piwigo-stored-xss/; https://www.exploit-db.com/exploits/42098/; https://www.youtube.com/watch?v=_ha7XBT_Omo
CVE: CVE-2017-9426
Published: 2018-02-26
Description: ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://touhidshaikh.com/blog/poc/facetag-extension-piwigo-sqli/; https://www.exploit-db.com/exploits/42094/; https://www.youtube.com/watch?v=MVCe_zYtFsQ
CVE: CVE-2018-7463
Published: 2018-02-26
Description: SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2017-1774
Published: 2018-02-26
Description: IBM Security Guardium Big Data Intelligence (SonarG) 3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 136818.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22013595; http://www.securityfocus.com/bid/103214; https://exchange.xforce.ibmcloud.com/vulnerabilities/136818
CVE: CVE-2017-18201
Published: 2018-02-26
Description: An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://www.securityfocus.com/bid/103190; https://access.redhat.com/errata/RHSA-2018:3246; https://git.savannah.gnu.org/cgit/libcdio.git/commit/?id=f6f9c48fb40b8a1e[PII_REDACTED]b0b61a7161eb1d
CVE: CVE-2018-1377
Published: 2018-02-26
Description: IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 137778.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://www.ibm.com/support/docview.wss?uid=swg22013596; http://www.securityfocus.com/bid/103213; https://exchange.xforce.ibmcloud.com/vulnerabilities/137778
CVE: CVE-2018-7485
Published: 2018-02-26
Description: The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103193; https://access.redhat.com/errata/RHSA-2019:2336; https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4e[PII_REDACTED]69d8e2963aL24
CVE: CVE-2018-7486
Published: 2018-02-26
Description: Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an [m]$.dspinclude("../pathname/executable.jpeg")[/m] approach, where executable.jpeg contains ColdFusion Markup Language code. This can be exploited in conjunction with a CKFinder feature that allows file upload.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: http://bekhzod0725.github.io/cybersecurity/2018/02/16/exploiting-muracms.html; http://bekhzod0725.github.io/cybersecurity/2018/02/16/exploiting-muracms.html
CVE: CVE-2018-5762
Published: 2018-02-26
Description: The TLS implementation in the TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 58.1 before 58.160, 59.1 before 059.1a.17 (IC #17), and 60.0 before 60.044 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
CVSS Score: 5.9 (MEDIUM)
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=46; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=46
CVE: CVE-2018-7487
Published: 2018-02-26
Description: There is a heap-based buffer overflow in the LoadPCX function of in_pcx.cpp in sam2p 0.49.4. A Crafted input will lead to a denial of service or possibly unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/pts/sam2p/issues/18; https://lists.debian.org/debian-lts-announce/2018/04/msg00004.html; https://github.com/pts/sam2p/issues/18
CVE: CVE-2018-7489
Published: 2018-02-26
Description: FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184, CWE-502
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2017-18195
Published: 2018-02-26
Description: An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/concrete5/concrete5/pull/6008/files; https://github.com/concrete5/concrete5/releases/tag/8.3.0; https://github.com/r3naissance/NSE/blob/master/http-vuln-cve2017-18195.nse
CVE: CVE-2018-7448
Published: 2018-02-26
Description: Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://dev.cmsmadesimple.org/project/changelog/5471; https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/44192/
CVE: CVE-2018-7491
Published: 2018-02-26
Description: In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors' values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1021
References: http://forge.prestashop.com/browse/BOOM-4917; https://github.com/PrestaShop/PrestaShop/pull/8807; http://forge.prestashop.com/browse/BOOM-4917
CVE: CVE-2018-7249
Published: 2018-02-26
Description: An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls to IOCTL 0xCA002813 can cause a race condition that leads to a use-after-free. When exploited, an unprivileged attacker can run arbitrary code in the kernel.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://github.com/Elvin9/NotSecDrv/blob/master/README.md; https://github.com/Elvin9/NotSecDrv/blob/master/README.md
CVE: CVE-2018-7250
Published: 2018-02-26
Description: An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. An uninitialized kernel pool allocation in IOCTL 0xCA002813 allows a local unprivileged attacker to leak 16 bits of uninitialized kernel PagedPool data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/Elvin9/SecDrvPoolLeak/blob/master/README.md; https://github.com/Elvin9/SecDrvPoolLeak/blob/master/README.md
CVE: CVE-2018-7492
Published: 2018-02-26
Description: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f3069c6d33f6ae63a1668737bc78aaaa51bff7ca; http://www.securityfocus.com/bid/103185; https://bugzilla.redhat.com/show_bug.cgi?id=1527393
CVE: CVE-2017-11632
Published: 2018-02-26
Description: An issue was discovered on Wireless IP Camera 360 devices. A root account with a known SHA-512 password hash exists, which makes it easier for remote attackers to obtain administrative access via a TELNET session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/eloygn/IT_Security_Research_WirelessIP_camera_family; https://github.com/eloygn/IT_Security_Research_WirelessIP_camera_family
CVE: CVE-2017-11633
Published: 2018-02-26
Description: An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover RTSP credentials by connecting to TCP port 9527 and reading the InsertConnect field.
CVSS Score: 7.5 (HIGH)
References: https://github.com/eloygn/IT_Security_Research_WirelessIP_camera_family; https://github.com/eloygn/IT_Security_Research_WirelessIP_camera_family
CVE: CVE-2017-11634
Published: 2018-02-26
Description: An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover a weakly encoded admin password by connecting to TCP port 9527 and reading the password field of the debugging information, e.g., nTBCS19C corresponds to a password of 123456.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/eloygn/IT_Security_Research_WirelessIP_camera_family; https://github.com/eloygn/IT_Security_Research_WirelessIP_camera_family
CVE: CVE-2017-11635
Published: 2018-02-26
Description: An issue was discovered on Wireless IP Camera 360 devices. Attackers can read recordings by navigating to /mnt/idea0 or /mnt/idea1 on the SD memory card.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/eloygn/IT_Security_Research_WirelessIP_camera_family; https://github.com/eloygn/IT_Security_Research_WirelessIP_camera_family
CVE: CVE-2017-16229
Published: 2018-02-26
Description: In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is supplied to sax_parse.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ohler55/ox/issues/195; https://rubygems.org/gems/ox/versions/2.8.1; https://github.com/ohler55/ox/issues/195
CVE: CVE-2017-16813
Published: 2018-02-26
Description: A denial-of-service issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs when a user uploads a file that includes a hexadecimal Unicode character in the "filename" parameter via Wi-Fi, since the app could fail to parse this.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16814
Published: 2018-02-26
Description: A Directory Traversal issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs by abusing the URL + escape character during a Wi-Fi transfer, which could be exploited by attackers to bypass intended restrictions on local application files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-0908
Published: 2018-02-26
Description: Microsoft Identity Manager 2016 SP1 allows an attacker to gain elevated privileges when it does not properly sanitize a specially crafted attribute value being displayed to a user on an affected MIM 2016 server, aka "Microsoft Identity Manager XSS Elevation of Privilege Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103112; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0908; http://www.securityfocus.com/bid/103112
CVE: CVE-2018-7490
Published: 2018-02-26
Description: uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html; https://www.debian.org/security/2018/dsa-4142; https://www.exploit-db.com/exploits/44223/
CVE: CVE-2018-4872
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability is a security bypass vulnerability that leads to a sandbox escape. Specifically, the vulnerability exists in the way a cross call is handled.
CVSS Score: 10.0 (CRITICAL)
References: http://www.securityfocus.com/bid/102993; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4875
Published: 2018-02-27
Description: Adobe Experience Manager versions 6.1 and 6.0 are vulnerable to a reflected cross-site scripting vulnerability related to the handling of malicious content embedded in image files uploaded to the DAM.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102991; http://www.securitytracker.com/id/1040365; https://helpx.adobe.com/security/products/experience-manager/apsb18-04.html
CVE: CVE-2018-4876
Published: 2018-02-27
Description: Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPI#getValidHref function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102990; http://www.securitytracker.com/id/1040365; https://helpx.adobe.com/security/products/experience-manager/apsb18-04.html
CVE: CVE-2018-4879
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the image conversion module that processes Enhanced Metafile Format Plus (EMF+) data. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102994; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4880
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the conversion module that reads U3D data. A successful attack can lead to sensitive data exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102996; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4881
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the image conversion module that reads bitmap image file (BMP) data. A successful attack can lead to sensitive data exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102996; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4882
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the string literal parser. A successful attack can lead to sensitive data exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102996; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4883
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability occurs because of computation that reads data that is past the end of the target buffer; the computation is part of the image conversion engine that handles Enhanced Metafile Format (EMF). A successful attack can lead to sensitive data exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102996; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4884
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the image conversion engine when processing Enhanced Metafile Format (EMF) data that embeds an image in the bitmap (BMP) file format. A successful attack can lead to sensitive data exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102996; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4885
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of Enhanced Metafile Format processing engine (within the image conversion module). A successful attack can lead to sensitive data exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102996; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4886
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation occurs in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to handling of bitmap rectangles. A successful attack can lead to sensitive data exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102996; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4887
Published: 2018-02-27
Description: An issue was discovered in Adobe Acrobat Reader 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]0 and earlier versions, 2[PII_REDACTED]4 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the Unicode mapping module that is invoked when processing Enhanced Metafile Format (EMF) data (during image conversion). A successful attack can lead to sensitive data exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102996; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html