deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-3867
Published: 2018-08-23
Description: An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly handles the answer received from a smart camera, leading to a buffer overflow on the stack. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0549; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0549
CVE: CVE-2018-3878
Published: 2018-08-23
Description: Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. A strncpy overflows the destination buffer, which has a size of 16 bytes. An attacker can send an arbitrarily long "region" value in order to exploit this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0555; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0555
CVE: CVE-2018-3879
Published: 2018-08-23
Description: An exploitable JSON injection vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly parses the user-controlled JSON payload, leading to a JSON injection which in turn leads to a SQL injection in the video-core database. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0556; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0556
CVE: CVE-2018-3902
Published: 2018-08-23
Description: An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0573; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0573
CVE: CVE-2018-3903
Published: 2018-08-23
Description: On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The memcpy call overflows the destination buffer, which has a size of 512 bytes. An attacker can send an arbitrarily long "url" value in order to overwrite the saved-PC with 0x42424242.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0574; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0574
CVE: CVE-2018-3905
Published: 2018-08-23
Description: An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the "state" field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0575; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0575
CVE: CVE-2018-3917
Published: 2018-08-23
Description: On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The strcpy call overflows the destination buffer, which has a size of 16 bytes. An attacker can send an arbitrarily long "region" value in order to exploit this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0581; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0581
CVE: CVE-2018-3919
Published: 2018-08-23
Description: An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely extracts the fields from the "clips" table of its SQLite database, leading to a buffer overflow on the stack. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0583; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0583
CVE: CVE-2018-3925
Published: 2018-08-23
Description: An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely parses the AWSELB cookie while communicating with remote video-host servers, leading to a buffer overflow on the heap. An attacker able to impersonate the remote HTTP servers could trigger this vulnerability.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0591; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0591
CVE: CVE-2018-8028
Published: 2018-08-23
Description: An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://cwiki.apache.org/confluence/display/SENTRY/Vulnerabilities+found+in+Apache+Sentry; https://cwiki.apache.org/confluence/display/SENTRY/Vulnerabilities+found+in+Apache+Sentry
CVE: CVE-2017-14452
Published: 2018-08-23
Description: An exploitable buffer overflow vulnerability exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. A strcpy overflows the buffer insteon_pubnub.channel_cc_r, which has a size of 16 bytes. An attacker can send an arbitrarily long "c_r" parameter in order to exploit this vulnerability. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0502; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0502
CVE: CVE-2018-15804
Published: 2018-08-23
Description: An issue was discovered in the MapR File System in MapR Converged Data Platform and MapR-XD 6.x and earlier. Under certain conditions, it is possible for MapR ticket credentials to become compromised, allowing a user to escalate their privileges to act as (aka impersonate) any other user, including cluster administrators, aka bug# 31935. This affects all users who have enabled security on the MapR platform and is fixed in mapr-patch-5.2.1.42646.GA[PII_REDACTED]3831, mapr-patch-5.2.2.44680.GA[PII_REDACTED]1430, mapr-patch-6.0.0[PII_REDACTED]1718.GA[PII_REDACTED]1420, and mapr-patch-6.0.[PII_REDACTED]2005.GA[PII_REDACTED]4919.
CVSS Score: 8.8 (HIGH)
References: https://mapr.com/support/s/article/MapR-Ticket-Credentials-can-become-compromised; https://mapr.com/support/s/article/MapR-Ticket-Credentials-can-become-compromised
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-23
Description: A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-502
References: https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637; https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-23
Description: A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://jenkins.io/security/advisory/2018-08-15/#SECURITY-672; https://jenkins.io/security/advisory/2018-08-15/#SECURITY-672
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-23
Description: A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://jenkins.io/security/advisory/2018-08-15/#SECURITY-790; https://jenkins.io/security/advisory/2018-08-15/#SECURITY-790
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-23
Description: A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://jenkins.io/security/advisory/2018-08-15/#SECURITY-996; https://jenkins.io/security/advisory/2018-08-15/#SECURITY-996
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-23
Description: A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1071; https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1071
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-23
Description: A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1076; https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1076
CVE: CVE-2018-3912
Published: 2018-08-23
Description: On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. The strcpy call overflows the destination buffer, which has a size of 128 bytes. An attacker can send an arbitrarily long "secretKey" value in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0581; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0581
CVE: CVE-2003-1605
Published: 2018-08-23
Description: curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://www.securityfocus.com/bid/8432; https://curl.haxx.se/docs/CVE-2003-1605.html; http://www.securityfocus.com/bid/8432
CVE: CVE-2018-1156
Published: 2018-08-23
Description: Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://mikrotik.com/download/changelogs; https://mikrotik.com/download/changelogs/bugfix-release-tree; https://www.tenable.com/security/research/tra-2018-21
CVE: CVE-2018-1157
Published: 2018-08-23
Description: Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://seclists.org/fulldisclosure/2019/Jul/20; https://mikrotik.com/download/changelogs; https://mikrotik.com/download/changelogs/bugfix-release-tree
CVE: CVE-2018-1158
Published: 2018-08-23
Description: Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: http://seclists.org/fulldisclosure/2019/Jul/20; https://mikrotik.com/download/changelogs; https://mikrotik.com/download/changelogs/bugfix-release-tree
CVE: CVE-2018-1159
Published: 2018-08-23
Description: Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://mikrotik.com/download/changelogs; https://mikrotik.com/download/changelogs/bugfix-release-tree; https://www.tenable.com/security/research/tra-2018-21
CVE: CVE-2018-14786
Published: 2018-08-23
Description: Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affected by an improper authentication vulnerability where the software does not perform authentication for functionality that requires a provable user identity, where it may allow a remote attacker to gain unauthorized access to various Alaris Syringe pumps and impact the intended operation of the pump when it is connected to a terminal server via the serial port.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletin-for-various-alaris-plus-syringe-pumps-sold-and-in-use-outside-the-united-states; http://www.securityfocus.com/bid/105147; https://ics-cert.us-cert.gov/advisories/ICSMA-18-235-01
CVE: CVE-2018-14791
Published: 2018-08-23
Description: Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on the affected products.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: http://www.securityfocus.com/bid/105105; https://ics-cert.us-cert.gov/advisories/ICSA-18-228-01; http://www.securityfocus.com/bid/105105
CVE: CVE-2018-14797
Published: 2018-08-23
Description: Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: http://www.securityfocus.com/bid/105105; https://ics-cert.us-cert.gov/advisories/ICSA-18-228-01; http://www.securityfocus.com/bid/105105
CVE: CVE-2018-6558
Published: 2018-08-23
Description: The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/google/fscrypt/commit/3022c1603d968c22f147b4a2c49c4637dd1be91b; https://github.com/google/fscrypt/commit/315f9b[PII_REDACTED]74a1fb99427f74027e191d66; https://github.com/google/fscrypt/issues/77
CVE: CVE-2018-15807
Published: 2018-08-23
Description: POSIM EVO 15.13 for Windows includes an "Emergency Override" administrative account that may be accessed through POSIM's "override" feature. This Override prompt expects a code that is computed locally using a deterministic algorithm. This code may be generated by an attacker and used to bypass any POSIM EVO login prompt.
CVSS Score: 7.8 (HIGH)
CWE: CWE-330
References: https://versprite.com/advisories/posim-evo-for-windows/; https://versprite.com/advisories/posim-evo-for-windows/
CVE: CVE-2018-15808
Published: 2018-08-23
Description: POSIM EVO 15.13 for Windows includes hardcoded database credentials for the "root" database user. "root" access to POSIM EVO's database may result in a breach of confidentiality, integrity, or availability or allow for attackers to remotely execute code on associated POSIM EVO clients.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://versprite.com/advisories/posim-evo-for-windows-2/; https://versprite.com/advisories/posim-evo-for-windows-2/
CVE: CVE-2018-15809
Published: 2018-08-23
Description: AccuPOS 2017.8 is installed with the insecure "Authenticated Users: Modify" permission for files within the installation path. This may allow local attackers to compromise the integrity of critical resource and executable files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://versprite.com/advisories/accupos/; https://versprite.com/advisories/accupos/
CVE: CVE-2018-3856
Published: 2018-08-23
Description: An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-88
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0539; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0539
CVE: CVE-2018-3866
Published: 2018-08-23
Description: An exploitable buffer overflow vulnerability exists in the samsungWifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strcpy at [8] overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long 'callbackUrl' value in order to exploit this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0548; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0548
CVE: CVE-2018-3872
Published: 2018-08-23
Description: An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts the videoHostUrl field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0554; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0554
CVE: CVE-2018-3880
Published: 2018-08-23
Description: An exploitable stack-based buffer overflow vulnerability exists in the database 'find-by-cameraId' functionality of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles existing records inside its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0557; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0557
CVE: CVE-2018-3911
Published: 2018-08-23
Description: An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated toward the internal video-core process. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-113
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0578; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0578
CVE: CVE-2018-15822
Published: 2018-08-23
Description: The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertion failure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/FFmpeg/FFmpeg/commit/6b67d7f05918f7a1ee8fc6ff21355d7e8736aa10; https://github.com/FFmpeg/FFmpeg/commit/d8ecb335fe4852bbc172c7b79e66944d158b4d92; https://lists.debian.org/debian-lts-announce/2019/05/msg00043.html
CVE: CVE-2018-3907
Published: 2018-08-24
Description: An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, 'on_url' callback. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-444
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577
CVE: CVE-2018-3909
Published: 2018-08-24
Description: An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, 'onmessagecomplete' callback. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-444
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577
CVE: CVE-2018-1699
Published: 2018-08-24
Description: IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145968.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/105189; https://exchange.xforce.ibmcloud.com/vulnerabilities/145968; https://www.ibm.com/support/docview.wss?uid=ibm10725805
CVE: CVE-2018-1722
Published: 2018-08-24
Description: IBM Security Access Manager Appliance 9.0.4.0 and 9.0.5.0 could allow remote code execution when Advanced Access Control or Federation services are running. IBM X-Force ID: 147370.
CVSS Score: 10.0 (CRITICAL)
References: http://www.securityfocus.com/bid/105145; http://www.securitytracker.com/id/1041557; https://exchange.xforce.ibmcloud.com/vulnerabilities/147370