deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8963
Published: 2018-02-15
Description: A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.securitytracker.com/id/1039684; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us; http://www.securitytracker.com/id/1039684
CVE: CVE-2017-8964
Published: 2018-02-15
Description: A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.securitytracker.com/id/1039684; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us; http://www.securitytracker.com/id/1039684
CVE: CVE-2017-8965
Published: 2018-02-15
Description: A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.securitytracker.com/id/1039684; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us; http://www.securitytracker.com/id/1039684
CVE: CVE-2017-8966
Published: 2018-02-15
Description: A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.securitytracker.com/id/1039684; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us; http://www.securitytracker.com/id/1039684
CVE: CVE-2017-8967
Published: 2018-02-15
Description: A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.securitytracker.com/id/1039684; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03787en_us; http://www.securitytracker.com/id/1039684
CVE: CVE-2017-8969
Published: 2018-02-15
Description: An improper input validation vulnerability in HPE Insight Control version 7.6 LR1 was found.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101883; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03794en_us; http://www.securityfocus.com/bid/101883
CVE: CVE-2017-8970
Published: 2018-02-15
Description: A remote unauthenticated disclosure of information vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101938; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03795en_us; http://www.securityfocus.com/bid/101938
CVE: CVE-2017-8971
Published: 2018-02-15
Description: A clickjacking vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101938; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03795en_us; http://www.securityfocus.com/bid/101938
CVE: CVE-2017-8972
Published: 2018-02-15
Description: A clickjacking vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101938; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03795en_us; http://www.securityfocus.com/bid/101938
CVE: CVE-2017-8973
Published: 2018-02-15
Description: An improper input validation vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101938; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03795en_us; http://www.securityfocus.com/bid/101938
CVE: CVE-2017-8974
Published: 2018-02-15
Description: A Local Authentication Restriction Bypass vulnerability in HPE NonStop Server version L-Series: T6533L01 through T6533L01^ADN; J-Series and H-series: T6533H02 through T6533H04^ADF and T6533H05 through T6533H05^ADL was found.
CVSS Score: 4.4 (MEDIUM)
References: http://www.securityfocus.com/bid/102530; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbns03804en_us; http://www.securityfocus.com/bid/102530
CVE: CVE-2017-8975
Published: 2018-02-15
Description: A Remote Code Execution vulnerability in Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance version v1.20 was found.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102410; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03803en_us; http://www.securityfocus.com/bid/102410
CVE: CVE-2017-8976
Published: 2018-02-15
Description: A Remote Code Execution vulnerability in Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance version v1.20 was found.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102410; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03803en_us; http://www.securityfocus.com/bid/102410
CVE: CVE-2017-8977
Published: 2018-02-15
Description: A Remote Denial of Service vulnerability in Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance version v1.20 was found.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102410; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03803en_us; http://www.securityfocus.com/bid/102410
CVE: CVE-2017-8978
Published: 2018-02-15
Description: A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Products version MFA 4.0 proxy was found.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03806en_us; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03806en_us
CVE: CVE-2017-8979
Published: 2018-02-15
Description: Security vulnerabilities in the HPE Integrated Lights-Out 2 (iLO 2) firmware could be exploited remotely to allow authentication bypass, code execution, and denial of service.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docId=hpesbhf03797en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03797en_us; https://support.hpe.com/hpsc/doc/public/display?docId=hpesbhf03797en_us
CVE: CVE-2017-8980
Published: 2018-02-15
Description: A Remote Disclosure of Information vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102925; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03810en_us; http://www.securityfocus.com/bid/102925
CVE: CVE-2017-8981
Published: 2018-02-15
Description: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0506 was found.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03813en_us; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03813en_us
CVE: CVE-2017-8982
Published: 2018-02-15
Description: A Remote Authentication Restriction Bypass vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P4 was found.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1040283; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03809en_us; https://www.exploit-db.com/exploits/44648/
CVE: CVE-2017-8983
Published: 2018-02-15
Description: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P4 was found.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03808en_us; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03808en_us
CVE: CVE-2017-8984
Published: 2018-02-15
Description: A remote code execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0506P03 was found.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102922; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03811en_us; http://www.securityfocus.com/bid/102922
CVE: CVE-2017-8985
Published: 2018-02-15
Description: HPE XP Storage using Hitachi Global Link Manager (HGLM) has a local authenticated information disclosure vulnerability in HGLM version HGLM 6.3.0-00 to 8.5.2-00.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03819en_us; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03819en_us
CVE: CVE-2017-8993
Published: 2018-02-15
Description: A Remote Cross-Site Scripting vulnerability in HPE Project and Portfolio Management (PPM) version v9.30, v9.31, v9.32, v9.40 was found.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100087; http://www.securitytracker.com/id/1039065; https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbgn03766en_us
CVE: CVE-2018-5767
Published: 2018-02-15
Description: An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted password parameter for the COOKIE header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.exploit-db.com/exploits/44253/; https://www.fidusinfosec.com/remote-code-execution-cve-2018-5767/; https://www.exploit-db.com/exploits/44253/
CVE: CVE-2018-6316
Published: 2018-02-15
Description: Ivanti Endpoint Security (formerly HEAT Endpoint Management and Security Suite) 8.5 Update 1 and earlier allows an authenticated user with low privileges and access to the local network to bypass application whitelisting when using the Application Control module on Ivanti Endpoint Security in lockdown mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://community.ivanti.com/docs/DOC-65656; https://community.ivanti.com/docs/DOC-65656
CVE: CVE-2[PII_REDACTED]
Published: 2018-02-16
Description: An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506; https://www.oracle.com/security-alerts/cpuapr2022.html; https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506
CVE: CVE-2[PII_REDACTED]
Published: 2018-02-16
Description: An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103101; https://jenkins.io/security/advisory/2018-02-14/#SECURITY-717; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2017-14535
Published: 2018-02-16
Description: trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/162854/Trixbox-2.8.0.4-Remote-Code-Execution.html; http://www.securityfocus.com/bid/103004; https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-14535-Exploit
CVE: CVE-2017-14536
Published: 2018-02-16
Description: trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103009; https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-cross-site-scripting-vulnerabilities/; http://www.securityfocus.com/bid/103009
CVE: CVE-2017-14537
Published: 2018-02-16
Description: trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/162853/Trixbox-2.8.0.4-Path-Traversal.html; http://www.securityfocus.com/bid/103007; https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-14537-Exploit
CVE: CVE-2018-6189
Published: 2018-02-16
Description: F-Secure Radar (on-premises) before 2018-02-15 has XSS via vectors involving the Tags parameter in the JSON request body in an outbound request for the /api/latest/vulnerabilityscans/tags/batch resource, aka a "suggested metadata tags for assets" issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://oscarhjelm.com/blag/2018/02/f-secure-radar-persistent-cross-site-scripting-vulnerability/; http://www.securityfocus.com/bid/103100; http://oscarhjelm.com/blag/2018/02/f-secure-radar-persistent-cross-site-scripting-vulnerability/
CVE: CVE-2018-6324
Published: 2018-02-16
Description: F-Secure Radar (on-premises) before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://oscarhjelm.com/blag/2018/02/f-secure-radar-login-page-unvalidated-redirect-vulnerability/; http://www.securityfocus.com/bid/103208; http://oscarhjelm.com/blag/2018/02/f-secure-radar-login-page-unvalidated-redirect-vulnerability/
CVE: CVE-2018-7176
Published: 2018-02-16
Description: FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://securitywarrior9.blogspot.in/2018/02/cross-site-request-forgery-front.html; https://www.exploit-db.com/exploits/44137/; https://securitywarrior9.blogspot.in/2018/02/cross-site-request-forgery-front.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-5379. Reason: This candidate is a reservation duplicate of CVE-2018-5379. Notes: All CVE users should reference CVE-2018-5379 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2018-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-5378. Reason: This candidate is a reservation duplicate of CVE-2018-5378. Notes: All CVE users should reference CVE-2018-5378 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2018-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-5381. Reason: This candidate is a reservation duplicate of CVE-2018-5381. Notes: All CVE users should reference CVE-2018-5381 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2018-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-5380. Reason: This candidate is a reservation duplicate of CVE-2018-5380. Notes: All CVE users should reference CVE-2018-5380 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-6943
Published: 2018-02-16
Description: core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/146403/WordPress-UltimateMember-2.0-Cross-Site-Scripting.html; https://wpvulndb.com/vulnerabilities/9705; https://packetstormsecurity.com/files/146403/WordPress-UltimateMember-2.0-Cross-Site-Scripting.html
CVE: CVE-2018-6944
Published: 2018-02-16
Description: core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/146403/WordPress-UltimateMember-2.0-Cross-Site-Scripting.html; https://wpvulndb.com/vulnerabilities/9705; https://packetstormsecurity.com/files/146403/WordPress-UltimateMember-2.0-Cross-Site-Scripting.html
CVE: CVE-2018-7186
Published: 2018-02-16
Description: Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.debian.org/890548; https://github.com/DanBloomberg/leptonica/commit/ee301cb2029db8a6289c5295daa42bba7715e99a; https://lists.debian.org/debian-lts-announce/2018/03/msg00005.html
CVE: CVE-2017-18190
Published: 2018-02-16
Description: A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1048; https://github.com/apple/cups/commit/afa80cb2b457bf8d64f775bed[PII_REDACTED]76c41; https://lists.debian.org/debian-lts-announce/2018/02/msg00023.html
CVE: CVE-2018-0515
Published: 2018-02-16
Description: Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://flets.com/azukeru/login/news/info_180213.html; https://jvn.jp/en/jp/JVN04564808/index.html; https://flets.com/azukeru/login/news/info_180213.html
CVE: CVE-2018-0516
Published: 2018-02-16
Description: Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://flets-w.com/topics/2018/20180207a.html; https://jvn.jp/en/jp/JVN87403477/index.html; http://flets-w.com/topics/2018/20180207a.html
CVE: CVE-2018-7187
Published: 2018-02-16
Description: The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc; https://github.com/golang/go/issues/23867; https://lists.debian.org/debian-lts-announce/2018/02/msg00029.html
CVE: CVE-2017-18089
Published: 2018-02-16
Description: The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the invited reviewers for a review.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103075; https://jira.atlassian.com/browse/CRUC-8169; http://www.securityfocus.com/bid/103075
CVE: CVE-2017-18090
Published: 2018-02-16
Description: Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103076; https://jira.atlassian.com/browse/FE-7000; http://www.securityfocus.com/bid/103076
CVE: CVE-2017-18091
Published: 2018-02-16
Description: The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103079; https://jira.atlassian.com/browse/CRUC-8173; https://jira.atlassian.com/browse/FE-7006
CVE: CVE-2018-7188
Published: 2018-02-16
Description: An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2018/02/16/1; https://sourceforge.net/p/tikiwiki/code/65327; http://openwall.com/lists/oss-security/2018/02/16/1
CVE: CVE-2018-1049
Published: 2018-02-16
Description: In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: http://www.securitytracker.com/id/1041520; https://access.redhat.com/errata/RHSA-2018:0260; https://bugzilla.redhat.com/show_bug.cgi?id=1534701
CVE: CVE-2018-3609
Published: 2018-02-16
Description: A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.
CVSS Score: 8.1 (HIGH)
CWE: CWE-522, CWE-532
References: http://www.securityfocus.com/bid/103097; https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt; https://success.trendmicro.com/jp/solution/1119290
CVE: CVE-2018-6218
Published: 2018-02-16
Description: A DLL Hijacking vulnerability in Trend Micro's User-Mode Hooking Module (UMH) could allow an attacker to run arbitrary code on a vulnerable system.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/103096; https://jvn.jp/jp/JVN28865183/; https://success.trendmicro.com/jp/solution/1119348
CVE: CVE-2018-5970
Published: 2018-02-17
Description: SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44116; https://exploit-db.com/exploits/44116
CVE: CVE-2018-5971
Published: 2018-02-17
Description: SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44122; https://exploit-db.com/exploits/44122
CVE: CVE-2018-5974
Published: 2018-02-17
Description: SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44126; https://exploit-db.com/exploits/44126
CVE: CVE-2018-5975
Published: 2018-02-17
Description: SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44127; https://exploit-db.com/exploits/44127