deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0660
Published: 2018-09-07
Description: Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file.
CVSS Score: 3.3 (LOW)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN62121133/index.html; https://hibara.org/software/attachecase/?lang=en; http://jvn.jp/en/jp/JVN62121133/index.html
CVE: CVE-2018-0661
Published: 2018-09-07
Description: Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to bypass access restriction to add files on a specific directory that may result in executing arbitrary OS commands/code or information including credentials leakage or alteration.
CVSS Score: 8.8 (HIGH)
References: http://jvn.jp/en/jp/JVN83701666/index.html; http://www.iodata.jp/support/information/2018/ts-wrlp/; http://jvn.jp/en/jp/JVN83701666/index.html
CVE: CVE-2018-0662
Published: 2018-09-07
Description: Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to add malicious files on the device and execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN83701666/index.html; http://www.iodata.jp/support/information/2018/ts-wrlp/; http://jvn.jp/en/jp/JVN83701666/index.html
CVE: CVE-2018-0663
Published: 2018-09-07
Description: Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) use hardcoded credentials which may allow an remote authenticated attacker to execute arbitrary OS commands on the device via unspecified vector.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: http://jvn.jp/en/jp/JVN83701666/index.html; http://www.iodata.jp/support/information/2018/ts-wrlp/; http://jvn.jp/en/jp/JVN83701666/index.html
CVE: CVE-2018-16657
Published: 2018-09-07
Description: In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Kamailio. The reason is missing input validation in the crcitt_string_array core function for calculating a CRC hash for To tags. (An additional error is present in the check_via_address core function: this function also misses input validation.) This could result in denial of service and potentially the execution of arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://lists.debian.org/debian-lts-announce/2018/09/msg00013.html; https://skalatan.de/blog/advisory-hw-2018-06; https://www.debian.org/security/2018/dsa-4292
CVE: CVE-2018-16658
Published: 2018-09-07
Description: An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4; http://www.securityfocus.com/bid/105334; https://access.redhat.com/errata/RHSA-2019:2029
CVE: CVE-2017-1114
Published: 2018-09-07
Description: IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121152.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/121152; https://www.ibm.com/support/docview.wss?uid=ibm10729773; https://exchange.xforce.ibmcloud.com/vulnerabilities/121152
CVE: CVE-2017-1115
Published: 2018-09-07
Description: IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/121153; https://www.ibm.com/support/docview.wss?uid=ibm10729769; https://exchange.xforce.ibmcloud.com/vulnerabilities/121153
CVE: CVE-2018-1567
Published: 2018-09-07
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialized object from untrusted sources. IBM X-Force ID: 143024.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.securitytracker.com/id/1041644; https://exchange.xforce.ibmcloud.com/vulnerabilities/143024; https://www.ibm.com/support/docview.wss?uid=swg22016254
CVE: CVE-2018-1756
Published: 2018-09-07
Description: IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, information in the back-end database. IBM X-Force ID: 148599.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=ibm10728883; https://exchange.xforce.ibmcloud.com/vulnerabilities/148599; https://www.exploit-db.com/exploits/45392/
CVE: CVE-2018-1757
Published: 2018-09-07
Description: IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing authentication in IGI for the survey application. IBM X-Force ID: 148601.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: http://www.ibm.com/support/docview.wss?uid=ibm10728883; https://exchange.xforce.ibmcloud.com/vulnerabilities/148601; http://www.ibm.com/support/docview.wss?uid=ibm10728883
CVE: CVE-2018-1789
Published: 2018-09-07
Description: IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.
CVSS Score: 8.4 (HIGH)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/148939; https://www.ibm.com/support/docview.wss?uid=ibm10728517; https://exchange.xforce.ibmcloud.com/vulnerabilities/148939
CVE: CVE-2018-3952
Published: 2018-09-07
Description: An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially crafted configuration file can cause a privilege escalation, resulting in the execution of arbitrary commands with system privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/105312; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0622; http://www.securityfocus.com/bid/105312
CVE: CVE-2018-4010
Published: 2018-09-07
Description: An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specially crafted configuration file can cause a privilege escalation, resulting in the ability to execute arbitrary commands with the system's privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/105319; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0679; http://www.securityfocus.com/bid/105319
CVE: CVE-2017-2792
Published: 2018-09-07
Description: An exploitable heap corruption vulnerability exists in the iBldDirInfo functionality of Antenna House DMC HTMLFilter used by MarkLogic 8.0-6. A specially crafted xls file can cause a heap corruption resulting in arbitrary code execution. An attacker can provide a malicious xls file to trigger this vulnerability.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0284; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0284
CVE: CVE-2017-2795
Published: 2018-09-07
Description: An exploitable heap corruption vulnerability exists in the Txo functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted xls file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide malicious XLS file to trigger this vulnerability.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0288; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0288
CVE: CVE-2016-9044
Published: 2018-09-07
Description: An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can cause a command injection. An authenticated attacker can send a crafted web request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0315; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0315
CVE: CVE-2018-16663
Published: 2018-09-07
Description: An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parse_relations in os/storage/antelope/aql-parser.c while parsing AQL (storage of relations).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/contiki-ng/contiki-ng/issues/599; https://github.com/contiki-ng/contiki-ng/issues/599
CVE: CVE-2018-16664
Published: 2018-09-07
Description: An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow in lvm_set_type in os/storage/antelope/lvm.c while parsing AQL (lvm_set_op, lvm_set_relation, lvm_set_operand).
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: https://github.com/contiki-ng/contiki-ng/issues/596; https://github.com/contiki-ng/contiki-ng/issues/596
CVE: CVE-2018-16665
Published: 2018-09-07
Description: An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvm_shift_for_operator in os/storage/antelope/lvm.c.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: https://github.com/contiki-ng/contiki-ng/issues/598; https://github.com/contiki-ng/contiki-ng/issues/598
CVE: CVE-2018-16666
Published: 2018-09-07
Description: An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in next_string in os/storage/antelope/aql-lexer.c while parsing AQL (parsing next string).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/contiki-ng/contiki-ng/issues/595; https://github.com/contiki-ng/contiki-ng/issues/595
CVE: CVE-2018-16667
Published: 2018-09-07
Description: An issue was discovered in Contiki-NG through 4.1. There is a buffer over-read in lookup in os/storage/antelope/lvm.c while parsing AQL (lvm_register_variable, lvm_set_variable_value, create_intersection, create_union).
CVSS Score: 7.0 (HIGH)
CWE: CWE-125
References: https://github.com/contiki-ng/contiki-ng/issues/597; https://github.com/contiki-ng/contiki-ng/issues/597
CVE: CVE-2018-16703
Published: 2018-09-07
Description: A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in excess of the configured login attempt limit. The vulnerability is due to insufficient server-side access control and login attempt limit enforcement. An attacker could exploit this vulnerability by sending modified login attempts to the Portal login page. An exploit could allow the attacker to identify existing users and perform brute-force password attacks on the Portal, as demonstrated by navigating to the user/4 URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-521, CWE-732
References: https://github.com/gleez/cms/issues/802; https://github.com/gleez/cms/issues/802
CVE: CVE-2018-16704
Published: 2018-09-07
Description: An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possible for attackers (logged in users) to view profile page of other users, as demonstrated by navigating to user/3 on demo.gleezcms.org.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/gleez/cms/issues/801; https://github.com/gleez/cms/issues/801
CVE: CVE-2018-16460
Published: 2018-09-07
Description: A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://hackerone.com/reports/390848; https://hackerone.com/reports/390848
CVE: CVE-2018-16709
Published: 2018-09-07
Description: Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-V C5576, DocuCentre-IV C2263, DocuCentre-V C2263, and ApeosPort-V 5070 devices allow remote attackers to read or write to files via crafted PJL commands.
CVSS Score: 9.8 (CRITICAL)
References: https://www.exploit-db.com/exploits/45332/; https://www.exploit-db.com/exploits/45332/
CVE: CVE-2018-16710
Published: 2018-09-07
Description: OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor disputes the significance of this report because their documentation states that with "blind port forwarding ... Putting OctoPrint onto the public internet is a terrible idea, and I really can't emphasize that enough.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://github.com/foosel/OctoPrint/issues/2814; https://github.com/foosel/OctoPrint/issues/2814
CVE: CVE-2017-17691
Published: 2018-09-07
Description: Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client instances, which allows remote attackers to obtain sensitive information via a man in the middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-522
References: https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-031_homematic.txt; https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-031_homematic.txt
CVE: CVE-2018-12897
Published: 2018-09-07
Description: SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153668/DameWare-Remote-Support-12.0.0.509-Buffer-Overflow.html; https://labs.nettitude.com/blog/solarwinds-cve-2018-12897-dameware-mini-remote-control-local-seh-buffer-overflow/; http://packetstormsecurity.com/files/153668/DameWare-Remote-Support-12.0.0.509-Buffer-Overflow.html
CVE: CVE-2018-14396
Published: 2018-09-07
Description: An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/; https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/
CVE: CVE-2018-14397
Published: 2018-09-07
Description: An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/; https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/
CVE: CVE-2018-14398
Published: 2018-09-07
Description: An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into visiting a fake login page in order to steal credentials.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/; https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/
CVE: CVE-2018-15474
Published: 2018-09-07
Description: CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export.  NOTE: the vendor has stated "this is not a security problem in DokuWiki.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-1236
References: https://github.com/splitbrain/dokuwiki/issues/2450; https://seclists.org/fulldisclosure/2018/Sep/4; https://www.patreon.com/posts/unfixed-security-21250652
CVE: CVE-2018-15483
Published: 2018-09-07
Description: An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html; https://www.kone.com/en/vulnerability.aspx; http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html
CVE: CVE-2018-15484
Published: 2018-09-07
Description: An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface by modifying autoexec.bat, aka KONE-01.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html; https://www.kone.com/en/vulnerability.aspx; http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html
CVE: CVE-2018-15485
Published: 2018-09-07
Description: An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require authentication or authorization, aka KONE-03.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html; https://www.kone.com/en/vulnerability.aspx; http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html
CVE: CVE-2018-15486
Published: 2018-09-07
Description: An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka KONE-02.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-829
References: http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html; https://www.kone.com/en/vulnerability.aspx; http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html
CVE: CVE-2018-15552
Published: 2018-09-07
Description: The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-15552; https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-15552
CVE: CVE-2018-16059
Published: 2018-09-07
Description: Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/107416; https://cert.vde.com/en-us/advisories/vde-2019-002; https://ics-cert.us-cert.gov/advisories/ICSA-19-073-03
CVE: CVE-2018-16363
Published: 2018-09-07
Description: The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://blog.51cto.com/010bjsoft/2171087; https://plugins.trac.wordpress.org/changeset/1936043; https://wordpress.org/support/topic/security-concern-6/#post-10655739
CVE: CVE-2018-16454
Published: 2018-09-07
Description: PHP Scripts Mall Currency Converter Script 2.0.5 allows remote attackers to cause a denial of service (web-interface change) via an inverted comma.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://googlequeens.com/2018/09/04/cve-2018-16454-currency-converter-script-2-0-5-has-buffer-overflow; https://googlequeens.com/2018/09/04/cve-2018-16454-currency-converter-script-2-0-5-has-buffer-overflow
CVE: CVE-2018-9283
Published: 2018-09-07
Description: An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters in the contact creation and modification page. The payload is stored within the application database and allows the execution of JavaScript code each time a client visit an infected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/; https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/
CVE: CVE-2018-16715
Published: 2018-09-08
Description: An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security permissions on the %ProgramData%\CTES folder and sub-folders may allow write access to low-privileged user accounts. This allows unauthorized replacement of service program executable (EXE) or dynamically loadable library (DLL) files, causing elevated (SYSTEM) user access. Configuration control files or data files under this folder could also be similarly modified to affect service process behavior.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://community.absolute.com/s/article/Absolute-Security-Bulletin-ASB1; https://community.absolute.com/s/article/Absolute-Security-Bulletin-ASB1
CVE: CVE-2018-16724
Published: 2018-09-08
Description: An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/xxy961216/attack-baijiacmsV4-with-blind-sql-injection; https://github.com/xxy961216/attack-baijiacmsV4-with-blind-sql-injection
CVE: CVE-2018-16725
Published: 2018-09-08
Description: An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xxy961216/attack-baijiacmsV4-with-xss; https://github.com/xxy961216/attack-baijiacmsV4-with-xss
CVE: CVE-2018-16730
Published: 2018-09-08
Description: \upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AvaterXXX/CScms/blob/master/CScms_xss.md; https://www.patec.cn/newsshow.php?cid=24&id=123; https://github.com/AvaterXXX/CScms/blob/master/CScms_xss.md
CVE: CVE-2018-16731
Published: 2018-09-08
Description: CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg, png), and then providing a .php pathname within fileurl JSON data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/AvaterXXX/CScms/blob/master/CScms_up.md; https://www.patec.cn/newsshow.php?cid=24&id=123; https://github.com/AvaterXXX/CScms/blob/master/CScms_up.md