deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14784
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14785
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14786
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14787
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14788
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14789
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14790
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14791
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14792
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14793
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-14794
Published: 2018-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7502.  Reason: This candidate is a reservation duplicate of CVE-2018-7502.  Notes: All CVE users should reference CVE-2018-7502 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-10092
Published: 2018-05-22
Description: The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
CVSS Score: 8.0 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2018/05/21/2; https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog; https://github.com/Dolibarr/dolibarr/commit/5d121b2d3ae2a95abebc9dc31e4782cbc61a1f39
CVE: CVE-2018-10094
Published: 2018-05-22
Description: SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2018/05/21/1; https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog; https://github.com/Dolibarr/dolibarr/commit/7ade4e37f24d6859987bb9f6232f604325633fdd
CVE: CVE-2018-10095
Published: 2018-05-22
Description: Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2018/05/21/3; https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog; https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af[PII_REDACTED]23ed56
CVE: CVE-2018-9019
Published: 2018-05-22
Description: SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog; https://github.com/Dolibarr/dolibarr/commit/83b762b681c6dfdceb809d26ce95f3667b614739; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2018-11354
Published: 2018-05-22
Description: In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11355
Published: 2018-05-22
Description: In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for packet status chunks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11356
Published: 2018-05-22
Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11357
Published: 2018-05-22
Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11358
Published: 2018-05-22
Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11359
Published: 2018-05-22
Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11360
Published: 2018-05-22
Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in epan/dissectors/packet-gsm_a_dtap.c by fixing an off-by-one error that caused a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11361
Published: 2018-05-22
Description: In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11362
Published: 2018-05-22
Description: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/104308; http://www.securitytracker.com/id/1041036
CVE: CVE-2018-11334
Published: 2018-05-23
Description: Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain privileges or cause a denial of service via \\.\pipe\WindscribeService.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://gist.github.com/drmint80/e5f8a3b8b8324c50a85d9b8623197c68; https://exchange.xforce.ibmcloud.com/vulnerabilities/143840; https://gist.github.com/drmint80/e5f8a3b8b8324c50a85d9b8623197c68
CVE: CVE-2018-7295
Published: 2018-05-23
Description: ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-924
References: https://raw.githubusercontent.com/WizardShotTheFood/advisories/master/CVE-2018-7295.txt; https://raw.githubusercontent.com/WizardShotTheFood/advisories/master/CVE-2018-7295.txt
CVE: CVE-2017-2598
Published: 2018-05-23
Description: Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-325, CWE-326
References: http://www.securityfocus.com/bid/95948; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2598; https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b
CVE: CVE-2018-1124
Published: 2018-05-23
Description: procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190, CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html; http://seclists.org/oss-sec/2018/q2/122
CVE: CVE-2018-1126
Published: 2018-05-23
Description: procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-190, CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html; http://seclists.org/oss-sec/2018/q2/122
CVE: CVE-2018-11396
Published: 2018-05-23
Description: ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00043.html; https://bugzilla.gnome.org/show_bug.cgi?id=795740; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00043.html
CVE: CVE-2018-8176
Published: 2018-05-23
Description: A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104184; http://www.securitytracker.com/id/1040937; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8176
CVE: CVE-2018-1122
Published: 2018-05-23
Description: procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
CVSS Score: 7.3 (HIGH)
CWE: CWE-829
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html; http://seclists.org/oss-sec/2018/q2/122
CVE: CVE-2018-1123
Published: 2018-05-23
Description: procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
CVSS Score: 3.9 (LOW)
CWE: CWE-122, CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html; http://seclists.org/oss-sec/2018/q2/122
CVE: CVE-2018-1125
Published: 2018-05-23
Description: procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787, CWE-121
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html; http://seclists.org/oss-sec/2018/q2/122
CVE: CVE-2018-1309
Published: 2018-05-23
Description: Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://nifi.apache.org/security.html#CVE-2018-1309; https://nifi.apache.org/security.html#CVE-2018-1309
CVE: CVE-2018-1310
Published: 2018-05-23
Description: Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://nifi.apache.org/security.html#CVE-2018-1310; https://nifi.apache.org/security.html#CVE-2018-1310
CVE: CVE-2017-9317
Published: 2018-05-23
Description: Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of high privilege account and further obtain device information or attack the device.
CVSS Score: 8.8 (HIGH)
References: https://www.dahuasecurity.com/support/cybersecurity/annoucementNotice/337; https://www.dahuasecurity.com/support/cybersecurity/annoucementNotice/337
CVE: CVE-2018-1193
Published: 2018-05-23
Description: Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.
CVSS Score: 5.3 (MEDIUM)
References: https://www.cloudfoundry.org/blog/cve-2018-1193/; https://www.cloudfoundry.org/blog/cve-2018-1193/
CVE: CVE-2018-10351
Published: 2018-05-23
Description: A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRegistration2 class. Authentication is required to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://success.trendmicro.com/solution/1119349; https://www.zerodayinitiative.com/advisories/ZDI-18-415/; https://success.trendmicro.com/solution/1119349
CVE: CVE-2018-10352
Published: 2018-05-23
Description: A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formConfiguration class. Authentication is required to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://success.trendmicro.com/solution/1119349; https://www.zerodayinitiative.com/advisories/ZDI-18-418/; https://success.trendmicro.com/solution/1119349
CVE: CVE-2018-10353
Published: 2018-05-23
Description: A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose sensitive information on vulnerable installations due to a flaw in the formChangePass class. Authentication is required to exploit this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://success.trendmicro.com/solution/1119349; https://www.zerodayinitiative.com/advisories/ZDI-18-419/; https://success.trendmicro.com/solution/1119349
CVE: CVE-2018-10354
Published: 2018-05-23
Description: A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the LauncherServer. Authentication is required to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://success.trendmicro.com/solution/1119349; https://www.zerodayinitiative.com/advisories/ZDI-18-416/; https://success.trendmicro.com/solution/1119349
CVE: CVE-2018-10355
Published: 2018-05-23
Description: An authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to recover user passwords on vulnerable installations due to a flaw in the DBCrypto class. An attacker must first obtain access to the user database on the target system in order to exploit this vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-522
References: https://success.trendmicro.com/solution/1119349; https://www.zerodayinitiative.com/advisories/ZDI-18-411/; https://success.trendmicro.com/solution/1119349
CVE: CVE-2018-10356
Published: 2018-05-23
Description: A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://success.trendmicro.com/solution/1119349; https://www.zerodayinitiative.com/advisories/ZDI-18-420/; https://success.trendmicro.com/solution/1119349
CVE: CVE-2018-10357
Published: 2018-05-23
Description: A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the FileDrop servlet. Authentication is required to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/104355; https://success.trendmicro.com/solution/1119811; https://www.zerodayinitiative.com/advisories/ZDI-18-469/
CVE: CVE-2018-11231
Published: 2018-05-23
Description: In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: http://foreversong.cn/archives/1183; http://foreversong.cn/archives/1183
CVE: CVE-2018-8898
Published: 2018-05-23
Description: A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616E6771696F6E67") allows unauthenticated attackers to perform arbitrary modification (read, write) to passwords and configurations meanwhile an administrator is logged into the web panel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/147708/D-Link-DSL-3782-Authentication-Bypass.html; https://www.exploit-db.com/exploits/44657/; http://packetstormsecurity.com/files/147708/D-Link-DSL-3782-Authentication-Bypass.html
CVE: CVE-2018-10648
Published: 2018-05-23
Description: There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://support.citrix.com/article/CTX234879; https://support.citrix.com/article/CTX234879
CVE: CVE-2018-10649
Published: 2018-05-23
Description: There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.citrix.com/article/CTX234879; https://support.citrix.com/article/CTX234879
CVE: CVE-2018-10650
Published: 2018-05-23
Description: There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://support.citrix.com/article/CTX234879; https://support.citrix.com/article/CTX234879
CVE: CVE-2018-10651
Published: 2018-05-23
Description: There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://support.citrix.com/article/CTX234879; https://support.citrix.com/article/CTX234879
CVE: CVE-2018-10652
Published: 2018-05-23
Description: There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.citrix.com/article/CTX234879; https://support.citrix.com/article/CTX234879