deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-10606
Published: 2018-06-01
Description: grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/207; https://nodesecurity.io/advisories/207
CVE: CVE-2016-10607
Published: 2018-06-01
Description: openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/208; https://nodesecurity.io/advisories/208
CVE: CVE-2016-10608
Published: 2018-06-01
Description: robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/201; https://nodesecurity.io/advisories/201
CVE: CVE-2016-10609
Published: 2018-06-01
Description: chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/203; https://nodesecurity.io/advisories/203
CVE: CVE-2016-10610
Published: 2018-06-01
Description: unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/206; https://nodesecurity.io/advisories/206
CVE: CVE-2016-10612
Published: 2018-06-01
Description: dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. dalek-browser-ie-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/205; https://nodesecurity.io/advisories/205
CVE: CVE-2016-10613
Published: 2018-06-01
Description: bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/211; https://nodesecurity.io/advisories/211
CVE: CVE-2016-10614
Published: 2018-06-01
Description: httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/210; https://nodesecurity.io/advisories/210
CVE: CVE-2016-10615
Published: 2018-06-01
Description: curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/215; https://nodesecurity.io/advisories/215
CVE: CVE-2016-10616
Published: 2018-06-01
Description: openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/218; https://nodesecurity.io/advisories/218
CVE: CVE-2016-10617
Published: 2018-06-01
Description: box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/219; https://nodesecurity.io/advisories/219
CVE: CVE-2016-10618
Published: 2018-06-01
Description: node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/214; https://nodesecurity.io/advisories/214
CVE: CVE-2016-10619
Published: 2018-06-01
Description: pennyworth is a natural language templating engine. pennyworth downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/213; https://nodesecurity.io/advisories/213
CVE: CVE-2016-10620
Published: 2018-06-01
Description: atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/216; https://nodesecurity.io/advisories/216
CVE: CVE-2016-10621
Published: 2018-06-01
Description: fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/217; https://nodesecurity.io/advisories/217
CVE: CVE-2016-10622
Published: 2018-06-01
Description: nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/212; https://nodesecurity.io/advisories/212
CVE: CVE-2016-10623
Published: 2018-06-01
Description: macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/221; https://nodesecurity.io/advisories/221
CVE: CVE-2016-10624
Published: 2018-06-01
Description: selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/222; https://nodesecurity.io/advisories/222
CVE: CVE-2016-10625
Published: 2018-06-01
Description: headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/230; https://nodesecurity.io/advisories/230
CVE: CVE-2016-10626
Published: 2018-06-01
Description: mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/229; https://nodesecurity.io/advisories/229
CVE: CVE-2016-10628
Published: 2018-06-01
Description: selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/224; https://nodesecurity.io/advisories/224
CVE: CVE-2016-10629
Published: 2018-06-01
Description: nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/226; https://nodesecurity.io/advisories/226
CVE: CVE-2016-10630
Published: 2018-06-01
Description: install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/228; https://nodesecurity.io/advisories/228
CVE: CVE-2016-10631
Published: 2018-06-01
Description: jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/225; https://nodesecurity.io/advisories/225
CVE: CVE-2016-10632
Published: 2018-06-01
Description: apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/223; https://nodesecurity.io/advisories/223
CVE: CVE-2016-10633
Published: 2018-06-01
Description: dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/232; https://nodesecurity.io/advisories/232
CVE: CVE-2016-10634
Published: 2018-06-01
Description: scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/231; https://nodesecurity.io/advisories/231
CVE: CVE-2018-11195
Published: 2018-06-01
Description: Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious users with physical access to the web browser of a Mahara user, after they have logged in, to potentially gain access to their Mahara credentials.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://bugs.launchpad.net/mahara/+bug/1770561; https://mahara.org/interaction/forum/topic.php?id=8269; https://bugs.launchpad.net/mahara/+bug/1770561
CVE: CVE-2018-11196
Published: 2018-06-01
Description: Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A archive and uploading that to Mahara. In contrast to other ZIP files that are uploaded, ClamAV (when activated) does not check Leap2A archives for viruses, allowing malicious files to be available for download. While files cannot be executed on Mahara itself, Mahara can be used to transfer such files to user computers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://bugs.launchpad.net/bugs/1770535; https://mahara.org/interaction/forum/topic.php?id=8270; https://bugs.launchpad.net/bugs/1770535
CVE: CVE-2018-11538
Published: 2018-06-01
Description: servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/147977/SearchBlox-8.6.6-Cross-Site-Request-Forgery.html; https://gurelahmet.com/cve-2018-11538-csrf-privilege-escalation-creation-of-an-administrator-account-on-searchblox-8-6-6/; https://www.exploit-db.com/exploits/44801/
CVE: CVE-2018-3756
Published: 2018-06-01
Description: Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or block multiple times, each with a random nonce, and have other validating nodes accept them as separate valid signatures.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/hyperledger/iroha/releases/tag/v1.0.0_beta-2; https://github.com/hyperledger/iroha/releases/tag/v1.0.0_beta-2
CVE: CVE-2018-3757
Published: 2018-06-01
Description: Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/roest01/node-pdf-image/commit/54679496a[PII_REDACTED]7608c2bbe2f6e5dd20e83; https://hackerone.com/reports/340208; https://github.com/roest01/node-pdf-image/commit/54679496a[PII_REDACTED]7608c2bbe2f6e5dd20e83
CVE: CVE-2018-3809
Published: 2018-06-01
Description: Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://hackerone.com/reports/330650; https://hackerone.com/reports/330650
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-01
Description: In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://access.redhat.com/errata/RHSA-2018:2669; https://access.redhat.com/errata/RHSA-2018:2927; https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-02
Description: In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1564305; https://github.com/kubernetes/kubernetes/issues/61297; https://hansmi.ch/articles/2018-04-openshift-s2i-security
CVE: CVE-2018-11143
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11144
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11145
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11146
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11147
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11148
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11149
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11150
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11151
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11152
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11153
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11154
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities
CVE: CVE-2018-11155
Published: 2018-06-02
Description: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html; http://seclists.org/fulldisclosure/2018/May/71; https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities