deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8026
Published: 2018-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-8027
Published: 2018-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-8029
Published: 2018-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-8030
Published: 2018-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-8042
Published: 2018-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-8043
Published: 2018-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2017-8049
Published: 2018-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mautic/mautic/releases/tag/2.12.0; https://github.com/mautic/mautic/releases/tag/2.12.0
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://github.com/mautic/mautic/releases/tag/2.12.0; https://github.com/mautic/mautic/releases/tag/2.12.0
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/mautic/mautic/releases/tag/2.12.0; https://github.com/mautic/mautic/releases/tag/2.12.0
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/102428; https://github.com/ImageMagick/ImageMagick/issues/867; https://lists.debian.org/debian-lts-announce/2018/01/msg00002.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/pravednik/xmlBundle; https://github.com/pravednik/xmlBundle/issues/2; https://github.com/pravednik/xmlBundle
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/elabftw/elabftw/issues/531; https://github.com/elabftw/elabftw/issues/531
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under "possibly insecure" suspicions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2017/11/22/7; https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes; https://github.com/opnsense/core/commit/d218b225
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/smarty-php/smarty/blob/master/change_log.txt; https://lists.debian.org/debian-lts-announce/2018/01/msg00023.html; https://lists.debian.org/debian-lts-announce/2018/02/msg00000.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://plone.org/security/hotfix/20171128/open-redirection-on-login-form; https://plone.org/security/hotfix/20171128/open-redirection-on-login-form
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property; https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.
CVSS Score: 6.5 (MEDIUM)
References: https://plone.org/security/hotfix/20171128/sandbox-escape; https://plone.org/security/hotfix/20171128/sandbox-escape
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.libav.org/show_bug.cgi?id=952; https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/8e313ca08800178efce00045e07dc494d437b70c; https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality (that the browser intends to block).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-732
References: https://github.com/brave/browser-laptop/issues/11683#issuecomment-339835601; https://github.com/brave/browser-laptop/issues/11683#issuecomment-339835601
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/BookStackApp/BookStack/issues/575; https://github.com/BookStackApp/BookStack/issues/575
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/cobbler/cobbler/issues/1845; https://github.com/cobbler/cobbler/issues/1845
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/embedthis/goahead/commit/adeb4abc6c998c19524e09fde20c02b4a26765a3; https://github.com/embedthis/goahead/pull/258; https://github.com/embedthis/goahead/commit/adeb4abc6c998c19524e09fde20c02b4a26765a3
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/embedthis/goahead/commit/5e6be61e42448f503e75e287dc332b1ecbf2a665#diff-7c9c60c790648b06210f57b9e2f53ca7; https://github.com/embedthis/goahead/pull/258; https://github.com/embedthis/goahead/commit/5e6be61e42448f503e75e287dc332b1ecbf2a665#diff-7c9c60c790648b06210f57b9e2f53ca7
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary files, via a crafted ZIP file, related to a "file path injection vulnerability".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/pocoproject/poco/issues/1968; https://lists.debian.org/debian-lts-announce/2018/01/msg00013.html; https://www.debian.org/security/2018/dsa-4083
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Linux Dash up to version v2 is vulnerable to multiple command injection vulnerabilities in the way module names are parsed and then executed resulting in code execution on the server, potentially as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/afaqurk/linux-dash/issues/447; https://github.com/afaqurk/linux-dash/issues/447
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url; https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/nylas-mail-lives/nylas-mail/issues/181; https://github.com/nylas-mail-lives/nylas-mail/issues/181
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326, CWE-326
References: http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html; https://cryptosense.com/weak-encryption-flaw-in-primefaces/; https://github.com/primefaces/primefaces/issues/1152
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-03
Description: Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://access.redhat.com/errata/RHSA-2018:1322; https://github.com/codehaus-plexus/plexus-utils/commit/b38a1b3a4352303e4312b2bb601a0d7ec6e28f41; https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2018-5072
Published: 2018-01-03
Description: Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md
CVE: CVE-2018-5073
Published: 2018-01-03
Description: Online Ticket Booking has CSRF via admin/movieedit.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md
CVE: CVE-2018-5074
Published: 2018-01-03
Description: Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md
CVE: CVE-2018-5075
Published: 2018-01-03
Description: Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md
CVE: CVE-2018-5076
Published: 2018-01-03
Description: Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md
CVE: CVE-2018-5077
Published: 2018-01-03
Description: Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md
CVE: CVE-2018-5078
Published: 2018-01-03
Description: Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Advanced%20Real%20Estate%20Script.md
CVE: CVE-2018-5079
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83002130.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x83002130; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x83002130
CVE: CVE-2018-5080
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x830020FC.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x830020FC; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x830020FC
CVE: CVE-2018-5081
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x830020F0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x830020F0; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x830020F0
CVE: CVE-2018-5082
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83002128.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x83002128; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x83002128
CVE: CVE-2018-5083
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8300215B.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x8300215B; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x8300215B
CVE: CVE-2018-5084
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8300212C.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x8300212C; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x8300212C
CVE: CVE-2018-5085
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83002124.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x83002124; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x83002124
CVE: CVE-2018-5086
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8300215F.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x8300215F; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x8300215F
CVE: CVE-2018-5087
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83002100.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x83002100; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x83002100
CVE: CVE-2018-5088
Published: 2018-01-03
Description: In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8300211C.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x8300211C; https://github.com/rubyfly/K7AntiVirus_POC/tree/master/0x8300211C
CVE: CVE-2018-5191
Published: 2018-01-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2[PII_REDACTED]. Reason: This candidate is a reservation duplicate of CVE-2[PII_REDACTED]. Notes: All CVE users should reference CVE-2[PII_REDACTED] instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-18018
Published: 2018-01-04
Description: In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362, CWE-362
References: http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html; http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html
CVE: CVE-2017-18019
Published: 2018-01-04
Description: In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the product crashes upon a \\.\K7Sentry DeviceIoControl call with an invalid kernel pointer.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://blogs.securiteam.com/index.php/archives/3435; https://blogs.securiteam.com/index.php/archives/3435
CVE: CVE-2017-14383
Published: 2018-01-04
Description: In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary HTML code in the user's browser session in the context of the affected web application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Dec/87; http://seclists.org/fulldisclosure/2017/Dec/87
CVE: CVE-2017-18020
Published: 2018-01-04
Description: On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and Exynos chipsets, attackers can execute arbitrary code in the bootloader because S Boot omits a size check during a copy of ramfs data to memory. The Samsung ID is SVE-2017-10598.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-8046
Published: 2018-01-04
Description: Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100948; https://access.redhat.com/errata/RHSA-2018:2405; https://pivotal.io/security/cve-2017-8046
CVE: CVE-2018-0103
Published: 2018-01-04
Description: A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attacker to execute arbitrary code on the system of a user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or launch the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCvg78835, CSCvg78837, CSCvg78839.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/102369; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180103-wnrp; http://www.securityfocus.com/bid/102369