deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-19769
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "UserProperties.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19770
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "Users.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19771
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "EditCurrentPool.jsp" has reflected XSS via the PropName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19772
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "EditCurrentPresentSpace.jsp" has reflected XSS via the ConnPoolName, GroupId, and ParentId parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19773
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "EditCurrentUser.jsp" has reflected XSS via the GroupId and ConnPoolName parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19774
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "PresentSpace.jsp" has reflected XSS via the GroupId and ConnPoolName parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19775
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "Variables.jsp" has reflected XSS via the ConnPoolName and GroupId parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19809
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/GroupCopy.jsp" has reflected XSS via the ConnPoolName, GroupId, or type parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19810
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/GroupMove.jsp" has reflected XSS via the ConnPoolName, GroupId, or type parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19811
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Import.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19812
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/SubFolderPackages.jsp" has reflected XSS via the GroupId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19813
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Subscribers.jsp" has reflected XSS via the ConnPoolName or GroupId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19814
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Subscriptions.jsp" has reflected XSS via the ConnPoolName or GroupId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19815
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/UserPopupAddNewProp.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19816
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/categorytree/ChooseCategory.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19817
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/AdminAuthorisationFrame.jsp" has reflected XSS via the ConnPoolName or GroupId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19818
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Contacts.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19819
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Rights.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19820
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Roles.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19821
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/SecurityPolicies.jsp" has reflected XSS via the ConnPoolName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-19822
Published: 2018-12-17
Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/SharedCriteria.jsp" has reflected XSS via the ConnPoolName or GroupId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/20; http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html
CVE: CVE-2018-20027
Published: 2018-12-17
Description: The yaml_parse.load method in Pylearn2 allows code injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/lisa-lab/pylearn2/issues/1593; https://github.com/lisa-lab/pylearn2/issues/1593
CVE: CVE-2018-20171
Published: 2018-12-17
Description: An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.seebug.org/vuldb/ssvid-97713; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2018-20172
Published: 2018-12-17
Description: An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.seebug.org/vuldb/ssvid-97714; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2017-1265
Published: 2018-12-17
Description: IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate. This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) techniques. IBM X-Force ID: 124740.
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: http://www.securityfocus.com/bid/106234; https://exchange.xforce.ibmcloud.com/vulnerabilities/124740; https://www.ibm.com/support/docview.wss?uid=swg22014229
CVE: CVE-2017-1272
Published: 2018-12-17
Description: IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 124747. IBM X-Force ID: 124747.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106237; https://exchange.xforce.ibmcloud.com/vulnerabilities/124747; https://www.ibm.com/support/docview.wss?uid=ibm10731655
CVE: CVE-2017-1597
Published: 2018-12-17
Description: IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132610.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-521
References: http://www.securityfocus.com/bid/106236; https://exchange.xforce.ibmcloud.com/vulnerabilities/132610; https://www.ibm.com/support/docview.wss?uid=swg22014231
CVE: CVE-2018-1889
Published: 2018-12-17
Description: IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152080.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106231; https://exchange.xforce.ibmcloud.com/vulnerabilities/152080; https://www.ibm.com/support/docview.wss?uid=ibm10743371
CVE: CVE-2018-1891
Published: 2018-12-17
Description: IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152082.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106239; https://exchange.xforce.ibmcloud.com/vulnerabilities/152082; https://www.ibm.com/support/docview.wss?uid=ibm10742865
CVE: CVE-2018-14852
Published: 2018-12-17
Description: Out-of-bounds array access in dhd_rx_frame in drivers/net/wireless/bcmdhd4358/dhd_linux.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker (who has obtained code execution on the Wi-Fi chip) to cause invalid accesses to operating system memory due to improper validation of the network interface index provided by the Wi-Fi chip's firmware.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14852.md; https://people.cs.kuleuven.be/~stijn.volckaert/papers/2019_NDSS_PeriScope.pdf; https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14852.md
CVE: CVE-2018-14853
Published: 2018-12-17
Description: A NULL pointer dereference in dhd_prot_txdata_write_flush in drivers/net/wireless/bcmdhd4358/dhd_msgbuf.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker (who has obtained code execution on the Wi-Fi chip) to cause the device to reboot. The Samsung ID is SVE-2018-11783.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14853.md; https://people.cs.kuleuven.be/~stijn.volckaert/papers/2019_NDSS_PeriScope.pdf; https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14853.md
CVE: CVE-2018-14854
Published: 2018-12-17
Description: Buffer overflow in dhd_bus_flow_ring_delete_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allow an attacker (who has obtained code execution on the Wi-Fi chip) to cause the device driver to perform invalid memory accesses. The Samsung ID is SVE-2018-11785.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14854_CVE-2018-14855_CVE-2018-14856.md; https://people.cs.kuleuven.be/~stijn.volckaert/papers/2019_NDSS_PeriScope.pdf; https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14854_CVE-2018-14855_CVE-2018-14856.md
CVE: CVE-2018-14855
Published: 2018-12-17
Description: Buffer overflow in dhd_bus_flow_ring_flush_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 allow an attacker (who has obtained code execution on the Wi-Fi chip) to cause the device driver to perform invalid memory accesses. The Samsung ID is SVE-2018-11785.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14854_CVE-2018-14855_CVE-2018-14856.md; https://people.cs.kuleuven.be/~stijn.volckaert/papers/2019_NDSS_PeriScope.pdf; https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14854_CVE-2018-14855_CVE-2018-14856.md
CVE: CVE-2018-14856
Published: 2018-12-17
Description: Buffer overflow in dhd_bus_flow_ring_create_response in drivers/net/wireless/bcmdhd4358/dhd_pcie.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allow an attacker (who has obtained code execution on the Wi-Fi) chip to cause the device driver to perform invalid memory accesses. The Samsung ID is SVE-2018-11785.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14854_CVE-2018-14855_CVE-2018-14856.md; https://people.cs.kuleuven.be/~stijn.volckaert/papers/2019_NDSS_PeriScope.pdf; https://github.com/securesystemslab/periscope/blob/master/bugs-found/CVE-2018-14854_CVE-2018-14855_CVE-2018-14856.md
CVE: CVE-2018-16596
Published: 2018-12-17
Description: A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09.04.00 and Internet-Box light prior to v08.05.02 allows remote code execution. No authentication is required to exploit this vulnerability. Sending a simple UDP packet to port 1900 allows an attacker to execute code on a remote device. However, this is only possible if the attacker is inside the LAN. Because of ASLR, the success rate is not 100% and leads instead to a DoS of the UPnP service. The remaining functionality of the Internet Box is not affected. A reboot of the Internet Box is necessary to attempt the exploit again.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-16596.txt; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-16596.txt
CVE: CVE-2018-18555
Published: 2018-12-17
Description: A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases; https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases
CVE: CVE-2018-18556
Published: 2018-12-17
Description: A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges.
CVSS Score: 9.9 (CRITICAL)
References: http://packetstormsecurity.com/files/159234/VyOS-restricted-shell-Escape-Privilege-Escalation.html; https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users/; https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases
CVE: CVE-2018-19036
Published: 2018-12-17
Description: An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2018-1202-bt-cve-2018-19036_security_advisory_ip_camera_vulnerability.pdf; https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2018-1202-bt-cve-2018-19036_security_advisory_ip_camera_vulnerability.pdf
CVE: CVE-2018-19828
Published: 2018-12-17
Description: Artica Integria IMS 5.0.83 has XSS via the search_string parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackpuntes.com/cve-2018-19828-integria-ims-5-0-83-cross-site-scripting-reflejado/; https://www.exploit-db.com/exploits/46012/; https://hackpuntes.com/cve-2018-19828-integria-ims-5-0-83-cross-site-scripting-reflejado/
CVE: CVE-2018-19933
Published: 2018-12-17
Description: Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rdincel1/Bolt-CMS-3.6.2---Cross-Site-Scripting; https://www.exploit-db.com/exploits/46014/; https://www.raifberkaydincel.com/bolt-cms-xss-vulnerability.html
CVE: CVE-2018-19936
Published: 2018-12-17
Description: PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/150750/PrinterOn-Enterprise-4.1.4-Arbitrary-File-Deletion.html; https://www.exploit-db.com/exploits/45969; http://packetstormsecurity.com/files/150750/PrinterOn-Enterprise-4.1.4-Arbitrary-File-Deletion.html
CVE: CVE-2018-19974
Published: 2018-12-17
Description: In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to discover addresses in the real stack (not the YARA virtual stack).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://bnbdr.github.io/posts/extracheese/; https://github.com/VirusTotal/yara/issues/999; https://github.com/bnbdr/swisscheese/
CVE: CVE-2018-19975
Published: 2018-12-17
Description: In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifically, OP_COUNT can read a DWORD.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://bnbdr.github.io/posts/extracheese/; https://github.com/VirusTotal/yara/issues/999; https://github.com/bnbdr/swisscheese/
CVE: CVE-2018-19976
Published: 2018-12-17
Description: In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the design of the YARA virtual machine.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://bnbdr.github.io/posts/extracheese/; https://github.com/VirusTotal/yara/issues/999; https://github.com/bnbdr/swisscheese/
CVE: CVE-2018-20092
Published: 2018-12-17
Description: PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.doyler.net/security-not-included/ptc-thingworx-vulnerability; https://www.ptc.com/en/documents/security/coordinated-vulnerability-disclosure/security-vulnerabilities; https://www.doyler.net/security-not-included/ptc-thingworx-vulnerability