deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14876
Published: 2018-03-30
Description: In msm_ispif_config_stereo() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params->entries[i].vfe_intf comes from userspace without any bounds check which could potentially result in a kernel out-of-bounds write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=f26dbd9d[PII_REDACTED]ba383044064b1304127ac0; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-14877
Published: 2018-03-30
Description: While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no mutex lock of allocated memory. If one thread sends an ioctl cmd IPA_IOC_QUERY_RT_TBL_INDEX while another sends an ioctl cmd IPA_IOC_DEL_RT_RULE, a use-after-free condition may occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=ca395c15c49cf6463a39d197b6a9331d183d94cb; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-14881
Published: 2018-03-30
Description: While calling the IPA IOCTL handler for IPA_IOC_ADD_HDR_PROC_CTX in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-13, a use-after-free condition may potentially occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=81ea9c34f575422a78015535c619500c34b8a69c; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-14883
Published: 2018-03-30
Description: In the function wma_unified_power_debug_stats_event_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-18, if the value param_buf->num_debug_register received from the FW command buffer is close to max of uint32, then the computation performed using this variable to calculate stats_registers_len may overflow to a smaller value leading to less than required memory allocated for power_stats_results and potentially a buffer overflow while copying the FW buffer to local buffer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=3de34af4e2ca91e1a2260deb380b81620a631c85; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-14891
Published: 2018-03-30
Description: In the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12, the contents of the stack can get leaked due to an uninitialized variable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=736667bf08b03fdca824e88b901c2dbdd6703a0c; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-14892
Published: 2018-03-30
Description: In the function msm_pcm_hw_params() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asm_open_shared_io() is not checked properly potentially leading to a possible dangling pointer access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=a3bed71777c133cfec78b5140877c6ba109961a0; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-15823
Published: 2018-03-30
Description: In spectral_create_samp_msg() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not properly validated potentially leading to a buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=49c1ce19c8a4689c33e6e8f17ab77d77fae6ff93; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-15826
Published: 2018-03-30
Description: Due to a race condition in MDSS rotator in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-20, a double free vulnerability may potentially exist when two threads free the same perf structures.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-415
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=5ac3e9d038a7ee7edf77dde2dffae6f8ba528848; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-15846
Published: 2018-03-30
Description: In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted pointer dereference may potentially occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=9fdbd92ec9196ba3629f68f4c22342aa6eedc960; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-15852
Published: 2018-03-30
Description: Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-15859
Published: 2018-03-30
Description: While processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB contains fewer than 1 byte, in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-11 a buffer overrun occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=88dcc44ea8fbe158d1dee3ea197e47794bf4449d; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-16614
Published: 2018-03-30
Description: SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the plugins/payment/weixin/lib/WxPay.tedatac.php fBill parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: http://seclists.org/fulldisclosure/2018/Mar/77; http://seclists.org/fulldisclosure/2018/Mar/77
CVE: CVE-2017-17766
Published: 2018-03-30
Description: In wma_peer_info_event_handler() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-03, the value of num_peers received from firmware is not properly validated so that an integer overflow vulnerability in the size of a buffer allocation may potentially lead to a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a37d8a78f5bd0e9a2c91de46721a6d80bd229a43; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-17769
Published: 2018-03-30
Description: Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-17771
Published: 2018-03-30
Description: In msm_isp_prepare_v4l2_buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=a452045792bc09548b4e1b940aa8adfed822b51c; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2017-9691
Published: 2018-03-30
Description: There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://www.securityfocus.com/bid/100213; https://www.codeaurora.org/security-bulletin/2017/11/28/november-2017-security-bulletin; http://www.securityfocus.com/bid/100213
CVE: CVE-2017-9692
Published: 2018-03-30
Description: When an atomic commit is issued on a writeback panel with a NULL output_layer parameter in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-03, a NULL pointer dereference may potentially occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100210; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=061556e74a08f89f04b3da30119029ca3fd87ad8; https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=ef8e3cd4588b5ae71b73a3aca751d59e882e6748
CVE: CVE-2017-9693
Published: 2018-03-30
Description: The length of attribute value for STA_EXT_CAPABILITY in __wlan_hdd_change_station in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-06 being less than the actual lenth of StaParams.extn_capability results in a read for extra bytes when a memcpy is done from params->ext_capab to StaParams.extn_capability using the sizeof(StaParams.extn_capability).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100210; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=05a5abb21e4d97001f77d344444a3ec2f9c275f9; https://www.codeaurora.org/security-bulletin/2017/10/20/october-2017-v1
CVE: CVE-2017-9694
Published: 2018-03-30
Description: While parsing Netlink attributes in QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_LOST_AP_SAMPLE_SIZE in qcacld 2.0 before 2017-05-16, a buffer overread could occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100210; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1e47d44de7bab5500d27f17ae5c4ebebc7d2b4ef; https://www.codeaurora.org/security-bulletin/2017/10/20/october-2017-v1
CVE: CVE-2017-9723
Published: 2018-03-30
Description: The touchscreen driver synaptics_dsx in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-05, the size of a stack-allocated buffer can be set to a value which exceeds the size of the stack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-02-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e83ebd2098009b0d336ffab11e00f739902bd5d9; https://source.android.com/security/bulletin/pixel/2018-02-01
CVE: CVE-2018-1232
Published: 2018-03-30
Description: RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the authentication agent and cause a denial-of-service situation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2018/Mar/60; http://www.securitytracker.com/id/1040577; http://seclists.org/fulldisclosure/2018/Mar/60
CVE: CVE-2018-1233
Published: 2018-03-30
Description: RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Mar/60; http://www.securitytracker.com/id/1040577; http://seclists.org/fulldisclosure/2018/Mar/60
CVE: CVE-2018-1234
Published: 2018-03-30
Description: RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to read configuration properties for the authentication agent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2018/Mar/60; http://www.securitytracker.com/id/1040577; http://seclists.org/fulldisclosure/2018/Mar/60
CVE: CVE-2018-5708
Published: 2018-03-30
Description: An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response (specifically, the configuration file restore_default), which is displayed in XML.
CVSS Score: 8.0 (HIGH)
CWE: CWE-522
References: http://seclists.org/fulldisclosure/2018/Mar/66; https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10111; https://www.exploit-db.com/exploits/44388/
CVE: CVE-2018-7171
Published: 2018-03-30
Description: Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. (dot dot) in the contentbase parameter to rpc/set_all.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/146938/TwonkyMedia-Server-7.0.11-8.5-Directory-Traversal.html; https://github.com/mechanico/sharingIsCaring/blob/master/twonky.py; https://www.exploit-db.com/exploits/44350/
CVE: CVE-2018-7203
Published: 2018-03-30
Description: Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/set_all.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/146939/TwonkyMedia-Server-7.0.11-8.5-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/44351/; http://packetstormsecurity.com/files/146939/TwonkyMedia-Server-7.0.11-8.5-Cross-Site-Scripting.html
CVE: CVE-2018-7566
Published: 2018-03-30
Description: The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00067.html; http://mailman.alsa-project.org/pipermail/alsa-devel/2018-February/132026.html; http://www.securityfocus.com/bid/103605
CVE: CVE-2017-18255
Published: 2018-03-31
Description: The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1572e45a924f254d9570093abde46430c3172e3d; http://www.securityfocus.com/bid/103607; https://github.com/torvalds/linux/commit/1572e45a924f254d9570093abde46430c3172e3d
CVE: CVE-2015-9258
Published: 2018-03-31
Description: In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: https://docs.docker.com/notary/changelog/; https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf; https://docs.docker.com/notary/changelog/
CVE: CVE-2015-9259
Published: 2018-03-31
Description: In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://docs.docker.com/notary/changelog/; https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf; https://docs.docker.com/notary/changelog/
CVE: CVE-2018-9159
Published: 2018-03-31
Description: In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://sparkjava.com/news#spark-272-released; https://access.redhat.com/errata/RHSA-2018:2020; https://access.redhat.com/errata/RHSA-2018:2405
CVE: CVE-2018-9160
Published: 2018-03-31
Description: SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/SickRage/SickRage/commit/8156a74a68aea930d1e1047baba8b115c3abfc44; https://github.com/SickRage/sickrage.github.io/blob/master/sickrage-news/CHANGES.md; https://www.exploit-db.com/exploits/44545/
CVE: CVE-2018-8893
Published: 2018-03-31
Description: Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.secz.org/0day/2569.html; https://www.secz.org/0day/2569.html
CVE: CVE-2018-8908
Published: 2018-03-31
Description: An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens due to lack of an anti-CSRF token in state modification requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://securitywarrior9.blogspot.in/2018/03/cross-site-request-forgery-frog-cms-cve.html; https://www.exploit-db.com/exploits/44383/; http://securitywarrior9.blogspot.in/2018/03/cross-site-request-forgery-frog-cms-cve.html
CVE: CVE-2018-9161
Published: 2018-03-31
Description: Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account by reading user/scripts/login_par.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.exploit-db.com/exploits/44276/; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5453.php; https://www.exploit-db.com/exploits/44276/
CVE: CVE-2018-9162
Published: 2018-03-31
Description: Contec Smart Home 4.15 devices do not require authentication for new_user.php, edit_user.php, delete_user.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.exploit-db.com/exploits/44295/; https://www.exploit-db.com/exploits/44295/
CVE: CVE-2018-9128
Published: 2018-04-01
Description: DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/152177/DVD-X-Player-5.5.3-Buffer-Overflow.html; https://0day4u.wordpress.com/2018/03/30/buffer-overflow-on-dvd-x-player-standard-5-5-3-9/; https://www.exploit-db.com/exploits/44438/
CVE: CVE-2018-6849
Published: 2018-04-01
Description: In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://datarift.blogspot.com/p/private-ip-leakage-using-webrtc.html; https://github.com/rapid7/metasploit-framework/pull/9538; https://news.ycombinator.com/item?id=16699270
CVE: CVE-2018-9149
Published: 2018-04-01
Description: The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798
References: https://www.slideshare.net/secret/qrHwDOJ71eLg7f; https://www.slideshare.net/secret/qrHwDOJ71eLg7f
CVE: CVE-2018-9156
Published: 2018-04-01
Description: An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://www.slideshare.net/secret/aewA1dZwZ9FQ8g; https://www.slideshare.net/secret/aewA1dZwZ9FQ8g
CVE: CVE-2018-9157
Published: 2018-04-01
Description: An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://www.slideshare.net/secret/pRWQOOe6rN8Iyb; https://www.slideshare.net/secret/pRWQOOe6rN8Iyb
CVE: CVE-2018-9158
Published: 2018-04-01
Description: An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. They don't employ a suitable mechanism to prevent a DoS attack, which leads to a response time delay. An attacker can use the hping3 tool to perform an IPv4 flood attack, and the services are interrupted from attack start to end.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.slideshare.net/secret/HpAEwK5qo5U4b1; https://www.slideshare.net/secret/HpAEwK5qo5U4b1
CVE: CVE-2018-9165
Published: 2018-04-01
Description: The pushdup function in util/decompile.c in libming through 0.4.8 does not recognize the need for ActionPushDuplicate to perform a deep copy when a String is at the top of the stack, making the library vulnerable to a util/decompile.c getName NULL pointer dereference, which may allow attackers to cause a denial of service via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/libming/libming/issues/121; https://lists.debian.org/debian-lts-announce/2018/04/msg00008.html; https://github.com/libming/libming/issues/121
CVE: CVE-2018-9172
Published: 2018-04-01
Description: The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-file-upload/#developers; https://www.exploit-db.com/exploits/44443/; https://www.iptanus.com/new-version-4-3-3-of-wordpress-file-upload-plugin/