deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-10656
Published: 2018-08-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-10657
Published: 2018-08-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-10658
Published: 2018-08-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-10659
Published: 2018-08-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-10660
Published: 2018-08-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2018-7790
Published: 2018-08-29
Description: An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a Modicon M221, the attacker can upload the original program from the PLC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294
References: http://www.securityfocus.com/bid/105182; https://www.schneider-electric.com/en/download/document/SEVD-2018-235-01/; http://www.securityfocus.com/bid/105182
CVE: CVE-2018-7791
Published: 2018-08-29
Description: A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to overwrite the original password with their password. If an attacker exploits this vulnerability and overwrite the password, the attacker can upload the original program from the PLC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/105182; https://www.schneider-electric.com/en/download/document/SEVD-2018-235-01/; http://www.securityfocus.com/bid/105182
CVE: CVE-2018-7792
Published: 2018-08-29
Description: A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to decode the password using rainbow table.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/105182; https://www.schneider-electric.com/en/download/document/SEVD-2018-235-01/; http://www.securityfocus.com/bid/105182
CVE: CVE-2018-16115
Published: 2018-08-29
Description: Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. The custom RNG implementations were not configured by default but examples in the documentation showed (and therefore implicitly recommended) using the custom ones. This can be used by an attacker to compromise the communication if these random number generators are enabled in configuration. It would be possible to eavesdrop, replay, or modify the messages sent with Akka Remoting/Cluster.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-338
References: https://doc.akka.io/docs/akka/current/security/2018-08-29-aes-rng.html; https://doc.akka.io/docs/akka/current/security/2018-08-29-aes-rng.html
CVE: CVE-2018-16132
Published: 2018-08-29
Description: The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed, resulting in a forced restart of the device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400
References: http://seclists.org/bugtraq/2018/Aug/57; http://seclists.org/bugtraq/2018/Aug/57
CVE: CVE-2018-16133
Published: 2018-08-29
Description: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://emreovunc.com/blog/en/CyBroHttpServer-v.1.0.3-Directory-Traversal-3.png; https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal; https://www.exploit-db.com/exploits/45303/
CVE: CVE-2018-16134
Published: 2018-08-29
Description: Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://emreovunc.com/blog/en/CyBroHttpServer-v1.0.3-XSS.png; https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Reflected-XSS; https://www.exploit-db.com/exploits/45309/
CVE: CVE-2018-16056
Published: 2018-08-30
Description: In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth Attribute Protocol dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by verifying that a dissector for a specific UUID exists.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/105174; http://www.securitytracker.com/id/1041609
CVE: CVE-2018-16057
Published: 2018-08-30
Description: In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was addressed in epan/dissectors/packet-ieee80211-radiotap-iter.c by validating iterator operations.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/105174; http://www.securitytracker.com/id/1041609
CVE: CVE-2018-16058
Published: 2018-08-30
Description: In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash. This was addressed in epan/dissectors/packet-btavdtp.c by properly initializing a data structure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/105174; http://www.securitytracker.com/id/1041609
CVE: CVE-2018-16140
Published: 2018-08-30
Description: A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2020/01/msg00018.html; https://sourceforge.net/p/mcj/tickets/28/; https://usn.ubuntu.com/3760-1/
CVE: CVE-2018-16141
Published: 2018-08-30
Description: ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://unothing.github.io/posts/thinkcmfx223/; https://unothing.github.io/posts/thinkcmfx223/
CVE: CVE-2018-16142
Published: 2018-08-30
Description: PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://unothing.github.io/posts/phpok48278/; https://unothing.github.io/posts/phpok48278/
CVE: CVE-2018-16158
Published: 2018-08-30
Description: Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins (to uid 0) via the PubkeyAuthentication option.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf; https://www.ctrlu.net/vuln/0006.html; https://github.com/BrianWGray/msf/blob/master/exploits/linux/ssh/eaton_known_privkey.rb
CVE: CVE-2018-11615
Published: 2018-08-30
Description: This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-185
References: https://zerodayinitiative.com/advisories/ZDI-18-583; https://zerodayinitiative.com/advisories/ZDI-18-583
CVE: CVE-2018-11616
Published: 2018-08-30
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Tencent Foxmail 7.2.9.115. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5543.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://zerodayinitiative.com/advisories/ZDI-18-584; https://zerodayinitiative.com/advisories/ZDI-18-584
CVE: CVE-2018-14317
Published: 2018-08-30
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6683.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-18-939; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-14619
Published: 2018-08-30
Description: A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-20
References: http://www.securityfocus.com/bid/105200; https://access.redhat.com/errata/RHSA-2018:2948; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14619
CVE: CVE-2015-9265
Published: 2018-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-14622.  Reason: This candidate is a reservation duplicate of CVE-2018-14622.  Notes: All CVE users should reference CVE-2018-14622 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-10936
Published: 2018-08-30
Description: A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
CVSS Score: 8.1 (HIGH)
CWE: CWE-297, CWE-297
References: http://www.securityfocus.com/bid/105220; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10936; https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2018-14621
Published: 2018-08-30
Description: An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion of file descriptors would cause the server to enter an infinite loop, consuming a large amount of CPU time and denying service to other clients until restarted.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-835, CWE-835
References: http://git.linux-nfs.org/?p=steved/libtirpc.git%3Ba=commit%3Bh=fce98161d9815ea016855d9f[PII_REDACTED]2c2c4b; https://bugzilla.novell.com/show_bug.cgi?id=968175; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14621
CVE: CVE-2018-14622
Published: 2018-08-30
Description: A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-252
References: http://git.linux-nfs.org/?p=steved/libtirpc.git%3Ba=commit%3Bh=1c77f7a869bdea2a34799d774460d1f9983d45f0; https://access.redhat.com/errata/RHBA-2017:1991; https://bugzilla.novell.com/show_bug.cgi?id=968175
CVE: CVE-2018-16131
Published: 2018-08-30
Description: The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://akka.io/blog/news/2018/08/30/akka-http-dos-vulnerability-found; https://doc.akka.io/docs/akka-http/current/security/2018-09-05-denial-of-service-via-decodeRequest.html; https://github.com/akka/akka-http/issues/2137
CVE: CVE-2018-16157
Published: 2018-08-30
Description: waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart&a=save item_totals parameter to zero, the entire cart is sold for free.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/caokang/waimai/issues/5; https://github.com/caokang/waimai/issues/5
CVE: CVE-2018-13819
Published: 2018-08-30
Description: A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/bid/105199; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-02--security-notice-for-ca-unified-infrastructure-mgt.html; http://www.securityfocus.com/bid/105199
CVE: CVE-2018-13820
Published: 2018-08-30
Description: A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/bid/105199; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-02--security-notice-for-ca-unified-infrastructure-mgt.html; http://www.securityfocus.com/bid/105199
CVE: CVE-2018-13821
Published: 2018-08-30
Description: A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/105199; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-02--security-notice-for-ca-unified-infrastructure-mgt.html; http://www.securityfocus.com/bid/105199
CVE: CVE-2018-13822
Published: 2018-08-30
Description: Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.securityfocus.com/bid/105297; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html; http://www.securityfocus.com/bid/105297
CVE: CVE-2018-13823
Published: 2018-08-30
Description: An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/105297; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html; http://www.securityfocus.com/bid/105297
CVE: CVE-2018-13824
Published: 2018-08-30
Description: Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/105297; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html; http://www.securityfocus.com/bid/105297
CVE: CVE-2018-13825
Published: 2018-08-30
Description: Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105297; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html; http://www.securityfocus.com/bid/105297
CVE: CVE-2018-13826
Published: 2018-08-30
Description: An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: http://www.securityfocus.com/bid/105297; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html; http://www.securityfocus.com/bid/105297
CVE: CVE-2018-15691
Published: 2018-08-30
Description: Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.securityfocus.com/bid/105197; http://www.securitytracker.com/id/1041591; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-03--security-notice-for-ca-release-automation.html
CVE: CVE-2018-16159
Published: 2018-08-30
Description: The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpvulndb.com/vulnerabilities/9117; https://www.exploit-db.com/exploits/45255/; https://wpvulndb.com/vulnerabilities/9117
CVE: CVE-2016-0205
Published: 2018-08-30
Description: A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate valid users of the system. IBM X-Force ID: 109394.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/109394; https://www-01.ibm.com/support/docview.wss?uid=swg2C4000049; https://exchange.xforce.ibmcloud.com/vulnerabilities/109394
CVE: CVE-2016-0234
Published: 2018-08-30
Description: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close their browser. IBM X-Force ID: 110303.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-613
References: http://www-01.ibm.com/support/docview.wss?uid=swg21997687; https://exchange.xforce.ibmcloud.com/vulnerabilities/110303; http://www-01.ibm.com/support/docview.wss?uid=swg21997687
CVE: CVE-2016-0373
Published: 2018-08-30
Description: IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.
CVSS Score: 3.1 (LOW)
CWE: CWE-285
References: http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219; https://exchange.xforce.ibmcloud.com/vulnerabilities/112119; http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219
CVE: CVE-2018-11718
Published: 2018-08-30
Description: Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://xovis.com/security/xovis-sec-2018-001.html; https://xovis.com/security/xovis-sec-2018-001.html
CVE: CVE-2018-11719
Published: 2018-08-30
Description: Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611
References: https://xovis.com/security/xovis-sec-2018-002.html; https://xovis.com/security/xovis-sec-2018-002.html
CVE: CVE-2018-11720
Published: 2018-08-30
Description: Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://xovis.com/security/xovis-sec-2018-003.html; https://xovis.com/security/xovis-sec-2018-003.html
CVE: CVE-2018-14899
Published: 2018-08-30
Description: On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious sites.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/; https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/
CVE: CVE-2018-14900
Published: 2018-08-30
Description: On EPSON WF-2750 printers with firmware JP02I2, there is no filtering of print jobs. Remote attackers can send print jobs directly to the printer via TCP port 9100.
CVSS Score: 7.5 (HIGH)
CWE: CWE-417
References: https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/; https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/
CVE: CVE-2018-14901
Published: 2018-08-30
Description: The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/; https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/
CVE: CVE-2018-14902
Published: 2018-08-30
Description: The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read scanned documents.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/; https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/
CVE: CVE-2018-14903
Published: 2018-08-30
Description: EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote attackers to cause a printer malfunction or send malicious data to the printer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/; https://www.vdalabs.com/2018/08/26/epson-printer-vulnerabilities/