deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7289
Published: 2018-02-21
Description: An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters.
CVSS Score: 3.3 (LOW)
CWE: CWE-172
References: https://github.com/armadito/armadito-windows-driver/issues/5; https://www.exploit-db.com/exploits/44169/; https://github.com/armadito/armadito-windows-driver/issues/5
CVE: CVE-2018-7302
Published: 2018-02-21
Description: Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html; https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html
CVE: CVE-2018-7303
Published: 2018-02-21
Description: The Calendar component in Tiki 17.1 allows HTML injection.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html; https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html
CVE: CVE-2018-7304
Published: 2018-02-21
Description: Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html; https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html
CVE: CVE-2018-7305
Published: 2018-02-21
Description: MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-352
References: https://websecnerd.blogspot.in/2018/02/mybb-forum-1_21.html; https://websecnerd.blogspot.in/2018/02/mybb-forum-1_21.html
CVE: CVE-2017-1462
Published: 2018-02-21
Description: IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128461.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22013739; http://www.securityfocus.com/bid/103127; http://www.securitytracker.com/id/1040393
CVE: CVE-2017-1604
Published: 2018-02-21
Description: IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132851.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22011883; http://www.securityfocus.com/bid/103126; https://exchange.xforce.ibmcloud.com/vulnerabilities/132851
CVE: CVE-2017-1758
Published: 2018-02-21
Description: IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender Advanced 9.0) is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 135859.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg22012828; http://www.ibm.com/support/docview.wss?uid=swg22013375; http://www.ibm.com/support/docview.wss?uid=swg22013432
CVE: CVE-2018-7308
Published: 2018-02-21
Description: A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any hosting account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.andmp.com/2018/02/advisory-assigned-cve-2018-7308-csrf.html; https://github.com/DanWin/hosting/issues/18; http://www.andmp.com/2018/02/advisory-assigned-cve-2018-7308-csrf.html
CVE: CVE-2018-6936
Published: 2018-02-21
Description: Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://0day4u.wordpress.com/2018/02/21/d-link-dir-600m-wireless-stored-xss/; https://www.exploit-db.com/exploits/44219/; https://0day4u.wordpress.com/2018/02/21/d-link-dir-600m-wireless-stored-xss/
CVE: CVE-2018-7281
Published: 2018-02-21
Description: CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. The binary takes a single command line argument and passes this argument to a system() call, thus allowing low privileged users to execute commands as root.
CVSS Score: 8.8 (HIGH)
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-003.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-003.md
CVE: CVE-2018-7311
Published: 2018-02-21
Description: PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new VPN connection operations via the main PrivateVPN application. The privileged helper tool creates new VPN connections by executing the openvpn binary located in the /Applications/PrivateVPN.app/Contents/Resources directory. The openvpn binary can be overwritten by the default user, which allows an attacker that has already installed malicious software as the default user to replace the binary. When a new VPN connection is established, the privileged helper tool will launch this malicious binary, thus allowing an attacker to execute code as the root user. NOTE: the vendor has reportedly indicated that this behavior is "an acceptable part of their software.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://gist.github.com/anonymous/cfc3f3419804b22ee9e82ee8d16a661d; https://github.com/VerSprite/research/blob/eba22c8b506be6f7128ef[PII_REDACTED]d5667bfff/advisories/VS-2018-004.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-004.md
CVE: CVE-2018-0121
Published: 2018-02-22
Description: A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper security restrictions that are imposed by the web-based service portal of the affected software. An attacker could exploit this vulnerability by submitting an empty password value to an affected portal when prompted to enter an administrative password for the portal. A successful exploit could allow the attacker to bypass authentication and gain administrator privileges for the web-based service portal of the affected software. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg29809.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/103113; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc; http://www.securityfocus.com/bid/103113
CVE: CVE-2018-0124
Published: 2018-02-22
Description: A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending arbitrary requests using the insecure key to a targeted application. An exploit could allow the attacker to execute arbitrary code. This vulnerability affects Cisco Unified Communications Domain Manager releases prior to 11.5(2). Cisco Bug IDs: CSCuv67964.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-320, CWE-320
References: http://www.securityfocus.com/bid/103114; http://www.securitytracker.com/id/1040405; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucdm
CVE: CVE-2018-0130
Published: 2018-02-22
Description: A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials for the web-based service portal of the affected software. An attacker could exploit this vulnerability by extracting the credentials from an image of the affected software and using those credentials to generate a valid administrative session token for the web-based service portal of any other installation of the affected software. A successful exploit could allow the attacker to gain administrative access to the web-based service portal of an affected system. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg30884.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264, CWE-1188
References: http://www.securityfocus.com/bid/103116; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1; http://www.securityfocus.com/bid/103116
CVE: CVE-2018-0139
Published: 2018-02-22
Description: A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause the IVR connection to disconnect, creating a system-wide denial of service (DoS) condition. The vulnerability is due to improper handling of a TCP connection request when the IVR connection is already established. An attacker could exploit this vulnerability by initiating a crafted connection to the IP address of the targeted CVP device. An exploit could allow the attacker to disconnect the IVR to CVP connection, creating a DoS condition that prevents the CVP from accepting new, incoming calls while the IVR automatically attempts to re-establish the connection to the CVP. This vulnerability affects Cisco Unified Customer Voice Portal (CVP) Software Release 11.5(1). Cisco Bug IDs: CSCve70560.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103124; http://www.securitytracker.com/id/1040414; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-cvp
CVE: CVE-2018-0145
Published: 2018-02-22
Description: A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information on the affected system. Cisco Bug IDs: CSCvg45105.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103131; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-dcaf; http://www.securityfocus.com/bid/103131
CVE: CVE-2018-0146
Published: 2018-02-22
Description: A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to improper CSRF protection by the affected application. An attacker could exploit this vulnerability by persuading a user of the affected application to click a malicious link. A successful exploit could allow the attacker to submit arbitrary requests and take unauthorized actions on behalf of the user. Cisco Bug IDs: CSCvg45114.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/103122; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-dcaf1; http://www.securityfocus.com/bid/103122
CVE: CVE-2018-0148
Published: 2018-02-22
Description: A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Supervisor Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protection by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions, via the user's web browser and with the user's privileges, on an affected system. Cisco Bug IDs: CSCvf71929.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/103141; http://www.securitytracker.com/id/1040412; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucsd
CVE: CVE-2018-0199
Published: 2018-02-22
Description: A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. An exploit could allow the attacker to perform remote code execution. Cisco Bug IDs: CSCve53989.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103143; http://www.securitytracker.com/id/1040407; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-jcf
CVE: CVE-2018-0200
Published: 2018-02-22
Description: A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface of an affected product. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvh65713.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103128; http://www.securitytracker.com/id/1040408; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-psc
CVE: CVE-2018-0201
Published: 2018-02-22
Description: A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of input during web page generation. An attacker could exploit this vulnerability by embedding media in instant messages. An exploit could allow the attacker to cause the recipient chat client to make outbound requests. Cisco Bug IDs: CSCve54001.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103133; http://www.securitytracker.com/id/1040406; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-jcf1
CVE: CVE-2018-0203
Published: 2018-02-22
Description: A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability. The vulnerability is due to improper handling of domain information in the affected software. An unauthenticated, remote attacker could exploit this vulnerability by sending crafted requests to the targeted application. A successful exploit could allow the attacker to send email messages to arbitrary addresses. Cisco Bug IDs: CSCvg62215.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-19
References: http://www.securityfocus.com/bid/103142; http://www.securitytracker.com/id/1040413; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-cuc
CVE: CVE-2018-0204
Published: 2018-02-22
Description: A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition for individual users. The vulnerability is due to weak login controls. An attacker could exploit this vulnerability by using a brute-force attack (Repeated Bad Login Attempts). A successful exploit could allow the attacker to restrict user access. Manual administrative intervention is required to restore access. Cisco Bug IDs: CSCvd07264.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-521
References: http://www.securityfocus.com/bid/103150; http://www.securitytracker.com/id/1040410; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-pcpt
CVE: CVE-2018-0205
Published: 2018-02-22
Description: A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by placing a malicious string in the Prime Collaboration Provisioning database. A successful exploit could allow the attacker to access Cisco Prime Collaboration Provisioning by injecting crafted data into the database. Cisco Bug IDs: CSCvd86609.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103145; http://www.securitytracker.com/id/1040409; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-pcpt1
CVE: CVE-2018-0206
Published: 2018-02-22
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a link that submits malicious input to the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg74815.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103146; http://www.securitytracker.com/id/1040411; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucm
CVE: CVE-2018-7284
Published: 2018-02-22
Description: A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2018-004.html; http://www.securityfocus.com/bid/103151; http://www.securitytracker.com/id/1040416
CVE: CVE-2018-7285
Published: 2018-02-22
Description: A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamic codecs and desired payload numbers. While an SDP negotiation may result in a codec using a different payload number, these desired ones are still stored internally. When an RTP packet was received, this registry would be consulted if the payload number was not found in the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payload number resulted in a codec of a different type than the RTP stream (for example, the payload number resulted in a video codec but the stream carried audio), a crash could occur if no stream of that type had been negotiated. This was due to the code incorrectly assuming that a stream of that type would always exist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://downloads.asterisk.org/pub/security/AST-2018-001.html; http://www.securityfocus.com/bid/103149; http://www.securitytracker.com/id/1040415
CVE: CVE-2018-7286
Published: 2018-02-22
Description: An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.
CVSS Score: 6.5 (MEDIUM)
References: http://downloads.asterisk.org/pub/security/AST-2018-005.html; http://www.securityfocus.com/bid/103129; http://www.securitytracker.com/id/1040417
CVE: CVE-2018-7287
Published: 2018-02-22
Description: An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1. If the HTTP server is enabled (default is disabled), WebSocket payloads of size 0 are mishandled (with a busy loop).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-754
References: http://downloads.digium.com/pub/security/AST-2018-006.html; http://www.securityfocus.com/bid/103120; http://www.securitytracker.com/id/1040419
CVE: CVE-2018-7313
Published: 2018-02-22
Description: SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/44158/; https://www.exploit-db.com/exploits/44158/
CVE: CVE-2017-18193
Published: 2018-02-22
Description: fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG) via an application with multiple threads.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dad48e73127ba10279ea33e6dbc8d3905c4d31c0; http://www.securityfocus.com/bid/103147; https://github.com/torvalds/linux/commit/dad48e73127ba10279ea33e6dbc8d3905c4d31c0
CVE: CVE-2017-18194
Published: 2018-02-22
Description: SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker to execute arbitrary SQL commands via the "utype" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]