deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-12495
Published: 2018-06-15
Description: The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Orc/discount/issues/189#issuecomment-397541501; https://lists.debian.org/debian-lts-announce/2018/09/msg00009.html; https://www.debian.org/security/2018/dsa-4293
CVE: CVE-2018-12498
Published: 2018-06-15
Description: spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/idreamsoft/iCMS/issues/26; https://github.com/idreamsoft/iCMS/issues/26
CVE: CVE-2017-18169
Published: 2018-06-15
Description: User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin
CVE: CVE-2018-5860
Published: 2018-06-15
Description: In the MDSS driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, a data structure may be used without being initialized correctly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin
CVE: CVE-2018-5863
Published: 2018-06-15
Description: If userspace provides a too-large WPA RSN IE length in wlan_hdd_cfg80211_set_ie(), a buffer overflow occurs in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2018/06/04/june-2018-code-aurora-security-bulletin
CVE: CVE-2017-17062
Published: 2018-06-16
Description: The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitrary user attributes by leveraging improper privilege management.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html; http://seclists.org/fulldisclosure/2018/Jun/23; https://www.exploit-db.com/exploits/44881/
CVE: CVE-2018-11221
Published: 2018-06-16
Description: Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://blog.hackercat.ninja/post/pandoras_box/; https://pandorafms.com/wp-content/uploads/2018/06/whats-new-723-EN.pdf; https://blog.hackercat.ninja/post/pandoras_box/
CVE: CVE-2018-11222
Published: 2018-06-16
Description: Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://blog.hackercat.ninja/post/pandoras_box/; https://pandorafms.com/wp-content/uploads/2018/06/whats-new-723-EN.pdf; https://blog.hackercat.ninja/post/pandoras_box/
CVE: CVE-2018-11223
Published: 2018-06-16
Description: XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=" call.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.hackercat.ninja/post/pandoras_box/; https://pandorafms.com/wp-content/uploads/2018/06/whats-new-723-EN.pdf; https://blog.hackercat.ninja/post/pandoras_box/
CVE: CVE-2018-5751
Published: 2018-06-16
Description: The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html; http://seclists.org/fulldisclosure/2018/Jun/23; https://www.exploit-db.com/exploits/44881/
CVE: CVE-2018-5752
Published: 2018-06-16
Description: The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html; http://seclists.org/fulldisclosure/2018/Jun/23; https://www.exploit-db.com/exploits/44881/
CVE: CVE-2018-5753
Published: 2018-06-16
Description: The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a (1) From or (2) Sender address.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html; http://seclists.org/fulldisclosure/2018/Jun/23; https://www.exploit-db.com/exploits/44881/
CVE: CVE-2018-5754
Published: 2018-06-16
Description: Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html; http://seclists.org/fulldisclosure/2018/Jun/23; https://www.exploit-db.com/exploits/44881/
CVE: CVE-2018-5755
Published: 2018-06-16
Description: Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html; http://seclists.org/fulldisclosure/2018/Jun/23; https://www.exploit-db.com/exploits/44881/
CVE: CVE-2018-5756
Published: 2018-06-16
Description: The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/tasks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: http://packetstormsecurity.com/files/148118/OX-App-Suite-7.8.4-XSS-Privilege-Management-SSRF-Traversal.html; http://seclists.org/fulldisclosure/2018/Jun/23; https://www.exploit-db.com/exploits/44881/
CVE: CVE-2018-6496
Published: 2018-06-16
Description: Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-502
References: http://www.securityfocus.com/bid/104483; http://www.securitytracker.com/id/1041139; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180066
CVE: CVE-2018-6497
Published: 2018-06-16
Description: Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31, 10.32, 10.33, 10.33 CUP2, 11.0 and CMS Server version 2018.05 BACKGROUND which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-502
References: http://www.securitytracker.com/id/1041140; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180069; http://www.securitytracker.com/id/1041140
CVE: CVE-2018-9859
Published: 2018-06-16
Description: The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it's available to create an executable file with System privilege by other vulnerable applications.
CVSS Score: 8.1 (HIGH)
References: https://cve.naver.com/detail/cve-2018-9859.html; https://cve.naver.com/detail/cve-2018-9859.html
CVE: CVE-2018-12501
Published: 2018-06-16
Description: Nagios Fusion before 4.1.4 has XSS, aka TPS#13332-13335.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-fusion/change-log/; https://www.nagios.com/downloads/nagios-fusion/change-log/
CVE: CVE-2018-12503
Published: 2018-06-16
Description: tinyexr 0.9.5 has a heap-based buffer over-read in LoadEXRImageFromMemory in tinyexr.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_b53a457; https://github.com/syoyo/tinyexr/issues/81; https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_b53a457
CVE: CVE-2018-12504
Published: 2018-06-16
Description: tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_b53a457; https://github.com/syoyo/tinyexr/issues/82; https://github.com/ChijinZ/security_advisories/tree/master/tinyexr_b53a457
CVE: CVE-2018-12453
Published: 2018-06-16
Description: Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704
References: https://gist.github.com/fakhrizulkifli/34a56d575030682f6c564553c53b82b5; https://github.com/antirez/redis/commit/c04082cf138f1f51cedf05ee9ad36fb6763cafc6; https://www.exploit-db.com/exploits/44908/
CVE: CVE-2018-12454
Published: 2018-06-17
Description: The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d; https://medium.com/%40jonghyk.song/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d
CVE: CVE-2018-12262
Published: 2018-06-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-12326
Published: 2018-06-17
Description: Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2019:0052; https://access.redhat.com/errata/RHSA-2019:0094; https://access.redhat.com/errata/RHSA-2019:1860
CVE: CVE-2018-10377
Published: 2018-06-17
Description: PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://releases.portswigger.net/2018/06/1734.html; https://hackerone.com/reports/337680; https://integritylabs.io/advisories/cve-2018-10377
CVE: CVE-2018-10969
Published: 2018-06-17
Description: SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/pie-register/#developers; https://www.exploit-db.com/exploits/44867/; https://wordpress.org/plugins/pie-register/#developers
CVE: CVE-2018-11647
Published: 2018-06-17
Description: index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jaredhanson/oauth2orize-fprm/blob/master/SECURITY-NOTICE.md; https://github.com/jaredhanson/oauth2orize-fprm/commit/2bf9faee787eb004abbdfb6f4cc2fb06653defd5; https://github.com/jaredhanson/oauth2orize-fprm/blob/master/SECURITY-NOTICE.md
CVE: CVE-2018-12329
Published: 2018-06-17
Description: Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows a local attacker to duplicate an authentication factor via cloning.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12330
Published: 2018-06-17
Description: Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via compromised firmware.
CVSS Score: 8.1 (HIGH)
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12331
Published: 2018-06-17
Description: Authentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2.68 allows a man-in-the-middle attacker to compromise authentication keys and configurations via IP spoofing during "Easy Enrollment."
CVSS Score: 7.4 (HIGH)
CWE: CWE-290
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12332
Published: 2018-06-17
Description: Incomplete Cleanup vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via a compromised host PC after a reset.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-459
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12333
Published: 2018-06-17
Description: Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate security relevant configurations and execute malicious code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12334
Published: 2018-06-17
Description: Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via a virtualization attack.
CVSS Score: 7.5 (HIGH)
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12335
Published: 2018-06-17
Description: Incorrect access control in ECOS System Management Appliance (aka SMA) 5.2.68 allows a user to compromise authentication keys, and access and manipulate security relevant configurations, via unrestricted database access during Easy Enrollment.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12336
Published: 2018-06-17
Description: Undocumented Factory Backdoor in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows the vendor to extract confidential information via remote root SSH access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12337
Published: 2018-06-17
Description: Reliance on Security Through Obscurity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to partially extract confidential configurations via user-space emulation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-12338
Published: 2018-06-17
Description: Undocumented Factory Backdoor in ECOS System Management Appliance (aka SMA) 5.2.68 allows the vendor to extract confidential information and manipulate security relevant configurations via remote root SSH access.
CVSS Score: 9.8 (CRITICAL)
References: https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html; https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html
CVE: CVE-2018-10997
Published: 2018-06-17
Description: Etere EtereWeb before 28.1.20 has a pre-authentication blind SQL injection in the POST parameters txUserName and txPassword.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/dmblbc/14a77036a[PII_REDACTED]c3cf3ee3f265e; https://gist.github.com/dmblbc/14a77036a[PII_REDACTED]c3cf3ee3f265e
CVE: CVE-2018-11218
Published: 2018-06-17
Description: Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://antirez.com/news/119; http://www.securityfocus.com/bid/104553; https://access.redhat.com/errata/RHSA-2019:0052
CVE: CVE-2018-11219
Published: 2018-06-17
Description: An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://antirez.com/news/119; http://www.securityfocus.com/bid/104552; https://access.redhat.com/errata/RHSA-2019:0052
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10531. Reason: This candidate is a reservation duplicate of CVE-2016-10531. Notes: All CVE users should reference CVE-2016-10531 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10540. Reason: This candidate is a reservation duplicate of CVE-2016-10540. Notes: All CVE users should reference CVE-2016-10540 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10542. Reason: This candidate is a reservation duplicate of CVE-2016-10542. Notes: All CVE users should reference CVE-2016-10542 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-12026
Published: 2018-06-17
Description: During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-59
References: https://blog.phusion.nl/passenger-5-3-2; https://security.gentoo.org/glsa/201807-02; https://blog.phusion.nl/passenger-5-3-2
CVE: CVE-2018-12027
Published: 2018-06-17
Description: An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said socket are writable by a normal user that is not the application's user, then that non-application user can swap that directory with something else, resulting in traffic being redirected to a non-application user's process through an alternative Unix domain socket.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-732
References: https://blog.phusion.nl/passenger-5-3-2; https://security.gentoo.org/glsa/201807-02; https://blog.phusion.nl/passenger-5-3-2
CVE: CVE-2018-12028
Published: 2018-06-17
Description: An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://blog.phusion.nl/passenger-5-3-2; https://security.gentoo.org/glsa/201807-02; https://blog.phusion.nl/passenger-5-3-2
CVE: CVE-2018-12029
Published: 2018-06-17
Description: A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://blog.phusion.nl/passenger-5-3-2; https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html; https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc
CVE: CVE-2018-12071
Published: 2018-06-17
Description: A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://github.com/bcit-ci/CodeIgniter/commit/800a20d6c4662d99ae0988b2f8f2238bb8bb29db; https://www.codeigniter.com/user_guide/changelog.html; https://www.codeigniter.com/user_guide/changelog.html
CVE: CVE-2018-12072
Published: 2018-06-17
Description: An issue was discovered in Cloud Media Popcorn A-200 03-05-130708-21-POP-411-000 firmware. It is configured to provide TELNET remote access (without a password) that pops a shell as root. If an attacker can connect to port 23 on the device, he can completely compromise it.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/freetom/2a446a226d0e98807c8b0c1111ef2def; https://gist.github.com/freetom/2a446a226d0e98807c8b0c1111ef2def