deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14889
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to the lack of a range check on the array index into the WMI descriptor pool, arbitrary address execution may potentially occur in the process mgmt completion handler.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=e11e9dc8298dc0632050cacce96e9652d017f755; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-15814
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msm_flash_subdev_do_ioctl of drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c, there is a possible out of bounds read if flash_data.cfg_type is CFG_FLASH_INIT due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-15830
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper ch_list array index initialization in function sme_set_plm_request() causes potential buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-129
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=8a7a2a9c5d203e[PII_REDACTED]061c79d3bc257ebe; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-15831
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wma_ndp_end_indication_event_handler(), there is no input validation check on a event_info value coming from firmware, which can cause an integer overflow and then leads to potential heap overwrite.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-190
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=31e6a657320e4299c659e3d57d38a89afe8c1ce1; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-15833
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, untrusted pointer dereference in update_userspace_power() function in power leads to information exposure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200, CWE-476
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=51ce6aec73d80e1f1fcc9c7fa71e9c2fcbdbc0fd; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-15834
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, race condition in diag_dbgfs_read_dcistats(), while accessing diag_dbgfs_dci_data_index, causes potential heap overflow.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119, CWE-362
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=2e1b54e38f1516e70d9f6581c4f1ee935effb903; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18050
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_map in wma_tbttoffset_update_event_handler(), which is received from firmware, leads to potential buffer overwrite and out of bounds memory read.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=63b57442d65dfdb4b4634ff32059b1bca8c72fb7; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18051
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event->vdev_id in wma_rcpi_event_handler(), which is received from firmware, leads to potential out of bounds memory read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=38fba6a9f6ca3c7bf0c4c1bd84fa2b89fbcaeb93; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18052
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for cmpl_params->num_reports, param_buf->desc_ids and param_buf->status in wma_mgmt_tx_bundle_completion_handler(), which is received from firmware, leads to potential out of bounds memory read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=c04c4870bd86a5f878553d7acf207388f3d6c3bd; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18053
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for fix_param->vdev_id in wma_p2p_lo_event_handler(), which is received from firmware, leads to potential out of bounds memory read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=da1c6e996ac7635c202296e31118f088f9427947; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18054
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for num_vdev_mac_entries in wma_pdev_hw_mode_transition_evt_handler(), which is received from firmware, leads to potential buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=6eefc756612e39fab49ff719b3dc9b94def53396; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18055
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmi_event->num_vdev_mac_entries in wma_pdev_set_hw_mode_resp_evt_handler(), which is received from firmware, leads to potential buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=50a0554d12cff58b3ffbd51d[PII_REDACTED]b87023; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18057
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_nlo_scan_cmp_evt_handler(), which is received from firmware, leads to potential out of bounds memory read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=24d41d2bd3d98325b3800345f4ba27a334b3894b; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18058
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wow_buf_pkt_len in wma_wow_wakeup_host_event() which is received from firmware leads to potential out of bounds memory read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=d6d42a10d4abf09299cdfacdd8aed5c26731b5ff; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18059
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_scan_event_callback(), which is received from firmware, leads to potential out of bounds memory read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=217705da7726002ffe61dad51a6c9cc97c52f649; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18060
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for resp_event->vdev_id in wma_unified_bcntx_status_event_handler(), which is received from firmware, leads to potential out of bounds memory read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=f3d81bd0b3cb992c214d94196b33168b02589c6b; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18061
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing AOA measurement event from WIGIG firmware in wil_aoa_evt_meas().
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=b65cf2a007e88fe86dbd6d3269682fc585a4130f; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18062
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing UTF event in wma_process_utf_event().
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=d7927eb7c9c2d79a3e24cddd1e9447ab98bf6700; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18065
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent->vdev_id in wma_action_frame_filter_mac_event_handler(), which is received from firmware, leads to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a8bc0f90ef49ea0aee90047a17772e4eebff259a; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2017-18066
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper controls in MSM CORE leads to use memory after it is freed in msm_core_ioctl().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=ff11f44c0c10c94170f03a8698f73f7e08b74625; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2018-3560
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Double Free vulnerability exists in Audio Driver while opening a sound compression device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2018-3561
Published: 2018-03-16
Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in diag_ioctl_lsm_deinit() leads to a Use After Free condition.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/pixel/2018-03-01; https://source.android.com/security/bulletin/pixel/2018-03-01
CVE: CVE-2018-8740
Published: 2018-03-17
Description: In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html; http://www.securityfocus.com/bid/103466; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6964
CVE: CVE-2018-8737
Published: 2018-03-17
Description: Bookme Control Panel 2.0 Application is vulnerable to stored XSS within the Customers "Book Me" function. Within the Name and Note (aka custName and custNote) sections of the Customers screen, the application does not sanitize user-supplied input and renders injected JavaScript code to the user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://neetech18.blogspot.in/2018/03/stored-xss-vulnerability-in-bookme_17.html; https://neetech18.blogspot.in/2018/03/stored-xss-vulnerability-in-bookme_17.html
CVE: CVE-2018-8741
Published: 2018-03-17
Description: A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the att_local_name field in Deliver.class.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2018/03/17/2; http://www.securitytracker.com/id/1040554; https://gist.github.com/hannob/3c4f86863c418930ad08853c1109364e
CVE: CVE-2017-18239
Published: 2018-03-18
Description: A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/jasongoodwin/authentikat-jwt/commit/2d2fa0d40ac8f2f7aa7e9b070fa1a25eee082cb0; https://github.com/jasongoodwin/authentikat-jwt/issues/12; https://github.com/jasongoodwin/authentikat-jwt/pull/36
CVE: CVE-2018-8754
Published: 2018-03-18
Description: The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libyal/libevt/commit/9d2cc3ca0a1612a6b271abcacffc2e3eea42925e; https://www.debian.org/security/2018/dsa-4160; https://github.com/libyal/libevt/commit/9d2cc3ca0a1612a6b271abcacffc2e3eea42925e
CVE: CVE-2018-8756
Published: 2018-03-18
Description: Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=member_content&a=init request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/guiciwushuang/yzmcms/blob/master/yzmcms_eval_injection_chinese.pdf; https://github.com/guiciwushuang/yzmcms/blob/master/yzmcms_eval_injection_english.pdf; https://github.com/guiciwushuang/yzmcms/blob/master/yzmcms_eval_injection_chinese.pdf
CVE: CVE-2018-8765
Published: 2018-03-18
Description: In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222018.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222018; https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222018
CVE: CVE-2018-8766
Published: 2018-03-18
Description: joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php, related to manager/admin_vod.php?action=add.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/joyplus/joyplus-cms/issues/421; https://github.com/joyplus/joyplus-cms/issues/421
CVE: CVE-2018-8767
Published: 2018-03-18
Description: joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=save&tab={pre}vod_type via the t_name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/joyplus/joyplus-cms/issues/420; https://github.com/joyplus/joyplus-cms/issues/420
CVE: CVE-2018-8768
Published: 2018-03-18
Description: In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
CVSS Score: 7.8 (HIGH)
References: http://openwall.com/lists/oss-security/2018/03/15/2; https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html; http://openwall.com/lists/oss-security/2018/03/15/2
CVE: CVE-2018-8769
Published: 2018-03-18
Description: elfutils 0.170 has a buffer over-read in the ebl_dynamic_tag_name function of libebl/ebldynamictagname.c because SYMTAB_SHNDX is unsupported.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://sourceware.org/bugzilla/show_bug.cgi?id=22976; https://sourceware.org/bugzilla/show_bug.cgi?id=22976
CVE: CVE-2018-8770
Published: 2018-03-18
Description: Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php in tests/.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/Kyhvedn/CVE_Description/blob/master/Cobub_Razor_0.8.0_more_physical_path_leakage.md; https://www.exploit-db.com/exploits/44495/; https://github.com/Kyhvedn/CVE_Description/blob/master/Cobub_Razor_0.8.0_more_physical_path_leakage.md
CVE: CVE-2017-18240
Published: 2018-03-19
Description: The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL (when the service is stopped).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103469; https://bugs.gentoo.org/628540; https://security.gentoo.org/glsa/201803-10
CVE: CVE-2014-3626
Published: 2018-03-19
Description: The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did not step outside the appropriate root directory (e.g. the web application root), decoded the URI and checked that this did not introduce additional /../ (and similar) sequences. A bug was introduced where the Grails Resource Plugin before 1.2.13 returned the decoded version of the URI rather than the normalized version of the URI after the directory traversal check. This exposed a double decoding vulnerability. To address this issue, the Grails Resource Plugin now repeatedly decodes the URI up to three times or until decoding no longer changes the URI. If the decode limit of 3 is exceeded the URI is rejected. A side-effect of this is that the Grails Resource Plugin is unable to serve a resource that includes a '%' character in the full path to the resource. Not all environments are vulnerable because of the differences in URL resolving in different servlet containers. Applications deployed to Tomcat 8 and Jetty 9 were found not not be vulnerable, however applications deployed to JBoss EAP 6.3 / JBoss AS 7.4 and JBoss AS 7.1 were found to be vulnerable (other JBoss versions weren't tested). In certain cases JBoss returns JBoss specific vfs protocol urls from URL resolution methods (ClassLoader.getResources). The JBoss vfs URL protocol supports resolving any file on the filesystem. This made the directory traversal possible. There may be other containers, in addition to JBoss, on which this vulnerability is exposed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://pivotal.io/security/cve-2014-3626; https://pivotal.io/security/cve-2014-3626
CVE: CVE-2015-5350
Published: 2018-03-19
Description: In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read files on the host system that the BOSH-created vcap user has permissions to read and then package them into their app droplet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://pivotal.io/security/cve-2015-5350; https://pivotal.io/security/cve-2015-5350
CVE: CVE-2018-6842
Published: 2018-03-19
Description: Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/zamous/c0afd7e21f3111de873c7bef6dcd9dd7; https://gist.github.com/zamous/c0afd7e21f3111de873c7bef6dcd9dd7
CVE: CVE-2018-6843
Published: 2018-03-19
Description: Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://gist.github.com/zamous/c0afd7e21f3111de873c7bef6dcd9dd7; https://gist.github.com/zamous/c0afd7e21f3111de873c7bef6dcd9dd7
CVE: CVE-2018-7422
Published: 2018-03-19
Description: A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-829
References: http://seclists.org/fulldisclosure/2018/Mar/40; https://wpvulndb.com/vulnerabilities/9044; https://www.exploit-db.com/exploits/44340/
CVE: CVE-2018-8761
Published: 2018-03-19
Description: protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture.
CVSS Score: 7.5 (HIGH)
References: https://github.com/QQ704568679/-/blob/master/YXcms%20TheCode%20audit; https://github.com/QQ704568679/-/blob/master/YXcms%20TheCode%20audit