deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible information disclosure, server-side request forgery, or remote code execution. This attack appear to be exploitable via Specially crafted game data file (XML).
CVSS Score: 7.8 (HIGH)
CWE: CWE-611
References: https://0dd.zone/2018/05/31/TripleA-XXE/; https://github.com/triplea-game/triplea/issues/3442; https://0dd.zone/2018/05/31/TripleA-XXE/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result in The error allows you to access records that you have no permissions to. .
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://github.com/tsolucio/corebos/blob/287780a61f98adca1fa631ae6e5de346947c7f81/modules/Contacts/EditView.php#L54; https://github.com/tsolucio/corebos/blob/287780a61f98adca1fa631ae6e5de346947c7f81/modules/Contacts/EditView.php#L54
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted UXF file. This vulnerability appears to have been fixed in 14.3.
CVSS Score: 7.8 (HIGH)
CWE: CWE-611
References: http://0dd.zone/2018/04/23/UMLet-XXE/; https://github.com/umlet/umlet/issues/500; http://0dd.zone/2018/04/23/UMLet-XXE/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2018/1000xxx/CVE-2[PII_REDACTED].json; https://shadow-vault.com/wekan.html; https://wekan.github.io/hall-of-fame/brutebleed/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem. This attack appear to be exploitable via HTTP GET/POST request. This vulnerability appears to have been fixed in 6.2.32.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://lists.debian.org/debian-lts-announce/2018/07/msg00033.html; https://sympa-community.github.io/security/2018-001.html; https://usn.ubuntu.com/4442-1/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Trovebox version <= 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 742b8edbe.
CVSS Score: 8.8 (HIGH)
References: https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html; https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html; https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Trovebox version <= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update internal resources. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html; https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html; https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.pluginvulnerabilities.com/2017/04/28/reflected-cross-site-scripting-xss-vulnerability-in-wp-statistics/; https://www.pluginvulnerabilities.com/2017/04/28/reflected-cross-site-scripting-xss-vulnerability-in-wp-statistics/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functionality that can result in An attacker is able to execute arbitrary (javascript) code within a victims' browser. This attack appear to be exploitable via Victim must open a crafted link to the application. This vulnerability appears to have been fixed in ocsreports 2.4.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/; https://www.secuvera.de/advisories/secuvera-SA-2017-03.txt; https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can result in An authenticated attacker is able to gain full access to data stored within database. This attack appear to be exploitable via By sending crafted requests it is possible to gain database access. This vulnerability appears to have been fixed in 2.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/; https://www.secuvera.de/advisories/secuvera-SA-2017-04.txt; https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac[PII_REDACTED]9) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be exploitable via the victim must open a page with a specially crafted <title> attribute, and then open the qute://history site via the :history command. This vulnerability appears to have been fixed in fixed in v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7; https://github.com/qutebrowser/qutebrowser/commit/5a7869f2feaa346853d2a85413d6527c87ef0d9f; https://github.com/qutebrowser/qutebrowser/issues/4011
CVE: CVE-2017-7658
Published: 2018-06-26
Description: In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444, CWE-444
References: http://www.securityfocus.com/bid/106566; http://www.securitytracker.com/id/1041194; https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-440; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-440
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-916; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-916
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCleanupThread.java, JCloudsCloud.java, JCloudsComputer.java, JCloudsPreCreationThread.java, JCloudsRetentionStrategy.java, JCloudsSlave.java, JCloudsSlaveTemplate.java, LauncherFactory.java, OpenstackCredentials.java, OpenStackMachineStep.java, SlaveOptions.java, SlaveOptionsDescriptor.java that allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, and to cause Jenkins to submit HTTP requests to attacker-specified URLs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-808; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-808
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-941; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-941
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-819; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-819
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-870; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-870
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured password.
CVSS Score: 7.2 (HIGH)
CWE: CWE-522
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-950; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-950
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-927; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-927
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-929; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-929
CVE: CVE-2018-6667
Published: 2018-06-26
Description: Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbitrary code via Java management extensions (JMX).
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/104564; http://www.securitytracker.com/id/1041129; https://kc.mcafee.com/corporate/index?page=content&id=SB10241
CVE: CVE-2018-10658
Published: 2018-06-26
Description: There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from code inside libdbus-send.so shared object or similar.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; https://www.axis.com/files/faq/Advisory_ACV-128401.pdf; https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf
CVE: CVE-2018-10659
Published: 2018-06-26
Description: There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by sending a crafted command which will result in a code path that calls the UND undefined ARM instruction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; https://www.axis.com/files/faq/Advisory_ACV-128401.pdf; https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf
CVE: CVE-2018-10660
Published: 2018-06-26
Description: An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; https://www.axis.com/files/faq/Advisory_ACV-128401.pdf; https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf
CVE: CVE-2018-10661
Published: 2018-06-26
Description: An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; https://www.axis.com/files/faq/Advisory_ACV-128401.pdf; https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf
CVE: CVE-2018-10662
Published: 2018-06-26
Description: An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; https://www.axis.com/files/faq/Advisory_ACV-128401.pdf; https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf
CVE: CVE-2018-10663
Published: 2018-06-26
Description: An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; https://www.axis.com/files/faq/Advisory_ACV-128401.pdf; https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf
CVE: CVE-2018-10664
Published: 2018-06-26
Description: An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/; https://www.axis.com/files/faq/Advisory_ACV-128401.pdf; https://www.axis.com/files/sales/ACV-128401_Affected_Product_List.pdf
CVE: CVE-2018-1072
Published: 2018-06-26
Description: ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://access.redhat.com/errata/RHSA-2018:2071; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1072; https://access.redhat.com/errata/RHSA-2018:2071
CVE: CVE-2018-11447
Published: 2018-06-26
Description: A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by an legitimate user, who must be authenticated to the web interface as administrative user. A successful attack could allow an attacker to interact with the web interface as an administrative user. This could allow the attacker to read or modify the device configuration, or to exploit other vulnerabilities that require authentication as administrative user. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-352
References: https://cert-portal.siemens.com/productcert/pdf/ssa-977428.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-977428.pdf
CVE: CVE-2018-11448
Published: 2018-06-26
Description: A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a stored Cross-Site Scripting (XSS) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires that the attacker has access to the web interface of an affected device. The attacker must be authenticated as administrative user on the web interface. Afterwards, a legitimate user must access the web interface. A successful attack could allow an attacker to execute malicious code in the browser of a legitimate user. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-352, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-977428.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-977428.pdf
CVE: CVE-2018-11449
Published: 2018-06-26
Description: A vulnerability has been identified in SCALANCE M875 (All versions). An attacker with access to the local file system might obtain passwords for administrative users. Successful exploitation requires read access to files on the local file system. A successful attack could allow an attacker to obtain administrative passwords. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.8 (HIGH)
CWE: CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-977428.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-977428.pdf
CVE: CVE-2018-4845
Published: 2018-06-26
Description: A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthineers Informatics products), RAPIDLab 1200 Series (All versions < V3.3 _with_ Siemens Healthineers Informatics products), RAPIDPoint 500 systems (All versions >= V3.0 _with_ Siemens Healthineers Informatics products), RAPIDPoint 500 systems (V2.4.X_with_ Siemens Healthineers Informatics products), RAPIDPoint 500 systems (All versions =< V2.3 _with_ Siemens Healthineers Informatics products), RAPIDPoint 400 systems (All versions _with_ Siemens Healthineers Informatics products). Remote attackers with either local or remote credentialed access to the "Remote View" feature might be able to elevate their privileges, compromising confidentiality, integrity, and availability of the system. No special skills or user interaction are required to perform this attack. At the time of advisory publication, no public exploitation of this security vulnerability is known. Siemens Healthineers confirms the security vulnerability and provides mitigations to resolve the security issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-269
References: https://cert-portal.siemens.com/productcert/pdf/ssa-755010.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-755010.pdf