deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15476
Published: 2018-08-30
Description: An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The SSL/TLS server certificate in the device to cloud communication was not verified by the device. As a result, an attacker in control of the network traffic of a device could have taken control of a device by intercepting and modifying commands issued from the server to the device in a Man-in-the-Middle attack. This included the ability to inject firmware update commands into the communication and cause the device to install maliciously modified firmware.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt
CVE: CVE-2018-15477
Published: 2018-08-30
Description: myStrom WiFi Switch V1 devices before 2.66 did not sanitize a parameter received from the cloud that was used in an OS command. Malicious servers were able to run operating system commands on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt
CVE: CVE-2018-15478
Published: 2018-08-30
Description: An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The process of registering a device with a cloud account was based on an activation code derived from the device MAC address. By guessing valid MAC addresses or using MAC addresses printed on devices in shops and reverse engineering the protocol, an attacker would have been able to register previously unregistered devices to their account. When the rightful owner would have connected them after purchase to their WiFi network, the devices would not have registered with their account, would subsequently not have been controllable from the owner's mobile app, and would not have been visible in the owner's account. Instead, they would have been under control of the attacker.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt
CVE: CVE-2018-15479
Published: 2018-08-30
Description: An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. Devices did not authenticate themselves to the cloud in device to cloud communication. This lack of device authentication allowed an attacker to impersonate any device by guessing or learning their MAC address.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt
CVE: CVE-2018-15480
Published: 2018-08-30
Description: An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The cloud API had a hidden parameter, which allowed an authenticated user to reconfigure the server URL for a device registered to their account. In combination with an insecure device registration vulnerability, this allowed an attacker to reconfigure a maliciously registered device to their own rogue replica of the myStrom API and issue commands to the device, including firmware update commands.
CVSS Score: 8.8 (HIGH)
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt
CVE: CVE-2018-15745
Published: 2018-08-30
Description: Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt; http://packetstormsecurity.com/files/149134/Argus-Surveillance-DVR-4.0.0.0-Directory-Traversal.html; https://www.exploit-db.com/exploits/45296/
CVE: CVE-2018-10513
Published: 2018-08-30
Description: A Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120742.aspx; https://www.zerodayinitiative.com/advisories/ZDI-18-961/; https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120742.aspx
CVE: CVE-2018-10514
Published: 2018-08-30
Description: A Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120742.aspx; https://www.zerodayinitiative.com/advisories/ZDI-18-962/; https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120742.aspx
CVE: CVE-2018-15363
Published: 2018-08-30
Description: An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120742.aspx; https://www.zerodayinitiative.com/advisories/ZDI-18-963/; https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120742.aspx
CVE: CVE-2018-15364
Published: 2018-08-30
Description: A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: https://success.trendmicro.com/solution/1120678; https://www.zerodayinitiative.com/advisories/ZDI-18-964/; https://success.trendmicro.com/solution/1120678
CVE: CVE-2018-6498
Published: 2018-08-30
Description: Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669
CVE: CVE-2018-6499
Published: 2018-08-30
Description: Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en&cc=us&hpappid=206728_SSO_PRO; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667
CVE: CVE-2018-16231
Published: 2018-08-30
Description: Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (daemon crash) via an unspecified sequence of FTP commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://hansesecure.de/vulnerability-remote-dos-in-personal-ftp-server/; https://hansesecure.de/vulnerability-remote-dos-in-personal-ftp-server/
CVE: CVE-2018-16233
Published: 2018-08-30
Description: MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bg5sbk/MiniCMS/issues/22; https://github.com/bg5sbk/MiniCMS/issues/22
CVE: CVE-2018-16234
Published: 2018-08-30
Description: MorningStar WhatWeb 0.4.9 has XSS via JSON report files.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/urbanadventurer/WhatWeb/issues/261; https://github.com/urbanadventurer/WhatWeb/issues/261
CVE: CVE-2018-16236
Published: 2018-08-30
Description: cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2018-16237
Published: 2018-08-30
Description: An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI.
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: https://github.com/howchen/howchen/issues/2; https://github.com/howchen/howchen/issues/2
CVE: CVE-2018-16238
Published: 2018-08-30
Description: An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://github.com/howchen/howchen/issues/2; https://github.com/howchen/howchen/issues/2
CVE: CVE-2018-16239
Published: 2018-08-30
Description: An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://github.com/howchen/howchen/issues/2; https://github.com/howchen/howchen/issues/2
CVE: CVE-2018-16275
Published: 2018-08-31
Description: OPSWAT MetaDefender before v4.11.2 allows CSV injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://onlinehelp.opswat.com/corev4/10._Release_notes.html; https://onlinehelp.opswat.com/corev4/10._Release_notes.html
CVE: CVE-2018-7685
Published: 2018-08-31
Description: The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.
CVSS Score: 7.8 (HIGH)
CWE: CWE-358, CWE-347
References: http://lists.suse.com/pipermail/sle-security-updates/2018-August/004510.html; https://bugzilla.suse.com/show_bug.cgi?id=1091624; https://www.suse.com/de-de/security/cve/CVE-2018-7685/
CVE: CVE-2018-16276
Published: 2018-08-31
Description: An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f1e255d60ae66a9f672ff9a207ee6cd8e33d2679; https://bugzilla.suse.com/show_bug.cgi?id=1106095; https://bugzilla.suse.com/show_bug.cgi?id=1115593
CVE: CVE-2018-16278
Published: 2018-08-31
Description: phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajax_save_draft function with the dir parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/howchen/howchen/issues/3; https://github.com/howchen/howchen/issues/3
CVE: CVE-2018-3787
Published: 2018-08-31
Description: Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/357109; https://hackerone.com/reports/357109
CVE: CVE-2018-11054
Published: 2018-08-31
Description: RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://seclists.org/fulldisclosure/2018/Aug/46; https://www.oracle.com/security-alerts/cpuapr2020.html; https://www.oracle.com/security-alerts/cpujan2020.html
CVE: CVE-2018-11055
Published: 2018-08-31
Description: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: http://seclists.org/fulldisclosure/2018/Aug/46; https://www.oracle.com/security-alerts/cpuapr2020.html; https://www.oracle.com/security-alerts/cpujan2020.html
CVE: CVE-2018-11056
Published: 2018-08-31
Description: RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would exhaust the stack, potentially causing a Denial Of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://seclists.org/fulldisclosure/2018/Aug/46; https://www.oracle.com/security-alerts/cpuapr2020.html; https://www.oracle.com/security-alerts/cpujan2020.html
CVE: CVE-2018-11057
Published: 2018-08-31
Description: RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: http://seclists.org/fulldisclosure/2018/Aug/46; https://www.oracle.com/security-alerts/cpuapr2020.html; https://www.oracle.com/security-alerts/cpujan2020.html
CVE: CVE-2018-6257
Published: 2018-08-31
Description: NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled where improper access control may lead to a denial of service, escalation of privileges, or both.
CVSS Score: 7.0 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4685; https://nvidia.custhelp.com/app/answers/detail/a_id/4685
CVE: CVE-2018-6258
Published: 2018-08-31
Description: NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability during GameStream installation where an attacker who has system access can potentially conduct a Man-in-the-Middle (MitM) attack to obtain sensitive information.
CVSS Score: 4.7 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4685; https://nvidia.custhelp.com/app/answers/detail/a_id/4685
CVE: CVE-2018-6259
Published: 2018-08-31
Description: NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability when GameStream is enabled, an attacker has system access, and certain system features are enabled, where limited information disclosure may be possible.
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4685; https://nvidia.custhelp.com/app/answers/detail/a_id/4685
CVE: CVE-2018-16298
Published: 2018-08-31
Description: An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bg5sbk/MiniCMS/issues/23; https://github.com/bg5sbk/MiniCMS/issues/23
CVE: CVE-2018-15514
Published: 2018-09-01
Description: HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/105202; https://docs.docker.com/docker-for-windows/edge-release-notes/; https://docs.docker.com/docker-for-windows/release-notes/
CVE: CVE-2018-15157
Published: 2018-09-01
Description: The libfsclfs_block_read function in libfsclfs_block.c in libfsclfs before 2018-07-25 allows remote attackers to cause a heap-based buffer over-read via a crafted clfs file. NOTE: the vendor has disputed this as described in the GitHub issue comments
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libyal/libfsclfs/issues/3; https://github.com/libyal/libfsclfs/issues/3
CVE: CVE-2018-15158
Published: 2018-09-01
Description: The libesedb_page_read_values function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libyal/libesedb/issues/43; https://github.com/libyal/libesedb/issues/43
CVE: CVE-2018-15159
Published: 2018-09-01
Description: The libesedb_page_read_tags function in libesedb_page.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libyal/libesedb/issues/43; https://github.com/libyal/libesedb/issues/43
CVE: CVE-2018-15160
Published: 2018-09-01
Description: The libesedb_catalog_definition_read function in libesedb_catalog_definition.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libyal/libesedb/issues/43; https://github.com/libyal/libesedb/issues/43
CVE: CVE-2018-15161
Published: 2018-09-01
Description: The libesedb_key_append_data function in libesedb_key.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libyal/libesedb/issues/43; https://github.com/libyal/libesedb/issues/43
CVE: CVE-2018-16302
Published: 2018-09-01
Description: MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/44828/; https://www.exploit-db.com/exploits/44828/
CVE: CVE-2018-16303
Published: 2018-09-01
Description: PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://forum.tracker-software.com/viewtopic.php?f=62&t=31419; https://forum.tracker-software.com/viewtopic.php?f=62&t=31419
CVE: CVE-2018-16308
Published: 2018-09-01
Description: The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
CVSS Score: 8.6 (HIGH)
CWE: CWE-1236
References: https://packetstormsecurity.com/files/148993/WordPress-Ninja-Forms-3.3.13-CSV-Injection.html; https://wordpress.org/plugins/ninja-forms/#developers; https://www.exploit-db.com/exploits/45234/
CVE: CVE-2018-16313
Published: 2018-09-01
Description: Bludit 2.3.4 allows XSS via a user name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.csdn.net/F_carry/article/details/81536424; https://blog.csdn.net/F_carry/article/details/81536424
CVE: CVE-2018-16314
Published: 2018-09-01
Description: An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/idreamsoft/iCMS/issues/35; https://github.com/idreamsoft/iCMS/issues/35
CVE: CVE-2018-16315
Published: 2018-09-01
Description: In waimai Super Cms 20150505, there is a CSRF vulnerability that can change the configuration via admin.php?m=Config&a=add.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/caokang/waimai/issues/3; https://github.com/caokang/waimai/issues/3
CVE: CVE-2018-16316
Published: 2018-09-01
Description: A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/portainer/portainer/commit/1ad150c99460a35224d6adfe48ddda9ee056b7d2; https://github.com/portainer/portainer/commit/1ad150c99460a35224d6adfe48ddda9ee056b7d2
CVE: CVE-2018-16320
Published: 2018-09-01
Description: idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://github.com/idreamsoft/iCMS/issues/41; https://github.com/idreamsoft/iCMS/issues/41