deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5052
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html; http://www.securitytracker.com/id/1041250
CVE: CVE-2018-5053
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5054
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5055
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5056
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5057
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have a Type Confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: http://www.securityfocus.com/bid/104701; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5058
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html; http://www.securitytracker.com/id/1041250
CVE: CVE-2018-5059
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104701; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5060
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5061
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5062
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5063
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5064
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104701; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5065
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/104701; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5066
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5067
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html; http://www.securitytracker.com/id/1041250
CVE: CVE-2018-5068
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104699; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5069
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104701; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-5070
Published: 2018-07-20
Description: Adobe Acrobat and Reader 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, and 2[PII_REDACTED]8 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104701; http://www.securitytracker.com/id/1041250; https://helpx.adobe.com/security/products/acrobat/apsb18-21.html
CVE: CVE-2018-3770
Published: 2018-07-20
Description: A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/360727; https://hackerone.com/reports/360727
CVE: CVE-2018-3771
Published: 2018-07-20
Description: An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/355458; https://hackerone.com/reports/355458
CVE: CVE-2018-14492
Published: 2018-07-21
Description: Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/ZIllR0/Routers/blob/master/Tendaoob1.md; https://github.com/ZIllR0/Routers/blob/master/Tendaoob1.md
CVE: CVE-2018-14500
Published: 2018-07-22
Description: joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/joyplus/joyplus-cms/issues/431; https://github.com/joyplus/joyplus-cms/issues/431
CVE: CVE-2018-14501
Published: 2018-07-22
Description: manager/admin_ajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "m_id=1 AND SLEEP(5)" substring.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/joyplus/joyplus-cms/issues/432; https://github.com/joyplus/joyplus-cms/issues/432
CVE: CVE-2018-14505
Published: 2018-07-22
Description: mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/mitmproxy/mitmproxy/issues/3234; https://github.com/mitmproxy/mitmproxy/pull/3243; https://github.com/mitmproxy/mitmproxy/issues/3234
CVE: CVE-2018-14512
Published: 2018-07-23
Description: An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[nickname] parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server" screen, the XSS payload is triggered.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/143; https://github.com/wuzhicms/wuzhicms/issues/143
CVE: CVE-2018-14513
Published: 2018-07-23
Description: An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[content] parameter to the index.php?m=feedback&f=index&v=contact URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/145; https://github.com/wuzhicms/wuzhicms/issues/145
CVE: CVE-2018-14514
Published: 2018-07-23
Description: An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/idreamsoft/iCMS/issues/29; https://github.com/idreamsoft/iCMS/issues/29
CVE: CVE-2018-14515
Published: 2018-07-23
Description: A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promote&f=index&v=search keywords parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wuzhicms/wuzhicms/issues/146; https://github.com/wuzhicms/wuzhicms/issues/146
CVE: CVE-2018-14517
Published: 2018-07-23
Description: SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SecWiki/CMS-Hunter/blob/master/seacms/seacms6.61/seacms661.md; https://github.com/SecWiki/CMS-Hunter/blob/master/seacms/seacms6.61/seacms661.md
CVE: CVE-2018-14521
Published: 2018-07-23
Description: An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_source_avcodec_readframe in io/source_avcodec.c, as demonstrated by aubiomfcc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/aubio/aubio/issues/187; https://github.com/aubio/aubio/issues/187
CVE: CVE-2018-14522
Published: 2018-07-23
Description: An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_pitch_set_unit in pitch/pitch.c, as demonstrated by aubionotes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00071.html; https://github.com/aubio/aubio/issues/188
CVE: CVE-2018-14523
Published: 2018-07-23
Description: An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00071.html; https://github.com/aubio/aubio/issues/189
CVE: CVE-2018-14524
Published: 2018-07-23
Description: dwg_decode_eed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwg_free_eed in free.c) because it does not properly manage the obj->eed value after a free occurs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/LibreDWG/libredwg/issues/33; https://savannah.gnu.org/forum/forum.php?forum_id=9211; https://github.com/LibreDWG/libredwg/issues/33
CVE: CVE-2018-14527
Published: 2018-07-23
Description: Feedback.asp in Xiao5uCompany 1.7 has XSS because the XSS protection mechanism in Safe.asp is insufficient (for example, it considers SCRIPT and IMG elements, but does not consider VIDEO elements).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/2018/Xiao5uCompany_1.7_xss.doc; https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/2018/Xiao5uCompany_1.7_xss.doc
CVE: CVE-2018-14531
Published: 2018-07-23
Description: An issue was discovered in Bento4 1.5.1-624. There is an unspecified "heap-buffer-overflow" crash in the AP4_HvccAtom class in Core/Ap4HvccAtom.cpp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/axiomatic-systems/Bento4/issues/293; https://github.com/axiomatic-systems/Bento4/issues/293
CVE: CVE-2018-14532
Published: 2018-07-23
Description: An issue was discovered in Bento4 1.5.1-624. There is a heap-based buffer over-read in AP4_Mpeg2TsVideoSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp after a call from Mp42Hls.cpp, a related issue to CVE-2018-13846.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/294; https://github.com/axiomatic-systems/Bento4/issues/294
CVE: CVE-2018-14543
Published: 2018-07-23
Description: There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp4dump.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/292; https://github.com/axiomatic-systems/Bento4/issues/292
CVE: CVE-2018-14544
Published: 2018-07-23
Description: There exists one invalid memory read bug in AP4_SampleDescription::GetFormat() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp42ts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/291; https://github.com/axiomatic-systems/Bento4/issues/291
CVE: CVE-2018-14545
Published: 2018-07-23
Description: There exists one invalid memory read bug in AP4_SampleDescription::GetType() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow attackers to cause a denial-of-service via a crafted mp4 file. This vulnerability can be triggered by the executable mp42ts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/291; https://github.com/axiomatic-systems/Bento4/issues/291
CVE: CVE-2018-14549
Published: 2018-07-23
Description: An issue has been found in libwav through 2017-04-20. It is a SEGV in the function wav_write in libwav.c.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/fouzhe/security/tree/master/libwav#segv-in-function-wav_write-in-libwavc; https://github.com/marc-q/libwav/issues/23; https://github.com/fouzhe/security/tree/master/libwav#segv-in-function-wav_write-in-libwavc
CVE: CVE-2018-14551
Published: 2018-07-23
Description: The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-908
References: https://github.com/ImageMagick/ImageMagick/issues/1221; https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html; https://usn.ubuntu.com/3785-1/
CVE: CVE-2018-1503
Published: 2018-07-23
Description: IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid or malformed headers that could cause messages to no longer be transmitted via the affected channel. IBM X-Force ID: 141339.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22015617; http://www.securityfocus.com/bid/104953; http://www.securitytracker.com/id/1041387
CVE: CVE-2018-1513
Published: 2018-07-23
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141551.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10717031; http://www.securityfocus.com/bid/104910; https://exchange.xforce.ibmcloud.com/vulnerabilities/141551
CVE: CVE-2018-6677
Published: 2018-07-23
Description: Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://www.securityfocus.com/bid/104893; https://kc.mcafee.com/corporate/index?page=content&id=SB10245; http://www.securityfocus.com/bid/104893
CVE: CVE-2018-6678
Published: 2018-07-23
Description: Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
References: http://www.securityfocus.com/bid/104893; https://kc.mcafee.com/corporate/index?page=content&id=SB10245; http://www.securityfocus.com/bid/104893
CVE: CVE-2018-14562
Published: 2018-07-23
Description: An issue was discovered in libthulac.so in THULAC through 2018-02-25. A NULL pointer dereference can occur in the BasicModel class in include/cb_model.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/thunlp/THULAC/issues/35#issue-342148638; https://github.com/thunlp/THULAC/issues/35#issue-342148638
CVE: CVE-2018-14563
Published: 2018-07-23
Description: An issue was discovered in libthulac.so in THULAC through 2018-02-25. "operator delete" is used with "operator new[]" in the TaggingLearner class in include/cb_tagging_learner.h, possibly leading to memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/thunlp/THULAC/issues/37; https://github.com/thunlp/THULAC/issues/37
CVE: CVE-2018-14564
Published: 2018-07-23
Description: An issue was discovered in libthulac.so in THULAC through 2018-02-25. A SEGV can occur in NGramFeature::find_bases in include/cb_ngram_feature.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/thunlp/THULAC/issues/35#issuecomment-405788715; https://github.com/thunlp/THULAC/issues/35#issuecomment-405788715
CVE: CVE-2018-14565
Published: 2018-07-23
Description: An issue was discovered in libthulac.so in THULAC through 2018-02-25. A heap-based buffer over-read can occur in NGramFeature::find_bases in include/cb_ngram_feature.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/thunlp/THULAC/issues/36; https://github.com/thunlp/THULAC/issues/36
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://octobercms.com/support/article/rn-10; https://octobercms.com/support/article/rn-10
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://octobercms.com/support/article/rn-10; http://octobercms.com/support/article/rn-10
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-23
Description: FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in cced03dd667a5df6df8fd40d8de0bff477ee02e8 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104896; https://github.com/FFmpeg/FFmpeg/commit/cced03dd667a5df6df8fd40d8de0bff477ee02e8; https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html