deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-8774
Published: 2017-04-02
Description: The HIFI driver in Huawei Mate 8 phones with software versions before NXT-AL10C00B386, versions before NXT-CL00C92B386, versions before NXT-DL00C17B386, versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368, Versions before CRR-UL00C00B368, Versions before CRR-UL20C00B368; P8 phones with software Versions before GRA-TL00C01B366, Versions before GRA-CL00C92B366, Versions before GRA-CL10C92B366, Versions before GRA-UL00C00B366, Versions before GRA-UL10C00B366; and P9 phones with software Versions before EVA-AL10C00B190, Versions before EVA-DL10C00B190, Versions before EVA-TL10C00B190, Versions before EVA-CL10C00B190 allows attackers to get root privilege or crash the system or execute arbitrary code, related to a buffer overflow.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-02-smartphone-en; http://www.securityfocus.com/bid/94503; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-02-smartphone-en
CVE: CVE-2016-8775
Published: 2017-04-02
Description: Touch Panel (TP) driver in Huawei NEM phones with software Versions before NEM-AL10C00B130, Versions before NEM-UL10C17B160, Versions before NEM-UL10C00B160, Versions before NEM-TL00C01B160 allows attackers to get root privilege or crash the system or execute arbitrary code, related to a buffer overflow.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-03-smartphone-en; http://www.securityfocus.com/bid/94506; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-03-smartphone-en
CVE: CVE-2016-8776
Published: 2017-04-02
Description: Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the factory reset protection (FRP) to enter some functional modules without authorization and perform operations to update the Google account.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-285
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-smartphone-en; http://www.securityfocus.com/bid/94836; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-smartphone-en
CVE: CVE-2016-8779
Published: 2017-04-02
Description: Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol (LDAP) operation command into a specific input variable to obtain sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-ldap-en; http://www.securityfocus.com/bid/94620; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-ldap-en
CVE: CVE-2016-8780
Published: 2017-04-02
Description: Huawei CloudEngine 6800 V100R006C00, CloudEngine 7800 V100R006C00, CloudEngine 8800 V100R006C00, and CloudEngine 12800 V100R006C00 allow remote attackers with specific permission to store massive files to exhaust the shared storage space, leading to a DoS condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-switch-en; http://www.securityfocus.com/bid/94618; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-switch-en
CVE: CVE-2016-8781
Published: 2017-04-02
Description: Huawei Secospace USG6300 with software V500R001C20 and V500R001C20SPC200PWE, Secospace USG6500 with software V500R001C20, Secospace USG6600 with software V500R001C20 and V500R001C20SPC200PWE allow remote attackers with specific permission to log in to a device and deliver a large number of unspecified commands to exhaust memory, causing a DoS condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-firewall-en; http://www.securityfocus.com/bid/94927; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-firewall-en
CVE: CVE-2016-8789
Published: 2017-04-02
Description: Huawei eSpace Integrated Access Device (IAD) with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-espace-en; http://www.securityfocus.com/bid/94613; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-espace-en
CVE: CVE-2016-8790
Published: 2017-04-02
Description: Huawei CloudEngine 5800 with software before V200R001C00SPC700, CloudEngine 6800 with software before V200R001C00SPC700, CloudEngine 7800 with software before V200R001C00SPC700, CloudEngine 8800 with software before V200R001C00SPC700, CloudEngine 12800 with software before V200R001C00SPC700 could allow the attacker to exploit a buffer overflow vulnerability by sending crafted packets to the affected system to cause a main control board reboot.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-cfm-en; http://www.securityfocus.com/bid/94402; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-cfm-en
CVE: CVE-2016-8791
Published: 2017-04-02
Description: Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368, Versions before CRR-UL00C00B368, Versions before CRR-UL20C00B368; and P8 phones with software Versions before GRA-TL00C01B366, Versions before GRA-CL00C92B366, Versions before GRA-CL10C92B366, Versions before GRA-UL00C00B366, Versions before GRA-UL10C00B366 allow attackers with graphic or Camera privilege to crash the system or escalate privilege.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-smartphone-en; http://www.securityfocus.com/bid/94404; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-smartphone-en
CVE: CVE-2016-8792
Published: 2017-04-02
Description: Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368, Versions before CRR-UL00C00B368, Versions before CRR-UL20C00B368; and P8 phones with software Versions before GRA-TL00C01B366, Versions before GRA-CL00C92B366, Versions before GRA-CL10C92B366, Versions before GRA-UL00C00B366, Versions before GRA-UL10C00B366 allow attackers with graphic or Camera privilege to crash the system or escalate privilege.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-smartphone-en; http://www.securityfocus.com/bid/94404; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-smartphone-en
CVE: CVE-2016-8793
Published: 2017-04-02
Description: Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368, Versions before CRR-UL00C00B368, Versions before CRR-UL20C00B368; and P8 phones with software Versions before GRA-TL00C01B366, Versions before GRA-CL00C92B366, Versions before GRA-CL10C92B366, Versions before GRA-UL00C00B366, Versions before GRA-UL10C00B366 allow attackers with graphic or Camera privilege to crash the system or escalate privilege.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-smartphone-en; http://www.securityfocus.com/bid/94404; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-smartphone-en
CVE: CVE-2016-8794
Published: 2017-04-02
Description: Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368, Versions before CRR-UL00C00B368, Versions before CRR-UL20C00B368; and P8 phones with software Versions before GRA-TL00C01B366, Versions before GRA-CL00C92B366, Versions before GRA-CL10C92B366, Versions before GRA-UL00C00B366, Versions before GRA-UL10C00B366 allow attackers with graphic or Camera privilege to crash the system or escalate privilege.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-smartphone-en; http://www.securityfocus.com/bid/94404; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-smartphone-en
CVE: CVE-2016-8795
Published: 2017-04-02
Description: Huawei CloudEngine 12800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 5800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 6800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 7800 with software V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 8800 with software V100R006C00; and Secospace USG6600 with software V500R001C00 allow remote unauthenticated attackers to craft specific IPFPM packets to trigger an integer overflow and cause the device to reset.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-01-vrp-en; http://www.securityfocus.com/bid/94504; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-01-vrp-en
CVE: CVE-2016-8796
Published: 2017-04-02
Description: Huawei USG9520 V300R001C01, USG9560 V300R001C01, and USG9580 V300R001C01 allow unauthenticated attackers to send abnormal DHCP request packets to the affected products to trigger a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-firewall-en; http://www.securityfocus.com/bid/94405; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161116-01-firewall-en
CVE: CVE-2016-8797
Published: 2017-04-02
Description: Huawei AR3200 with software V200R007C00, V200R005C32, V200R005C20; S12700 with software V200R008C00, V200R007C00; S5300 with software V200R008C00, V200R007C00, V200R006C00; S5700 with software V200R008C00, V200R007C00, V200R006C00; S6300 with software V200R008C00, V200R007C00; S6700 with software V200R008C00, V200R007C00; S7700 with software V200R008C00, V200R007C00, V200R006C00; S9300 with software V200R008C00, V200R007C00, V200R006C00; and S9700 with software V200R008C00, V200R007C00, V200R006C00 allow remote attackers to send abnormal Multiprotocol Label Switching (MPLS) packets to cause memory exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160608-01-mpls-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160608-01-mpls-en
CVE: CVE-2016-8798
Published: 2017-04-02
Description: Huawei USG5500 with software V300R001C00 and V300R001C00 allows attackers to bypass the anti-DDoS module of the USGs to cause a denial of service condition on the backend server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161026-01-usg-en; http://www.securityfocus.com/bid/93891; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161026-01-usg-en
CVE: CVE-2016-8801
Published: 2017-04-02
Description: Huawei OceanStor 5600 V3 with V300R003C00C10 and earlier versions allows attackers with administrator privilege to inject a command into a specific command's parameters, and run this injected command with root privilege.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-storage-en; http://www.securityfocus.com/bid/94832; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-storage-en
CVE: CVE-2016-8802
Published: 2017-04-02
Description: The security policy processing module in Huawei Secospace USG6300 with software V500R001C20SPC100, V500R001C20SPC101, V500R001C20SPC200; Secospace USG6500 with software V500R001C20SPC100, V500R001C20SPC101, V500R001C20SPC200; Secospace USG6600 with software V500R001C20SPC100, V500R001C20SPC101, V500R001C20SPC200 allows authenticated attackers to setup a specific security policy into the devices, causing a buffer overflow and crashing the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161125-01-usg-en; http://www.securityfocus.com/bid/94538; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161125-01-usg-en
CVE: CVE-2016-8803
Published: 2017-04-02
Description: The maintenance module in Huawei FusionStorage V100R003C30U1 allows attackers to create documents according to special rules to obtain the OS root privilege of FusionStorage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-01-fusionstorage-en; http://www.securityfocus.com/bid/94507; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161123-01-fusionstorage-en
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10211. Reason: This candidate is a reservation duplicate of CVE-2016-10211. Notes: All CVE users should reference CVE-2016-10211 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10222. Reason: This candidate is a reservation duplicate of CVE-2016-10222. Notes: All CVE users should reference CVE-2016-10222 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-03
Description: The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2017/02/10/16; http://www.securitytracker.com/id/1037731; https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-7510.  Reason:  This candidate is a reservation duplicate of CVE-2016-7510.  Notes: All CVE users should reference CVE-2016-7510 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10209. Reason: This candidate is a reservation duplicate of CVE-2016-10209. Notes: All CVE users should reference CVE-2016-10209 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-04-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10226. Reason: This candidate is a reservation duplicate of CVE-2016-10226. Notes: All CVE users should reference CVE-2016-10226 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-10209
Published: 2017-04-03
Description: The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97327; https://github.com/libarchive/libarchive/issues/842; https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
CVE: CVE-2016-10210
Published: 2017-04-03
Description: libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/98077; https://github.com/VirusTotal/yara/commit/3119b232c9c453c98d8fa8b6ae4e37ba18117cd4; https://github.com/VirusTotal/yara/issues/576
CVE: CVE-2016-10211
Published: 2017-04-03
Description: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98078; https://github.com/VirusTotal/yara/commit/890c3f850293176c0e996a602ffa88b315f4e98f; https://github.com/VirusTotal/yara/issues/575
CVE: CVE-2016-10217
Published: 2017-04-03
Description: The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=90fd0c7ca3efc1ddff64a86f4104b13b3ac969eb; https://bugs.ghostscript.com/show_bug.cgi?id=697456; http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=90fd0c7ca3efc1ddff64a86f4104b13b3ac969eb
CVE: CVE-2016-10218
Published: 2017-04-03
Description: The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d621292fb2c8157d9899dcd83fd04dd250e30fe4; https://bugs.ghostscript.com/show_bug.cgi?id=697444; http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d621292fb2c8157d9899dcd83fd04dd250e30fe4
CVE: CVE-2016-10219
Published: 2017-04-03
Description: The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.debian.org/security/2017/dsa-3838; http://www.ghostscript.com/cgi-bin/findgit.cgi?4bef1a1d32e29b[PII_REDACTED]0dbff574b9cda08f; https://bugs.ghostscript.com/show_bug.cgi?id=697453
CVE: CVE-2016-10220
Published: 2017-04-03
Description: The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2017/dsa-3838; http://www.ghostscript.com/cgi-bin/findgit.cgi?daf85701dab05f17e924a48a81edc9195b4a04e8; https://bugs.ghostscript.com/show_bug.cgi?id=697450
CVE: CVE-2016-10221
Published: 2017-04-03
Description: The count_entries function in pdf-layer.c in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted PDF document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.ghostscript.com/cgi-bin/findgit.cgi?2590fed7a355a421f062ebd4293df892800fa7ac; https://bugs.ghostscript.com/show_bug.cgi?id=697400; https://security.gentoo.org/glsa/201706-08
CVE: CVE-2016-10222
Published: 2017-04-03
Description: runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (segmentation violation and application crash) via crafted JavaScript code that triggers a "type confusion" in the JSON.stringify function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://trac.webkit.org/changeset/208123; https://bugs.webkit.org/show_bug.cgi?id=164123; http://trac.webkit.org/changeset/208123
CVE: CVE-2016-10226
Published: 2017-04-03
Description: JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (bitfield out-of-bounds read and application crash) via crafted JavaScript code that is mishandled in the operatorString function, related to assembler/MacroAssemblerARM64.h, assembler/MacroAssemblerX86Common.h, and wasm/WasmB3IRGenerator.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.webkit.org/show_bug.cgi?id=165091; https://trac.webkit.org/changeset/209295; https://bugs.webkit.org/show_bug.cgi?id=165091
CVE: CVE-2016-10312
Published: 2017-04-03
Description: Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf; https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf
CVE: CVE-2016-10313
Published: 2017-04-03
Description: Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct CSRF attacks via certain /goform/* pages.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf; https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf
CVE: CVE-2016-10314
Published: 2017-04-03
Description: Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to read passwords via a direct request to the x.asp page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf; https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf
CVE: CVE-2016-10315
Published: 2017-04-03
Description: Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct Open Redirect attacks via the submit-url parameter to certain /goform/* pages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf; https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf
CVE: CVE-2016-10316
Published: 2017-04-03
Description: Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct Open Redirect attacks via the return-url parameter to /goform/formLogout.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf; https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf