deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-12882
Published: 2018-06-26
Description: exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/104551; https://bugs.php.net/bug.php?id=76409; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12884
Published: 2018-06-26
Description: In Octopus Deploy 3.0 onwards (before 2018.6.7), an authenticated user with incorrect permissions may be able to create Accounts under the Infrastructure menu.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://github.com/OctopusDeploy/Issues/issues/4674; https://github.com/OctopusDeploy/Issues/issues/4674
CVE: CVE-2018-12889
Published: 2018-06-26
Description: An issue was discovered in CCN-lite 2.0.1. There is a heap-based buffer overflow in mkAddToRelayCacheRequest and in ccnl_populate_cache for an array lacking '\0' termination when reading a binary CCNx or NDN file. This can result in Heap Corruption. This was addressed by fixing the memory management in mkAddToRelayCacheRequest in ccn-lite-ctrl.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/cn-uofbasel/ccn-lite/issues/279; https://github.com/cn-uofbasel/ccn-lite/issues/279
CVE: CVE-2018-0526
Published: 2018-06-26
Description: Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN51737843/index.html; https://support.cybozu.com/ja-jp/article/10030; http://jvn.jp/en/jp/JVN51737843/index.html
CVE: CVE-2018-0527
Published: 2018-06-26
Description: Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN51737843/index.html; https://support.cybozu.com/ja-jp/article/10029; http://jvn.jp/en/jp/JVN51737843/index.html
CVE: CVE-2018-0528
Published: 2018-06-26
Description: Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-287
References: http://jvn.jp/en/jp/JVN51737843/index.html; https://support.cybozu.com/ja-jp/article/9812; http://jvn.jp/en/jp/JVN51737843/index.html
CVE: CVE-2018-0529
Published: 2018-06-26
Description: Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN51737843/index.html; https://support.cybozu.com/ja-jp/article/10052; http://jvn.jp/en/jp/JVN51737843/index.html
CVE: CVE-2018-0557
Published: 2018-06-26
Description: Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'E-mail Details Screen' via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN52319657/index.html; https://support.cybozu.com/ja-jp/article/10194; http://jvn.jp/en/jp/JVN52319657/index.html
CVE: CVE-2018-0558
Published: 2018-06-26
Description: Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN52319657/index.html; https://support.cybozu.com/ja-jp/article/10193; http://jvn.jp/en/jp/JVN52319657/index.html
CVE: CVE-2018-0559
Published: 2018-06-26
Description: Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN52319657/index.html; https://support.cybozu.com/ja-jp/article/10196; http://jvn.jp/en/jp/JVN52319657/index.html
CVE: CVE-2018-0563
Published: 2018-06-26
Description: Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN20040004/index.html; https://flets.com/customer/next/sec/setup/esat_install.html; https://flets.com/customer/tec/fvc/setup/esat_install.html
CVE: CVE-2018-0565
Published: 2018-06-26
Description: Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN51737843/index.html; https://support.cybozu.com/ja-jp/article/10200; http://jvn.jp/en/jp/JVN51737843/index.html
CVE: CVE-2018-0566
Published: 2018-06-26
Description: Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: http://jvn.jp/en/jp/JVN51737843/index.html; https://support.cybozu.com/ja-jp/article/10195; http://jvn.jp/en/jp/JVN51737843/index.html
CVE: CVE-2018-0567
Published: 2018-06-26
Description: Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors.
CVSS Score: 6.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN51737843/index.html; https://support.cybozu.com/ja-jp/article/10198; http://jvn.jp/en/jp/JVN51737843/index.html
CVE: CVE-2018-0569
Published: 2018-06-26
Description: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN67881316/index.html; https://basercms.net/security/JVN67881316; http://jvn.jp/en/jp/JVN67881316/index.html
CVE: CVE-2018-0570
Published: 2018-06-26
Description: Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN67881316/index.html; https://basercms.net/security/JVN67881316; http://jvn.jp/en/jp/JVN67881316/index.html
CVE: CVE-2018-0571
Published: 2018-06-26
Description: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: http://jvn.jp/en/jp/JVN67881316/index.html; https://basercms.net/security/JVN67881316; http://jvn.jp/en/jp/JVN67881316/index.html
CVE: CVE-2018-0572
Published: 2018-06-26
Description: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.
CVSS Score: 8.1 (HIGH)
References: http://jvn.jp/en/jp/JVN67881316/index.html; https://basercms.net/security/JVN67881316; http://jvn.jp/en/jp/JVN67881316/index.html
CVE: CVE-2018-0573
Published: 2018-06-26
Description: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: http://jvn.jp/en/jp/JVN67881316/index.html; https://basercms.net/security/JVN67881316; http://jvn.jp/en/jp/JVN67881316/index.html
CVE: CVE-2018-0574
Published: 2018-06-26
Description: Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN67881316/index.html; https://basercms.net/security/JVN67881316; http://jvn.jp/en/jp/JVN67881316/index.html
CVE: CVE-2018-0575
Published: 2018-06-26
Description: baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN67881316/index.html; https://basercms.net/security/JVN67881316; http://jvn.jp/en/jp/JVN67881316/index.html
CVE: CVE-2018-0584
Published: 2018-06-26
Description: IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication [effect_of_bypassing_authentication] via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN27137002/index.html; http://jvn.jp/en/jp/JVN27137002/index.html
CVE: CVE-2018-0592
Published: 2018-06-26
Description: Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN91151862/index.html; http://www.securityfocus.com/bid/104563; https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/
CVE: CVE-2018-0593
Published: 2018-06-26
Description: Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN91151862/index.html; http://www.securityfocus.com/bid/104563; https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/
CVE: CVE-2018-0594
Published: 2018-06-26
Description: Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN91151862/index.html; http://www.securityfocus.com/bid/104563; https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/
CVE: CVE-2018-0595
Published: 2018-06-26
Description: Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN91151862/index.html; http://www.securityfocus.com/bid/104563; https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/
CVE: CVE-2018-0596
Published: 2018-06-26
Description: Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN91151862/index.html; http://www.securityfocus.com/bid/104563; https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/
CVE: CVE-2018-0597
Published: 2018-06-26
Description: Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN91151862/index.html; http://www.securityfocus.com/bid/104563; https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/
CVE: CVE-2018-0598
Published: 2018-06-26
Description: Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN72748502/index.html; https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/; https://msrc.microsoft.com/blog/2018/04/triaging-a-dll-planting-vulnerability/
CVE: CVE-2018-0599
Published: 2018-06-26
Description: Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN81196185/index.html; https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/; http://jvn.jp/en/jp/JVN81196185/index.html
CVE: CVE-2018-0600
Published: 2018-06-26
Description: Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN13940333/index.html; http://support.d-imaging.sony.co.jp/www/disoft/int/download/playmemories-home/win/ja/index.html; http://jvn.jp/en/jp/JVN13940333/index.html
CVE: CVE-2018-0601
Published: 2018-06-26
Description: Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN79301396/index.html; https://github.com/yak1ex/axpdfium/wiki/JVN%[PII_REDACTED]%28en%29; http://jvn.jp/en/jp/JVN79301396/index.html
CVE: CVE-2018-0602
Published: 2018-06-26
Description: Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN16471686/index.html; https://wordpress.org/plugins/email-subscribers/#developers; https://wpvulndb.com/vulnerabilities/9101
CVE: CVE-2018-0603
Published: 2018-06-26
Description: Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN60978548/index.html; https://wordpress.org/plugins/site-reviews/#developers; https://wpvulndb.com/vulnerabilities/9102
CVE: CVE-2018-0604
Published: 2018-06-26
Description: Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.
CVSS Score: 7.2 (HIGH)
References: http://jvn.jp/en/jp/JVN27978559/index.html; http://jvn.jp/en/jp/JVN27978559/index.html
CVE: CVE-2018-0605
Published: 2018-06-26
Description: Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN27978559/index.html; http://jvn.jp/en/jp/JVN27978559/index.html
CVE: CVE-2018-0606
Published: 2018-06-26
Description: SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN27978559/index.html; http://jvn.jp/en/jp/JVN27978559/index.html
CVE: CVE-2018-0608
Published: 2018-06-26
Description: Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN93226941/index.html; https://github.com/h2o/h2o/issues/1775; http://jvn.jp/en/jp/JVN93226941/index.html
CVE: CVE-2018-0609
Published: 2018-06-26
Description: Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN92265618/index.html; https://linecorp.com/en/security/article/172; http://jvn.jp/en/jp/JVN92265618/index.html
CVE: CVE-2018-0610
Published: 2018-06-26
Description: Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://jvn.jp/en/jp/JVN33124193/index.html; https://www.zenphoto.org/news/zenphoto-1.5; http://jvn.jp/en/jp/JVN33124193/index.html
CVE: CVE-2018-0611
Published: 2018-06-26
Description: The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN71535108/index.html; https://www.ana.co.jp/ja/jp/share/mobile/smartphone/app_ana/#title; http://jvn.jp/en/jp/JVN71535108/index.html
CVE: CVE-2018-0612
Published: 2018-06-26
Description: Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN98975951/index.html; https://chrome.google.com/webstore/detail/5000%E5%85%86%E5%86%86%E3%82%B3%E3%83%B3%E3%83%90%E3%83%BC%E3%82%BF%E3%83%BC/mgaphgebhfgmkahikdhdomnnpelbijmo; http://jvn.jp/en/jp/JVN98975951/index.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit.
CVSS Score: 5.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html; http://www.openwall.com/lists/oss-security/2018/06/26/3; https://access.redhat.com/errata/RHSA-2018:2948
CVE: CVE-2018-10852
Published: 2018-06-26
Description: The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.
CVSS Score: 3.8 (LOW)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/104547; https://access.redhat.com/errata/RHSA-2018:3158; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10852
CVE: CVE-2017-7656
Published: 2018-06-26
Description: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: http://www.securitytracker.com/id/1041194; https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667; https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f[PII_REDACTED]b74d1e4272%40%3Cissues.activemq.apache.org%3E
CVE: CVE-2017-7657
Published: 2018-06-26
Description: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444, CWE-190, CWE-444
References: http://www.securitytracker.com/id/1041194; https://access.redhat.com/errata/RHSA-2019:0910; https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack appear to be exploitable via Specially crafted FIT image and special device memory functionality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://lists.denx.de/pipermail/u-boot/2018-June/330454.html; https://lists.denx.de/pipermail/u-boot/2018-June/330898.html; https://lists.denx.de/pipermail/u-boot/2018-June/330454.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: http://lists.busybox.net/pipermail/busybox/2018-May/086462.html; https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91; https://usn.ubuntu.com/4531-1/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: http://my.instant-update.com/t/i-wanna-to-report-an-security-issue/659/3; https://github.com/InstantUpdate/CMS/commit/5e70496b6b0c4cd554e62a709a248c1584533da6; http://my.instant-update.com/t/i-wanna-to-report-an-security-issue/659/3
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-26
Description: MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. This attack appear to be exploitable via Must have access to admin panel. This vulnerability appears to have been fixed in 1.8.15.
CVSS Score: 7.2 (HIGH)
CWE: CWE-829
References: http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html; https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/; http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html