deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11439
Published: 2018-05-30
Description: The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2018/May/49; https://lists.debian.org/debian-lts-announce/2018/07/msg00022.html; https://lists.debian.org/debian-lts-announce/2021/09/msg00020.html
CVE: CVE-2018-10995
Published: 2018-05-30
Description: SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://lists.debian.org/debian-lts-announce/2018/07/msg00029.html; https://lists.debian.org/debian-lts-announce/2018/08/msg00008.html; https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html
CVE: CVE-2018-11518
Published: 2018-05-30
Description: A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of audio signals; based on the frequency, certain commands and functions are processed. Since these frequencies are accepted within a phone call, an attacker can record these frequencies and use them for service activations. This is a request-forgery issue when the required series of DTMF signals for a service activation is predictable (e.g., the IVR system does not speak a nonce to the caller). In this case, the IVR system accepts an activation request from a less-secure channel (any loudspeaker in the caller's physical environment) without verifying that the request was intended (it matches a nonce sent over a more-secure channel to the caller's earpiece).
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://virgil-cj.blogspot.com/2018/05/0day-legacy-ivr-lets-phreak.html; https://datarift.blogspot.com/2018/05/CVE-2018-11518-abusing-ivr-systems.html; https://twitter.com/mishradhiraj_/status/[PII_REDACTED]85652482
CVE: CVE-2018-11562
Published: 2018-05-30
Description: An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/[PII_REDACTED]d1076756f62760d6daf582b6db722; https://github.com/MISP/MISP/commit/[PII_REDACTED]d1076756f62760d6daf582b6db722
CVE: CVE-2015-7610
Published: 2018-05-30
Description: Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.zimbra.com/2018/04/new-patches-for-you-zimbra-8-8-8-turing-patch-1-zimbra-8-7-11-patch-2/; https://blog.zimbra.com/2018/05/new-patches-zimbra-8-8-8-turing-patch-3-zimbra-8-7-11-patch-3-zimbra-8-6-0-patch-10/; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2018-10196
Published: 2018-05-30
Description: NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1579254; https://gitlab.com/graphviz/graphviz/issues/1367; https://lists.debian.org/debian-lts-announce/2021/05/msg00014.html
CVE: CVE-2018-10939
Published: 2018-05-30
Description: Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.zimbra.com/2018/05/new-zimbra-patches-8-8-8-patch-4-and-8-7-11-patch-4/; https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P4
CVE: CVE-2018-11476
Published: 2018-05-30
Description: An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a password. This enables anyone within the range of the WLAN to connect to the network without authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: http://seclists.org/fulldisclosure/2018/May/66; https://www.sec-consult.com/en/blog/advisories/unprotected-wifi-access-unencrypted-data-transfer-in-vgate-icar2-wifi-obd2-dongle/; http://seclists.org/fulldisclosure/2018/May/66
CVE: CVE-2018-11477
Published: 2018-05-30
Description: An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the public.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: http://seclists.org/fulldisclosure/2018/May/66; https://www.sec-consult.com/en/blog/advisories/unprotected-wifi-access-unencrypted-data-transfer-in-vgate-icar2-wifi-obd2-dongle/; http://seclists.org/fulldisclosure/2018/May/66
CVE: CVE-2018-11478
Published: 2018-05-30
Description: An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information from the car. This on-board diagnostics feature can also be used to send commands to the car (different for every vendor / car product line / car). No authentication is needed, which allows attacks from the local Wi-Fi network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2018/May/66; https://www.sec-consult.com/en/blog/advisories/unprotected-wifi-access-unencrypted-data-transfer-in-vgate-icar2-wifi-obd2-dongle/; http://seclists.org/fulldisclosure/2018/May/66
CVE: CVE-2018-11481
Published: 2018-05-30
Description: TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-websys-Authenticated-RCE; https://github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-websys-Authenticated-RCE
CVE: CVE-2018-11482
Published: 2018-05-30
Description: /usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-login-Escalation-of-Privileges; https://www.us-cert.gov/ncas/bulletins/SB18-155; https://github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-login-Escalation-of-Privileges
CVE: CVE-2018-11565
Published: 2018-05-30
Description: Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://bugs.launchpad.net/mahara/+bug/1772774; https://mahara.org/interaction/forum/topic.php?id=8271; https://bugs.launchpad.net/mahara/+bug/1772774
CVE: CVE-2018-7534
Published: 2018-05-30
Description: In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-320
References: http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=47; http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=47
CVE: CVE-2018-11567
Published: 2018-05-30
Description: Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device's hearing range. NOTE: The vendor states "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do. Customers do not need to take any action for these mitigations to work.
CVSS Score: 3.3 (LOW)
CWE: CWE-384
References: https://info.checkmarx.com/hubfs/Amazon_Echo_Research.pdf; https://www.checkmarx.com/2018/04/25/eavesdropping-with-amazon-alexa/; https://www.wired.com/story/amazon-echo-alexa-skill-spying/
CVE: CVE-2018-11568
Published: 2018-05-30
Description: Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the '<' and '>' characters have &lt; and &gt; representations.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/143666/WordPress-GamePlan-Event-And-Gym-Fitness-Theme-1.5.13.2-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/143666/WordPress-GamePlan-Event-And-Gym-Fitness-Theme-1.5.13.2-Cross-Site-Scripting.html
CVE: CVE-2018-11571
Published: 2018-05-31
Description: ClipperCMS 1.3.3 allows Session Fixation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://github.com/ClipperCMS/ClipperCMS/issues/486; https://github.com/ClipperCMS/ClipperCMS/issues/486
CVE: CVE-2018-11572
Published: 2018-05-31
Description: ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ClipperCMS/ClipperCMS/issues/485; https://github.com/ClipperCMS/ClipperCMS/issues/485
CVE: CVE-2018-11575
Published: 2018-05-31
Description: ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib; https://github.com/miniupnp/ngiflib/issues/4; https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib
CVE: CVE-2018-11576
Published: 2018-05-31
Description: ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib; https://github.com/miniupnp/ngiflib/issues/6; https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib
CVE: CVE-2018-11577
Published: 2018-05-31
Description: Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html; https://github.com/Edward-L/fuzzing-pocs/tree/master/liblouis; https://github.com/liblouis/liblouis/issues/582
CVE: CVE-2018-11578
Published: 2018-05-31
Description: GifIndexToTrueColor in ngiflib.c in MiniUPnP ngiflib 0.4 has a Segmentation fault.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib; https://github.com/miniupnp/ngiflib/issues/5; https://github.com/Edward-L/fuzzing-pocs/tree/master/ngiflib
CVE: CVE-2018-11579
Published: 2018-05-31
Description: class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://labs.threatpress.com/unauthenticated-settings-change-vulnerability-in-woocommerce-category-banner-management-plugin/; https://wordpress.org/plugins/banner-management-for-woocommerce/#developers; http://labs.threatpress.com/unauthenticated-settings-change-vulnerability-in-woocommerce-category-banner-management-plugin/
CVE: CVE-2018-11580
Published: 2018-05-31
Description: An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://labs.threatpress.com/mass-pages-posts-creator/; https://wordpress.org/plugins/mass-pagesposts-creator/#developers; http://labs.threatpress.com/mass-pages-posts-creator/
CVE: CVE-2018-11583
Published: 2018-05-31
Description: SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/alice19940905/88b194b89e83c5c0a394f7f297111e12; https://gist.github.com/alice19940905/88b194b89e83c5c0a394f7f297111e12
CVE: CVE-2018-11036
Published: 2018-05-31
Description: Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale) on vSZ, SZ-100, SZ-300, and SCG-200 devices allows remote attackers to obtain sensitive information or modify data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://www.ruckuswireless.com/security/279/view/txt; https://www.ruckuswireless.com/security/279/view/txt
CVE: CVE-2018-9311
Published: 2018-05-31
Description: The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-693
References: http://www.securityfocus.com/bid/104258; https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf; https://www.theregister.co.uk/2018/05/23/bmw_security_bugs/
CVE: CVE-2018-9312
Published: 2018-05-31
Description: The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows a local attack when a USB device is plugged in.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: http://www.securityfocus.com/bid/104258; https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf; https://www.theregister.co.uk/2018/05/23/bmw_security_bugs/
CVE: CVE-2018-9313
Published: 2018-05-31
Description: The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows a remote attack via Bluetooth when in pairing mode, leading to a Head Unit reboot.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-693
References: http://www.securityfocus.com/bid/104258; https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf; https://www.theregister.co.uk/2018/05/23/bmw_security_bugs/
CVE: CVE-2018-9314
Published: 2018-05-31
Description: The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows an attack by an attacker who has direct physical access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-693
References: http://www.securityfocus.com/bid/104258; https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf; https://www.theregister.co.uk/2018/05/23/bmw_security_bugs/
CVE: CVE-2018-9318
Published: 2018-05-31
Description: The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-693
References: http://www.securityfocus.com/bid/104258; https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf; https://www.theregister.co.uk/2018/05/23/bmw_security_bugs/
CVE: CVE-2018-9320
Published: 2018-05-31
Description: The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows a local attack when a USB device is plugged in.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: http://www.securityfocus.com/bid/104258; https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf; https://www.theregister.co.uk/2018/05/23/bmw_security_bugs/
CVE: CVE-2018-9322
Published: 2018-05-31
Description: The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows local attacks involving the USB or OBD-II interface. An attacker can bypass the code-signing protection mechanism for firmware updates, and consequently obtain a root shell.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: http://www.securityfocus.com/bid/104258; https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf; https://www.theregister.co.uk/2018/05/23/bmw_security_bugs/
CVE: CVE-2018-5388
Published: 2018-05-31
Description: In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-124, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html
CVE: CVE-2018-11220
Published: 2018-05-31
Description: Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
CVSS Score: 8.8 (HIGH)
References: https://www.exploit-db.com/exploits/44779/; https://www.exploit-db.com/exploits/44779/
CVE: CVE-2018-11590
Published: 2018-05-31
Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflow during syntax parsing. This was addressed by fixing stack size detection on Linux in jsutils.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/espruino/Espruino/commit/a0d7f432abee692402c00e8b615ff5982dde9780; https://github.com/espruino/Espruino/files/2019243/so_0.txt; https://github.com/espruino/Espruino/issues/1427
CVE: CVE-2018-11591
Published: 2018-05-31
Description: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing. This was addressed by adding validation for a debug trace print statement in jsvar.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/espruino/Espruino/commit/b6d362f6a1f2de0b3e[PII_REDACTED]efb509196bf4; https://github.com/espruino/Espruino/files/2015612/test.txt; https://github.com/espruino/Espruino/issues/1420
CVE: CVE-2018-11592
Published: 2018-05-31
Description: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via an Out-of-bounds Read during syntax parsing in which certain height validation is missing in libs/graphics/jswrap_graphics.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/espruino/Espruino/commit/8a44b04b584b3d3ab1cb68fed410f7ecb165e50e; https://github.com/espruino/Espruino/files/2015630/test_0.txt; https://github.com/espruino/Espruino/issues/1421
CVE: CVE-2018-11593
Published: 2018-05-31
Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclosure with a user crafted input file via a Buffer Overflow during syntax parsing because strncpy is misused in jslex.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://github.com/espruino/Espruino/commit/bed844f109b6c[PII_REDACTED]55068de2e101e8018; https://github.com/espruino/Espruino/files/2019228/eh_0.txt; https://github.com/espruino/Espruino/issues/1426
CVE: CVE-2018-11594
Published: 2018-05-31
Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing of "VOID" tokens in jsparse.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/espruino/Espruino/commit/c36d30529118aa049797db43f111ddad468aad29; https://github.com/espruino/Espruino/files/2022588/input.txt; https://github.com/espruino/Espruino/issues/1434
CVE: CVE-2018-11595
Published: 2018-05-31
Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Privileges with a user crafted input file via a Buffer Overflow during syntax parsing, because strncat is misused.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/espruino/Espruino/commit/0a7619875bf[PII_REDACTED]5f6bee08465b89ff10b; https://github.com/espruino/Espruino/files/2019210/test_0.txt; https://github.com/espruino/Espruino/files/2019216/test_2.txt
CVE: CVE-2018-11596
Published: 2018-05-31
Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because a check for '\0' is made for the wrong array element in jsvar.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/espruino/Espruino/commit/ce[PII_REDACTED]d58cb43d3d4d9dada710a8361b89; https://github.com/espruino/Espruino/issues/1435; https://github.com/espruino/Espruino/commit/ce[PII_REDACTED]d58cb43d3d4d9dada710a8361b89
CVE: CVE-2018-11597
Published: 2018-05-31
Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because of a missing check for stack exhaustion with many '{' characters in jsparse.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/espruino/Espruino/commit/51380baf17241728b6d48cdb84140b931e3e3cc5; https://github.com/espruino/Espruino/issues/1448; https://github.com/espruino/Espruino/commit/51380baf17241728b6d48cdb84140b931e3e3cc5
CVE: CVE-2018-11598
Published: 2018-05-31
Description: Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Disclosure with user crafted input files via a Buffer Overflow or Out-of-bounds Read during syntax parsing of certain for loops in jsparse.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://github.com/espruino/Espruino/commit/bf4416ab9129ee3afd56739ea4e3cd0da5484b6b; https://github.com/espruino/Espruino/files/2025956/test_0.txt; https://github.com/espruino/Espruino/files/2025963/test_1.txt
CVE: CVE-2018-11624
Published: 2018-05-31
Description: In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://github.com/ImageMagick/ImageMagick/issues/1149; https://github.com/ImageMagick/ImageMagick/issues/1149
CVE: CVE-2018-11625
Published: 2018-05-31
Description: In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/1156; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/1156