deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10510
Published: 2018-08-15
Description: A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to execute arbitrary code on vulnerable installations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://success.trendmicro.com/solution/1120112; https://success.trendmicro.com/solution/1120112
CVE: CVE-2018-10511
Published: 2018-08-15
Description: A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request forgery (SSRF) attack on vulnerable installations.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://success.trendmicro.com/solution/1120112; https://success.trendmicro.com/solution/1120112
CVE: CVE-2018-10512
Published: 2018-08-15
Description: A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, which may lead to a denial of server (DoS).
CVSS Score: 7.5 (HIGH)
References: https://success.trendmicro.com/solution/1120112; https://success.trendmicro.com/solution/1120112
CVE: CVE-2018-0367
Published: 2018-08-15
Description: A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco Bug IDs: CVE-2018-0367.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/105109; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-res-xss; http://www.securityfocus.com/bid/105109
CVE: CVE-2018-0386
Published: 2018-08-15
Description: A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The vulnerability is due to improper validation of input that is passed to the affected software. An attacker could exploit this vulnerability by persuading a user of the affected software to access a malicious URL. A successful exploit could allow the attacker to access sensitive, browser-based information on the affected system or perform arbitrary actions in the affected software in the security context of the user. Cisco Bug IDs: CSCvh49694.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/105113; http://www.securitytracker.com/id/1041537; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-cucdm-xss
CVE: CVE-2018-0409
Published: 2018-08-15
Description: A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Communication Server (VCS) and Expressway could allow an unauthenticated, remote attacker to cause a temporary service outage for all IM&P users, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious IPv4 or IPv6 packet to an affected device on TCP port 7400. An exploit could allow the attacker to overread a buffer, resulting in a crash and restart of the XCP Router service. Cisco Bug IDs: CSCvg97663, CSCvi55947.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: http://www.securityfocus.com/bid/105102; http://www.securityfocus.com/bid/105104; http://www.securitytracker.com/id/1041533
CVE: CVE-2018-0410
Published: 2018-08-15
Description: A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an affected system. The vulnerability exists because the affected software improperly manages memory resources for TCP connections to a targeted device. An attacker could exploit this vulnerability by establishing a high number of TCP connections to the data interface of an affected device via IPv4 or IPv6. A successful exploit could allow the attacker to exhaust system memory, which could cause the system to stop processing new connections and result in a DoS condition. System recovery may require manual intervention. Cisco Bug IDs: CSCvf36610.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/105098; http://www.securitytracker.com/id/1041535; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-wsa-dos
CVE: CVE-2018-0412
Published: 2018-08-15
Description: A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an unauthenticated, adjacent attacker to force the downgrade of the encryption algorithm that is used between an authenticator (access point) and a supplicant (Wi-Fi client). The vulnerability is due to the improper processing of certain EAPOL messages that are received during the Wi-Fi handshake process. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between a supplicant and an authenticator and manipulating an EAPOL message exchange to force usage of a WPA-TKIP cipher instead of the more secure AES-CCMP cipher. A successful exploit could allow the attacker to conduct subsequent cryptographic attacks, which could lead to the disclosure of confidential information. Cisco Bug IDs: CSCvj29229.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-310
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-sb-wap-encrypt; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-sb-wap-encrypt
CVE: CVE-2018-0415
Published: 2018-08-15
Description: A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an authenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of certain EAPOL frames. An attacker could exploit this vulnerability by sending a stream of crafted EAPOL frames to an affected device. A successful exploit could allow the attacker to force the access point (AP) to disassociate all the associated stations (STAs) and to disallow future, new association requests. Cisco Bug IDs: CSCvj97472.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-388, CWE-388
References: http://www.securityfocus.com/bid/105116; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-csb-wap-dos; http://www.securityfocus.com/bid/105116
CVE: CVE-2018-0418
Published: 2018-08-15
Description: A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input and validation checking on certain Precision Time Protocol (PTP) ingress traffic to an affected device. An attacker could exploit this vulnerability by injecting malformed traffic into an affected device. A successful exploit could allow the attacker to cause services on the device to become unresponsive, resulting in a DoS condition. Cisco Bug IDs: CSCvj22858.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-20
References: http://www.securityfocus.com/bid/105185; http://www.securitytracker.com/id/1041538; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-asr-ptp-dos
CVE: CVE-2018-0419
Published: 2018-08-15
Description: A vulnerability in certain attachment detection mechanisms of Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass the filtering functionality of an affected system. The vulnerability is due to the improper detection of content within executable (EXE) files. An attacker could exploit this vulnerability by sending a customized EXE file that is not recognized and blocked by the ESA. A successful exploit could allow an attacker to send email messages that contain malicious executable files to unsuspecting users. Cisco Bug IDs: CSCvh03786.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105112; http://www.securitytracker.com/id/1041531; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-esa-file-bypass
CVE: CVE-2018-0427
Published: 2018-08-15
Description: A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to incorrect input validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious packet. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. Cisco Bug IDs: CSCvi42263.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: http://www.securityfocus.com/bid/105106; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-dna-injection; http://www.securityfocus.com/bid/105106
CVE: CVE-2018-0428
Published: 2018-08-15
Description: A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access controls. An attacker could exploit this vulnerability by authenticating to the device as a specific user to gain the information needed to elevate privileges to root in a separate login shell. A successful exploit could allow the attacker to escape the CLI subshell and execute system-level commands on the underlying operating system as root. Cisco Bug IDs: CSCvj93548.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284, CWE-269
References: http://www.securityfocus.com/bid/105104; http://www.securitytracker.com/id/1041536; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-wsa-escalation
CVE: CVE-2017-13100
Published: 2018-08-15
Description: DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/787952; https://www.kb.cert.org/vuls/id/787952
CVE: CVE-2017-13101
Published: 2018-08-15
Description: Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/787952; https://www.kb.cert.org/vuls/id/787952
CVE: CVE-2017-13102
Published: 2018-08-15
Description: Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/787952; https://www.kb.cert.org/vuls/id/787952
CVE: CVE-2017-13103
Published: 2018-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-13104
Published: 2018-08-15
Description: Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/787952; https://www.kb.cert.org/vuls/id/787952
CVE: CVE-2017-13105
Published: 2018-08-15
Description: Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication. This opens the application up to a man-in-the-middle attack having all of its encrypted traffic intercepted and read by an attacker.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://www.kb.cert.org/vuls/id/787952; https://www.kb.cert.org/vuls/id/787952
CVE: CVE-2017-13106
Published: 2018-08-15
Description: Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/787952; https://www.kb.cert.org/vuls/id/787952
CVE: CVE-2017-13107
Published: 2018-08-15
Description: Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/787952; https://www.kb.cert.org/vuls/id/787952
CVE: CVE-2017-13108
Published: 2018-08-15
Description: DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/787952; https://www.kb.cert.org/vuls/id/787952
CVE: CVE-2018-1715
Published: 2018-08-16
Description: IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147003.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/147003; https://www.ibm.com/support/docview.wss?uid=swg22017453; https://exchange.xforce.ibmcloud.com/vulnerabilities/147003
CVE: CVE-2018-11771
Published: 2018-08-16
Description: When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/105139; http://www.securitytracker.com/id/1041503; https://lists.apache.org/thread.html/0adb631517766e793e18a59723e2df08ced41eb9a57478f14781c9f7%40%3Cdev.tinkerpop.apache.org%3E
CVE: CVE-2018-10139
Published: 2018-08-16
Description: The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/105111; http://www.securitytracker.com/id/1041544; https://security.paloaltonetworks.com/CVE-2018-10139
CVE: CVE-2018-10140
Published: 2018-08-16
Description: The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105107; http://www.securitytracker.com/id/1041545; https://security.paloaltonetworks.com/CVE-2018-10140
CVE: CVE-2018-1712
Published: 2018-08-16
Description: IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370.
CVSS Score: 8.6 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/146370; https://www-01.ibm.com/support/docview.wss?uid=ibm10716169; https://exchange.xforce.ibmcloud.com/vulnerabilities/146370
CVE: CVE-2016-9596
Published: 2018-08-16
Description: libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1408302; https://bugzilla.redhat.com/show_bug.cgi?id=1408302
CVE: CVE-2016-9598
Published: 2018-08-16
Description: libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2018:2486; https://bugzilla.redhat.com/show_bug.cgi?id=1408306; https://access.redhat.com/errata/RHSA-2018:2486
CVE: CVE-2018-11509
Published: 2018-08-16
Description: ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html; https://www.exploit-db.com/exploits/45200/; http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
CVE: CVE-2018-11511
Published: 2018-08-16
Description: The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html; https://www.exploit-db.com/exploits/45200/; http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html
CVE: CVE-2018-12256
Published: 2018-08-16
Description: admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file (resulting in remote code execution) by using the text/xml or application/xml Content-Type in a public_html/admin/?app=vqmods&doc=vqmods request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/litecart/litecart/commit/2305368eb70a26cab34c772c9ae88787f4c3e669; https://www.litecart.net/download; https://github.com/litecart/litecart/commit/2305368eb70a26cab34c772c9ae88787f4c3e669
CVE: CVE-2018-13434
Published: 2018-08-16
Description: An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is not used. In other words, an attacker could authenticate with an arbitrary fingerprint.  NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: https://gist.github.com/tanprathan/f5133651e438b2ad1b39172d52b56115; https://gist.github.com/tanprathan/f5133651e438b2ad1b39172d52b56115
CVE: CVE-2018-13435
Published: 2018-08-16
Description: An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication.  NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred
CVSS Score: 7.0 (HIGH)
CWE: CWE-287
References: https://gist.github.com/tanprathan/19165c43ade898ab8b664098fb171f49; https://gist.github.com/tanprathan/19165c43ade898ab8b664098fb171f49
CVE: CVE-2018-13446
Published: 2018-08-16
Description: An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode.  NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
CVSS Score: 7.0 (HIGH)
CWE: CWE-287
References: https://gist.github.com/tanprathan/efde53e5b312f50edb08f050b6be3928; https://gist.github.com/tanprathan/efde53e5b312f50edb08f050b6be3928
CVE: CVE-2018-14567
Published: 2018-08-16
Description: libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/105198; https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e[PII_REDACTED]5e74; https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html
CVE: CVE-2018-15122
Published: 2018-08-16
Description: An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object (such as DLL or EXE) with an embedded resource file by clicking on the resource.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://docs.telerik.com/devtools/justdecompile/knowledge-base/jd-ja-resources-vulnerability; https://www.telerik.com/support/whats-new/justdecompile/release-history/justdecompile-r2-2018-sp1; https://docs.telerik.com/devtools/justdecompile/knowledge-base/jd-ja-resources-vulnerability
CVE: CVE-2018-10873
Published: 2018-08-17
Description: A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.
CVSS Score: 8.3 (HIGH)
CWE: CWE-119, CWE-20
References: http://www.securityfocus.com/bid/105152; https://access.redhat.com/errata/RHSA-2018:2731; https://access.redhat.com/errata/RHSA-2018:2732