deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7698
Published: 2018-03-05
Description: An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera's stream and make changes without the user's knowledge.
CVSS Score: 8.1 (HIGH)
CWE: CWE-522
References: https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/; https://blog.nickleghorn.com/2019/06/16/d-link-security-cameras-using-mydlink-app-leak-passwords/
CVE: CVE-2017-18217
Published: 2018-03-05
Description: An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and application/modules/quotes/views/view.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://blog.isecurion.com/2018/04/23/invoice-plane-v1-5-cross-site-scripting-vulnerability/; https://github.com/InvoicePlane/InvoicePlane/pull/542; https://github.com/InvoicePlane/InvoicePlane/pull/551
CVE: CVE-2017-18218
Published: 2018-03-05
Description: In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can cause a denial of service (use-after-free and BUG) or possibly have unspecified other impact by leveraging differences in skb handling between hns_nic_net_xmit_hw and hns_nic_net_xmit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=27463ad99f738ed93c7c8b3e2e5bc8c4853a2ff2; http://www.securityfocus.com/bid/103277; https://github.com/torvalds/linux/commit/27463ad99f738ed93c7c8b3e2e5bc8c4853a2ff2
CVE: CVE-2018-7493
Published: 2018-03-05
Description: CactusVPN through 6.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-007.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-007.md
CVE: CVE-2017-18219
Published: 2018-03-05
Description: An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted file that triggers an attempt at a large png_pixels array allocation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/cadd4b0522fa; http://www.securityfocus.com/bid/103258; https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html
CVE: CVE-2017-18220
Published: 2018-03-05
Description: The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote attackers to cause a denial of service (magick/blob.c CloseBlob use-after-free) or possibly have unspecified other impact via a crafted file, a related issue to CVE-2017-11403.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/98721124e51f; http://www.securityfocus.com/bid/103276; https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html
CVE: CVE-2018-7711
Published: 2018-03-05
Description: HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.
CVSS Score: 8.1 (HIGH)
CWE: CWE-347
References: https://github.com/simplesamlphp/saml2/commit/4f6af7f69f29df8555a18b9bb7b646906b45924d; https://lists.debian.org/debian-lts-announce/2018/03/msg00017.html; https://simplesamlphp.org/security/201803-01
CVE: CVE-2018-7712
Published: 2018-03-05
Description: The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (size.height <= (1<<20)) may be false. Note: “OpenCV CV_Assert is not an assertion (C-like assert()), it is regular C++ exception which can raised in case of invalid or non-supported parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://github.com/opencv/opencv/issues/10998; https://github.com/xiaoqx/pocs/tree/master/opencv/dos-by-assert; https://github.com/opencv/opencv/issues/10998
CVE: CVE-2018-7713
Published: 2018-03-05
Description: The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (size.width <= (1<<20)) may be false. Note: “OpenCV CV_Assert is not an assertion (C-like assert()), it is regular C++ exception which can raised in case of invalid or non-supported parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/opencv/opencv/issues/10998; https://github.com/xiaoqx/pocs/tree/master/opencv/dos-by-assert; https://github.com/opencv/opencv/issues/10998
CVE: CVE-2018-7714
Published: 2018-03-05
Description: The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failure) because (pixels <= (1<<30)) may be false. Note: “OpenCV CV_Assert is not an assertion (C-like assert()), it is regular C++ exception which can raised in case of invalid or non-supported parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/opencv/opencv/issues/10998; https://github.com/xiaoqx/pocs/tree/master/opencv/dos-by-assert; https://github.com/opencv/opencv/issues/10998
CVE: CVE-2018-7715
Published: 2018-03-05
Description: PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the path string from the corresponding XPC message. This string is supposed to point to PrivateVPN's internal openvpn binary. If a new connection has not already been established, an attacker can send the XPC service a malicious XPC message with the path string pointing at a binary that he or she controls. This results in the execution of arbitrary code as the root user.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-005.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-005.md
CVE: CVE-2018-7716
Published: 2018-03-05
Description: PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the config string from the corresponding XPC message. This string is supposed to point to an internal OpenVPN configuration file. If a new connection has not already been established, an attacker can send the XPC service a malicious XPC message with the config string pointing at an OpenVPN configuration file that he or she controls. In the configuration file, an attacker can specify a dynamic library plugin that should run for every new VPN connection. This plugin will execute code in the context of the root user.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/VerSprite/research/edit/master/advisories/VS-2018-006.md; https://github.com/VerSprite/research/edit/master/advisories/VS-2018-006.md
CVE: CVE-2018-7717
Published: 2018-03-05
Description: The htmlImageAddTitleAttribute function in sige.php in the Kubik-Rubik Simple Image Gallery Extended (SIGE) extension 3.2.3 for Joomla! has XSS via a crafted image header, as demonstrated by the Caption-Abstract header object in a JPEG file. This is fixed in 3.3.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://debugtrap.com/2018/03/01/joomla_sige_xss/; http://debugtrap.com/2018/03/01/joomla_sige_xss/
CVE: CVE-2018-1062
Published: 2018-03-06
Description: A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-212, CWE-212
References: http://www.securityfocus.com/bid/103433; https://access.redhat.com/errata/RHBA-2018:0135; https://bugzilla.redhat.com/show_bug.cgi?id=1549944
CVE: CVE-2018-7307
Published: 2018-03-06
Description: The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://auth0.com/docs/security/bulletins/cve-2018-7307; https://auth0.com/docs/security/bulletins/cve-2018-7307
CVE: CVE-2018-7650
Published: 2018-03-06
Description: PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. Within the "Add New" section, the application does not sanitize user supplied input to the name parameter, and renders injected JavaScript code to the user's browser. This is different from CVE-2018-6878.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://neetech18.blogspot.in/2018/03/stored-xss-vulnerability-in-hot-scripts.html; https://neetech18.blogspot.in/2018/03/stored-xss-vulnerability-in-hot-scripts.html
CVE: CVE-2017-6280
Published: 2018-03-06
Description: NVIDIA driver contains a possible out-of-bounds read vulnerability due to a leak which may lead to information disclosure. This issue is rated as moderate. Android: A-63851980.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-12-01; https://source.android.com/security/bulletin/pixel/2017-12-01
CVE: CVE-2017-6282
Published: 2018-03-06
Description: NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary location which may lead to an escalation of privileges. This issue is rated as high.
CVSS Score: 7.8 (HIGH)
CWE: CWE-123
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4631; http://nvidia.custhelp.com/app/answers/detail/a_id/4631
CVE: CVE-2017-6283
Published: 2018-03-06
Description: NVIDIA Security Engine contains a vulnerability in the RSA function where the keyslot read/write lock permissions are cleared on a chip reset which may lead to information disclosure. This issue is rated as high.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4631; http://nvidia.custhelp.com/app/answers/detail/a_id/4631
CVE: CVE-2017-6284
Published: 2018-03-06
Description: NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does not properly initialize and store or transmits sensitive data using a weakened encryption scheme that is unable to protect sensitive data which may lead to information disclosure.This issue is rated as moderate.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-326
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4631; https://nvidia.custhelp.com/app/answers/detail/a_id/4787; http://nvidia.custhelp.com/app/answers/detail/a_id/4631
CVE: CVE-2017-6295
Published: 2018-03-06
Description: NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past the end, or before the beginning, of the intended buffer; and may lead to denial of service or information disclosure. This issue is rated as high.
CVSS Score: 8.4 (HIGH)
CWE: CWE-125
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4631; http://nvidia.custhelp.com/app/answers/detail/a_id/4631
CVE: CVE-2017-6296
Published: 2018-03-06
Description: NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of privileges. This issue is rated as moderate.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4631; http://nvidia.custhelp.com/app/answers/detail/a_id/4631
CVE: CVE-2017-9783
Published: 2018-03-06
Description: Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ignacionelson/ProjectSend/compare/448/commits; https://github.com/ignacionelson/ProjectSend/pull/448/commits/6c3710430be26feb5371cb0377e5355d6f9a27ca; https://github.com/ignacionelson/ProjectSend/compare/448/commits
CVE: CVE-2017-9786
Published: 2018-03-06
Description: Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ignacionelson/ProjectSend/pull/448/commits/6c3710430be26feb5371cb0377e5355d6f9a27ca; https://github.com/ignacionelson/ProjectSend/pull/448/commits/6c3710430be26feb5371cb0377e5355d6f9a27ca
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-06
Description: GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks being modified, this could lead to RCE. This attack appear to be exploitable via an attacker supplied MP4 file that when run by the victim may result in RCE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/gpac/gpac/issues/994; https://usn.ubuntu.com/3926-1/; https://github.com/gpac/gpac/issues/994
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-06
Description: Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination (CWE-170) vulnerability in mingw-w64-crt (libc)->(v)snprintf that can result in The bug may be used to corrupt subsequent string functions. This attack appear to be exploitable via Depending on the usage, worst case: network.
CVSS Score: 9.8 (CRITICAL)
References: https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2018/1000xxx/CVE-2[PII_REDACTED].json; https://sourceforge.net/p/mingw-w64/bugs/709/; https://sourceforge.net/p/mingw-w64/bugs/709/?limit=25#1d38/fefc/39aa
CVE: CVE-2018-7722
Published: 2018-03-06
Description: The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may be possible.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md; https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md
CVE: CVE-2018-7723
Published: 2018-03-06
Description: The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md; https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md
CVE: CVE-2018-7724
Published: 2018-03-06
Description: The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CVE-2017-10681, may be possible.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md; https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md
CVE: CVE-2018-7725
Published: 2018-03-06
Description: An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2018:3229; https://github.com/gdraheim/zziplib/issues/39; https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html
CVE: CVE-2018-7726
Published: 2018-03-06
Description: An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2018:3229; https://github.com/gdraheim/zziplib/issues/41; https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html
CVE: CVE-2018-7727
Published: 2018-03-06
Description: An issue was discovered in ZZIPlib 0.13.68. There is a memory leak triggered in the function zzip_mem_disk_new in memdisk.c, which will lead to a denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://access.redhat.com/errata/RHSA-2018:3229; https://github.com/gdraheim/zziplib/issues/40; https://access.redhat.com/errata/RHSA-2018:3229
CVE: CVE-2018-7728
Published: 2018-03-06
Description: An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FileHandlers/TIFF_Handler.cpp mishandles a case of a zero length, leading to a heap-based buffer over-read in the MD5Update() function in third-party/zuid/interfaces/MD5.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://bugs.freedesktop.org/show_bug.cgi?id=105205; https://cgit.freedesktop.org/exempi/commit/?id=e163667a06a9b656a047b0ec660b871f29a83c9f; https://lists.debian.org/debian-lts-announce/2018/03/msg00013.html
CVE: CVE-2018-7729
Published: 2018-03-06
Description: An issue was discovered in Exempi through 2.4.4. There is a stack-based buffer over-read in the PostScript_MetaHandler::ParsePSFile() function in XMPFiles/source/FileHandlers/PostScript_Handler.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://bugs.freedesktop.org/show_bug.cgi?id=105206; https://cgit.freedesktop.org/exempi/commit/?id=baa4b8a02c1ffab9645d13f0bfb1c0d10d311a0c; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BCFXKOOATZ2B5G3G7EBXZWVZHEABN4ZV/
CVE: CVE-2018-7730
Published: 2018-03-06
Description: An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp, leading to a heap-based buffer over-read in the PSD_MetaHandler::CacheFileData() function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:2048; https://bugs.freedesktop.org/show_bug.cgi?id=105204; https://cgit.freedesktop.org/exempi/commit/?id=6cbd34025e5fd3ba47b29b602096e456507ce83b
CVE: CVE-2018-7731
Published: 2018-03-06
Description: An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer dereference in the WEBP::VP8XChunk class.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugs.freedesktop.org/show_bug.cgi?id=105247; https://cgit.freedesktop.org/exempi/commit/?id=aabedb5e749dd59112a3fe1e8e08f2d934f56666; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BCFXKOOATZ2B5G3G7EBXZWVZHEABN4ZV/
CVE: CVE-2018-7732
Published: 2018-03-06
Description: An issue was discovered in YxtCMF 3.1. SQL Injection exists in ShitiController.class.php via the ids array parameter to exam/shiti/delshiti.html.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/SQYY/CVE/blob/master/YxtCMF_S.txt; https://github.com/SQYY/CVE/blob/master/YxtCMF_S.txt
CVE: CVE-2018-7733
Published: 2018-03-06
Description: An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/add_post.html.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/SQYY/CVE/blob/master/YxtCMF_C; https://github.com/SQYY/CVE/blob/master/YxtCMF_C
CVE: CVE-2018-7734
Published: 2018-03-06
Description: Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users&section=cpanel&page=list request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.filerun.com/changelog; https://feedback.filerun.com/communities/1/topics/189-critical-security-update-available; https://www.scanfsec.com/FileRun_2017_09_25_Blind_SQL.html
CVE: CVE-2018-7735
Published: 2018-03-06
Description: Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata&section=cpanel&page=list_filetypes request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.filerun.com/changelog; https://feedback.filerun.com/communities/1/topics/189-critical-security-update-available; https://www.scanfsec.com/FileRun_2017_09_25_Blind_SQL.html
CVE: CVE-2015-5377
Published: 2018-03-06
Description: Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol.  NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://www.securityfocus.com/bid/75938; http://www.zerodayinitiative.com/advisories/ZDI-15-365/; https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736
CVE: CVE-2017-15519
Published: 2018-03-06
Description: Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. All users are urged to move to version 3.0.1 and perform the mitigation steps or upgrade to 4.0 following the product documentation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1343
Published: 2018-03-06
Description: PAM exposure enabling unauthenticated access to remote host
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.netiq.com/documentation/privileged-account-manager-3/npam3104-release-notes/data/npam3104-release-notes.html; https://www.netiq.com/documentation/privileged-account-manager-3/npam3203-release-notes/data/npam3203-release-notes.html; https://www.novell.com/support/kb/doc.php?id=7022630
CVE: CVE-2018-5729
Published: 2018-03-06
Description: MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: http://www.securitytracker.com/id/1042071; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3071