deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5980
Published: 2018-02-17
Description: SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44128; https://exploit-db.com/exploits/44128
CVE: CVE-2018-5981
Published: 2018-02-17
Description: SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44112; https://exploit-db.com/exploits/44112
CVE: CVE-2018-5982
Published: 2018-02-17
Description: SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44105; https://exploit-db.com/exploits/44105
CVE: CVE-2018-5983
Published: 2018-02-17
Description: SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44118; https://exploit-db.com/exploits/44118
CVE: CVE-2018-5987
Published: 2018-02-17
Description: SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay action, the searchVal parameter in a view=search action, or the uid parameter in a view=likes action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44131; https://exploit-db.com/exploits/44131
CVE: CVE-2018-5989
Published: 2018-02-17
Description: SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue to CVE-2011-5099.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44132; https://exploit-db.com/exploits/44132
CVE: CVE-2018-5990
Published: 2018-02-17
Description: SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44107; https://exploit-db.com/exploits/44107
CVE: CVE-2018-5991
Published: 2018-02-17
Description: SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44111; https://exploit-db.com/exploits/44111
CVE: CVE-2018-5992
Published: 2018-02-17
Description: SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44129; https://exploit-db.com/exploits/44129
CVE: CVE-2018-5993
Published: 2018-02-17
Description: SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44106; https://exploit-db.com/exploits/44106
CVE: CVE-2018-5994
Published: 2018-02-17
Description: SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resume request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44120; https://exploit-db.com/exploits/44120
CVE: CVE-2018-6004
Published: 2018-02-17
Description: SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44110; https://exploit-db.com/exploits/44110
CVE: CVE-2018-6005
Published: 2018-02-17
Description: SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44125; https://exploit-db.com/exploits/44125
CVE: CVE-2018-6006
Published: 2018-02-17
Description: SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44119; https://exploit-db.com/exploits/44119
CVE: CVE-2018-6368
Published: 2018-02-17
Description: SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44117; https://exploit-db.com/exploits/44117
CVE: CVE-2018-6370
Published: 2018-02-17
Description: SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under the all-offers/ URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44123; https://exploit-db.com/exploits/44123
CVE: CVE-2018-6372
Published: 2018-02-17
Description: SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44115; https://exploit-db.com/exploits/44115
CVE: CVE-2018-6373
Published: 2018-02-17
Description: SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44109; https://exploit-db.com/exploits/44109
CVE: CVE-2018-6394
Published: 2018-02-17
Description: SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44114; https://exploit-db.com/exploits/44114
CVE: CVE-2018-6396
Published: 2018-02-17
Description: SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a layout=form_markers action, or the map parameter in a layout=default action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/103094; https://exploit-db.com/exploits/44113; http://www.securityfocus.com/bid/103094
CVE: CVE-2018-6583
Published: 2018-02-17
Description: SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44130; https://exploit-db.com/exploits/44130
CVE: CVE-2018-6584
Published: 2018-02-17
Description: SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44108; https://exploit-db.com/exploits/44108
CVE: CVE-2018-6585
Published: 2018-02-17
Description: SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or filter_events_cat parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exploit-db.com/exploits/44121; https://exploit-db.com/exploits/44121
CVE: CVE-2018-7177
Published: 2018-02-17
Description: SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/44134; https://www.exploit-db.com/exploits/44134
CVE: CVE-2018-7178
Published: 2018-02-17
Description: SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/44136; https://www.exploit-db.com/exploits/44136
CVE: CVE-2018-7179
Published: 2018-02-17
Description: SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/44135; https://www.exploit-db.com/exploits/44135
CVE: CVE-2018-7180
Published: 2018-02-17
Description: SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/44133; https://www.exploit-db.com/exploits/44133
CVE: CVE-2018-7197
Published: 2018-02-18
Description: An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pluck-cms/pluck/issues/47; https://github.com/pluck-cms/pluck/issues/47
CVE: CVE-2018-7198
Published: 2018-02-18
Description: October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://securitywarrior9.blogspot.com/2018/02/html-injection-october-cms.html; https://www.exploit-db.com/exploits/44144/; http://securitywarrior9.blogspot.com/2018/02/html-injection-october-cms.html
CVE: CVE-2018-7206
Published: 2018-02-18
Description: An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)
CVSS Score: 8.8 (HIGH)
References: https://blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76; https://github.com/jupyterhub/oauthenticator/blob/8499dc2/CHANGELOG.md#073---2018-02-16; https://github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2
CVE: CVE-2018-7207
Published: 2018-02-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-7208
Published: 2018-02-18
Description: In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; http://www.securityfocus.com/bid/103077
CVE: CVE-2018-7209
Published: 2018-02-18
Description: An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idashboards/config.xml URI, as demonstrated by intranet URLs for reports.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/; https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/
CVE: CVE-2018-7210
Published: 2018-02-18
Description: An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idb/config?CMD=installLicense URI, as demonstrated by intranet IP addresses and names of guest accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/; https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/
CVE: CVE-2018-7211
Published: 2018-02-18
Description: An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-327
References: https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/; https://membership.backbox.org/idashboards-9-6b-multiple-vulnerabilities/
CVE: CVE-2018-7212
Published: 2018-02-18
Description: An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c; https://github.com/sinatra/sinatra/pull/1379; https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c
CVE: CVE-2018-7216
Published: 2018-02-18
Description: Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal allows remote authenticated users to hijack the authentication of application users for requests that modify their personal data by leveraging lack of anti-CSRF tokens.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2018/Feb/44; https://packetstormsecurity.com/files/146409/Tejari-Cross-Site-Request-Forgery.html; https://www.exploit-db.com/exploits/44256/
CVE: CVE-2018-7217
Published: 2018-02-18
Description: In Bravo Tejari Procurement Portal, uploaded files are not properly validated by the application either on the client or the server side. An attacker can take advantage of this vulnerability and upload malicious executable files to compromise the application, as demonstrated by an esop/evm/OPPreliminaryForms.do?formId=857 request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://seclists.org/bugtraq/2018/Feb/38; https://packetstormsecurity.com/files/146425/Tejari-Arbitrary-File-Upload.html; http://seclists.org/bugtraq/2018/Feb/38
CVE: CVE-2018-6024
Published: 2018-02-18
Description: SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/146454/Joomla-Project-Log-1.5.3-SQL-Injection.html; https://www.exploit-db.com/exploits/44124/; http://packetstormsecurity.com/files/146454/Joomla-Project-Log-1.5.3-SQL-Injection.html
CVE: CVE-2017-16924
Published: 2018-02-19
Description: Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data/<client_id>/collections/##/usermgmt.xml URL, as demonstrated by passwords and Wi-Fi keys. This is fixed in build 100157.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://github.com/snoonan77/security-research/blob/master/CVE-2017-16924; https://www.manageengine.com/desktop-management-msp/password-encryption-policy-violation.html; https://github.com/snoonan77/security-research/blob/master/CVE-2017-16924
CVE: CVE-2018-5378
Published: 2018-02-19
Description: The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119, CWE-119
References: http://savannah.nongnu.org/forum/forum.php?forum_id=9095; http://www.kb.cert.org/vuls/id/940439; https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-0543.txt
CVE: CVE-2018-5379
Published: 2018-02-19
Description: The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415, CWE-415
References: http://savannah.nongnu.org/forum/forum.php?forum_id=9095; http://www.kb.cert.org/vuls/id/940439; http://www.securityfocus.com/bid/103105
CVE: CVE-2018-5380
Published: 2018-02-19
Description: The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://savannah.nongnu.org/forum/forum.php?forum_id=9095; http://www.kb.cert.org/vuls/id/940439; https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf
CVE: CVE-2018-5381
Published: 2018-02-19
Description: The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-228, CWE-835
References: http://savannah.nongnu.org/forum/forum.php?forum_id=9095; http://www.kb.cert.org/vuls/id/940439; https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf
CVE: CVE-2017-15712
Published: 2018-02-19
Description: Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/103102; https://lists.apache.org/thread.html/[PII_REDACTED]fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E; http://www.securityfocus.com/bid/103102
CVE: CVE-2017-16755
Published: 2018-02-19
Description: An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ruby.sh/helpspot-disclosure-20180206.txt; https://www.helpspot.com/releases; https://www.helpspot.com/releases/version-4-7-2
CVE: CVE-2017-16756
Published: 2018-02-19
Description: An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://ruby.sh/helpspot-disclosure-20180206.txt; https://www.helpspot.com/releases; https://www.helpspot.com/releases/version-4-7-2
CVE: CVE-2017-18092
Published: 2018-02-19
Description: The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of a comment on the snippet.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103082; https://jira.atlassian.com/browse/CRUC-8176; http://www.securityfocus.com/bid/103082
CVE: CVE-2017-18093
Published: 2018-02-19
Description: Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103095; https://jira.atlassian.com/browse/CRUC-8175; https://jira.atlassian.com/browse/FE-7008
CVE: CVE-2017-18095
Published: 2018-02-19
Description: The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: http://www.securityfocus.com/bid/103207; https://jira.atlassian.com/browse/CRUC-8178; http://www.securityfocus.com/bid/103207
CVE: CVE-2018-1409
Published: 2018-02-19
Description: IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22010766; http://www.ibm.com/support/docview.wss?uid=swg22010767; https://exchange.xforce.ibmcloud.com/vulnerabilities/138708
CVE: CVE-2018-1410
Published: 2018-02-19
Description: IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138709.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22010766; http://www.ibm.com/support/docview.wss?uid=swg22010767; https://exchange.xforce.ibmcloud.com/vulnerabilities/138709
CVE: CVE-2018-1411
Published: 2018-02-19
Description: IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138710.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22010766; http://www.ibm.com/support/docview.wss?uid=swg22010767; https://exchange.xforce.ibmcloud.com/vulnerabilities/138710
CVE: CVE-2018-6591
Published: 2018-02-19
Description: Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended. For example, users might have an expectation that chatroom bookmarks are private, but the various interacting software components do not necessarily make that happen.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gultsch.de/converse_bookmarks.html; https://gultsch.de/converse_bookmarks.html
CVE: CVE-2018-7219
Published: 2018-02-19
Description: application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://foreversong.cn/archives/1081; http://foreversong.cn/archives/1081
CVE: CVE-2016-8750
Published: 2018-02-19
Description: Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-90
References: http://www.securityfocus.com/bid/103098; https://access.redhat.com/errata/RHSA-2018:1322; https://karaf.apache.org/security/cve-2016-8750.txt
CVE: CVE-2018-7225
Published: 2018-02-19
Description: An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2018/02/18/1; http://www.securityfocus.com/bid/103107; https://access.redhat.com/errata/RHSA-2018:1055