deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-13763
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for Ublasti, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/Ublasti; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13764
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for BiquToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/BiquToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13765
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for LandCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/LandCoin; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13766
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for Easticoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/Easticoin; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13767
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for Cornerstone, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/Cornerstone; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13768
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for ZToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/ZToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13769
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for JeansToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/JeansToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13770
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for UltimateCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/UltimateCoin; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13771
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for ExacoreContract, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/ExacoreContract; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13772
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for TheFlashToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/TheFlashToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13773
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for Enterprise Token Ecosystem (ETE) (Contract Name: NetkillerToken), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/NetkillerToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13774
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for Bitstarti, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/Bitstarti; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13775
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for RCKT_Coin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/RCKT_Coin; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13776
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for AppleToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/AppleToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13777
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for RRToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/RRToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13778
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for CGCToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/CGCToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13779
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for YLCToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/YLCToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13780
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for ESH, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/ESH; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13781
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for MyYLC, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/MyYLCToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13782
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for ENTER (ENTR) (Contract Name: EnterCoin), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/EnterCoin; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13783
Published: 2018-07-09
Description: The mintToken function of a smart contract implementation for JiucaiToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md; https://github.com/BlockChainsSecurity/EtherTokens/tree/master/JiucaiToken; https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md
CVE: CVE-2018-13784
Published: 2018-07-09
Description: PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php.
CVSS Score: 9.1 (CRITICAL)
References: http://build.prestashop.com/news/prestashop-1-7-3-4-1-6-1-20-maintenance-releases/; https://github.com/PrestaShop/PrestaShop/pull/9218; https://github.com/PrestaShop/PrestaShop/pull/9222
CVE: CVE-2017-16890
Published: 2018-07-09
Description: SWFTools 0.9.2 has a divide-by-zero error in the wav_convert2mono function in lib/wav.c because the align value may be zero.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/matthiaskramm/swftools/issues/57; https://github.com/matthiaskramm/swftools/issues/57
CVE: CVE-2018-11541
Published: 2018-07-09
Description: A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privileged content via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://gist.github.com/CyberSKR/0134dff8f48d2e7b87227c554404bfcb; https://support.sonus.net/display/UXDOC61/SBC+Edge+6.1.6+Release+Notes; https://gist.github.com/CyberSKR/0134dff8f48d2e7b87227c554404bfcb
CVE: CVE-2018-11542
Published: 2018-07-09
Description: A Remote Command Execution (RCE) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the execution of arbitrary commands via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/CyberSKR/a2a8c[PII_REDACTED]5af7bdbf53acebe1b; https://support.sonus.net/display/UXDOC61/SBC+Edge+6.1.6+Release+Notes; https://gist.github.com/CyberSKR/a2a8c[PII_REDACTED]5af7bdbf53acebe1b
CVE: CVE-2018-11543
Published: 2018-07-09
Description: A Local File Inclusion (LFI) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the downloading of arbitrary files via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It affects the SWe Lite devices 6.1.x up to Build 111 and 7.0.x up to Build 140.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/CyberSKR/6914c2c2c8a550d6555137a3ff756df4; https://support.sonus.net/display/UXDOC61/SBC+Edge+6.1.6+Release+Notes; https://gist.github.com/CyberSKR/6914c2c2c8a550d6555137a3ff756df4
CVE: CVE-2018-13256
Published: 2018-07-09
Description: PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gkaim.com/cve-2018-13256-vikas-chaudhary/; https://www.exploit-db.com/exploits/45125/; https://gkaim.com/cve-2018-13256-vikas-chaudhary/
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-09
Description: Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.37 and later.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-967; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-967
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-09
Description: Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a File and Directory Information Exposure vulnerability in AWSCodeDeployPublisher.java that can result in Disclosure of environment variables. This vulnerability appears to have been fixed in 1.20 and later.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-825; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-825
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-09
Description: Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodeDeployPublisher.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 1.20 and later.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-833; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-833
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-09
Description: Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, CodeBuilder.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.27 and later.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://jenkins.io/security/advisory/2018-06-25/#SECURITY-834; https://jenkins.io/security/advisory/2018-06-25/#SECURITY-834
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-12230.  Reason: This candidate is a reservation duplicate of CVE-2018-12230.  Notes: All CVE users should reference CVE-2018-12230 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-13785
Published: 2018-07-09
Description: In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-369
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/105599; http://www.securitytracker.com/id/1041889
CVE: CVE-2018-1548
Published: 2018-07-09
Description: IBM API Connect 2018.1.0.0, 2018.2.1, 2018.2.2, 2018.2.3, and 2018.2.4 contains a vulnerability that could allow an authenticated user to obtain sensitive information. IBM X-Force ID: 142657.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22017136; http://www.securityfocus.com/bid/104734; https://exchange.xforce.ibmcloud.com/vulnerabilities/142657
CVE: CVE-2017-7471
Published: 2018-07-09
Description: Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-732
References: http://www.openwall.com/lists/oss-security/2017/04/19/2; http://www.securityfocus.com/bid/97970; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7471
CVE: CVE-2015-0230
Published: 2018-07-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015.  Notes: none
CVE: CVE-2016-4466
Published: 2018-07-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016.  Notes: none
CVE: CVE-2016-5015
Published: 2018-07-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016.  Notes: none
CVE: CVE-2018-6830
Published: 2018-07-09
Description: Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and C1 Lite V2 2.52.2.47 and earlier, FI9800P, FI9800P V2, FI9803P V2, FI9803P V3, and FI9851P V2 2.54.2.47 and earlier, FI9815P, FI9815P V2, FI9816P, and FI9816P V2, 2.51.2.47 and earlier, R2 and R4 2.71.1.59 and earlier, C2 and FI9961EP 2.72.1.59 and earlier, FI9900EP, FI9900P, and FI9901EP 2.74.1.59 and earlier, FI9928P 2.74.1.58 and earlier, FI9803EP and FI9853EP 2.22.2.31 and earlier, FI9803P and FI9851P 2.24.2.31 and earlier, FI9821P V2, FI9826P V2, FI9831P V2, and FI9821EP 2.21.2.31 and earlier, FI9821W V2, FI9831W, FI9826W, FI9821P, FI9831P, and FI9826P 2.11.1.120 and earlier, FI9818W V2 2.13.2.120 and earlier, FI9805W, FI9804W, FI9804P, FI9805E, and FI9805P 2.14.1.120 and earlier, FI9828P, and FI9828W 2.13.1.120 and earlier, and FI9828P V2 2.11.1.133 and earlier allows remote attackers to delete arbitrary files via a .. (dot dot) in the URI path component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.vdoo.com/2018/06/06/vdoo-has-found-major-vulnerabilities-in-foscam-cameras/; https://www.foscam.com/company/securing-your-foscam-camera-important-notice.html; https://blog.vdoo.com/2018/06/06/vdoo-has-found-major-vulnerabilities-in-foscam-cameras/
CVE: CVE-2018-6831
Published: 2018-07-09
Description: The setSystemTime function in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and C1 Lite V2 2.52.2.47 and earlier, FI9800P, FI9800P V2, FI9803P V2, FI9803P V3, and FI9851P V2 2.54.2.47 and earlier, FI9815P, FI9815P V2, FI9816P, and FI9816P V2, 2.51.2.47 and earlier, R2 and R4 2.71.1.59 and earlier, C2 and FI9961EP 2.72.1.59 and earlier, FI9900EP, FI9900P, and FI9901EP 2.74.1.59 and earlier, FI9928P 2.74.1.58 and earlier, FI9803EP and FI9853EP 2.22.2.31 and earlier, FI9803P and FI9851P 2.24.2.31 and earlier, FI9821P V2, FI9826P V2, FI9831P V2, and FI9821EP 2.21.2.31 and earlier, FI9821W V2, FI9831W, FI9826W, FI9821P, FI9831P, and FI9826P 2.11.1.120 and earlier, FI9818W V2 2.13.2.120 and earlier, FI9805W, FI9804W, FI9804P, FI9805E, and FI9805P 2.14.1.120 and earlier, FI9828P, and FI9828W 2.13.1.120 and earlier, and FI9828P V2 2.11.1.133 and earlier allows remote authenticated users to execute arbitrary commands via a ';' in the ntpServer argument.  NOTE: this issue exists because of an incomplete fix for CVE-2017-2849.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://blog.vdoo.com/2018/06/06/vdoo-has-found-major-vulnerabilities-in-foscam-cameras/; https://www.foscam.com/company/securing-your-foscam-camera-important-notice.html; https://blog.vdoo.com/2018/06/06/vdoo-has-found-major-vulnerabilities-in-foscam-cameras/