deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-10723
Published: 2018-06-21
Description: An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oom_lock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator (e.g., via concurrent page fault events) when the global OOM killer is invoked. NOTE: the software maintainer has not accepted certain proposed patches, in part because of a viewpoint that "the underlying problem is non-trivial to handle.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: https://patchwork.kernel.org/patch/10395909/; https://patchwork.kernel.org/patch/9842889/; https://www.spinics.net/lists/linux-mm/msg117896.html
CVE: CVE-2017-13072
Published: 2018-06-21
Description: Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/nas-201805-16; https://www.qnap.com/en/security-advisory/nas-201805-16
CVE: CVE-2017-2669
Published: 2018-06-21
Description: Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
CVSS Score: 3.7 (LOW)
CWE: CWE-20, CWE-20
References: http://www.openwall.com/lists/oss-security/2017/04/11/1; http://www.securityfocus.com/bid/97536; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2669
CVE: CVE-2017-2672
Published: 2018-06-21
Description: A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-269
References: http://www.securityfocus.com/bid/97526; https://access.redhat.com/errata/RHSA-2018:0336; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2672
CVE: CVE-2018-0712
Published: 2018-06-21
Description: Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions could allow remote attackers to run arbitrary commands or install malware on the NAS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.securitytracker.com/id/1041141; https://www.qnap.com/zh-tw/security-advisory/nas-201806-19; http://www.securitytracker.com/id/1041141
CVE: CVE-2018-12526
Published: 2018-06-21
Description: Telesquare SDT-CS3B1 and SDT-CW3B1 devices through 1.2.0 have a default factory account. Remote attackers can obtain access to the device via TELNET using a hardcoded account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.boho.or.kr/data/secNoticeView.do?bulletin_writing_sequence=27284; https://www.fortiguard.com/zeroday/FG-VD-18-106; https://www.boho.or.kr/data/secNoticeView.do?bulletin_writing_sequence=27284
CVE: CVE-2018-1253
Published: 2018-06-21
Description: RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Jun/39; http://www.securityfocus.com/bid/104534; http://www.securitytracker.com/id/1041134
CVE: CVE-2018-1254
Published: 2018-06-21
Description: RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim Security Console administrator to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/Jun/39; http://www.securityfocus.com/bid/104534; http://www.securitytracker.com/id/1041134
CVE: CVE-2018-12615
Published: 2018-06-21
Description: An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8; https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8
CVE: CVE-2018-12617
Published: 2018-06-21
Description: qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/104531; https://gist.github.com/fakhrizulkifli/c7740d28efa07dafee66d4da5d857ef6; https://lists.debian.org/debian-lts-announce/2019/02/msg00041.html
CVE: CVE-2018-7679
Published: 2018-06-21
Description: Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm
CVE: CVE-2018-7680
Published: 2018-06-21
Description: Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm
CVE: CVE-2018-7681
Published: 2018-06-21
Description: Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm
CVE: CVE-2018-7683
Published: 2018-06-21
Description: Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm
CVE: CVE-2018-12581
Published: 2018-06-21
Description: An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104530; http://www.securitytracker.com/id/1041187; https://www.phpmyadmin.net/security/PMASA-2018-3/
CVE: CVE-2018-12613
Published: 2018-06-21
Description: An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html; http://www.securityfocus.com/bid/104532; https://security.gentoo.org/glsa/201904-16
CVE: CVE-2018-3665
Published: 2018-06-21
Description: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104460; http://www.securitytracker.com/id/1041124; http://www.securitytracker.com/id/1041125
CVE: CVE-2018-12630
Published: 2018-06-21
Description: NEWMARK (aka New Mark) NMCMS 2.1 allows SQL Injection via the sect_id parameter to the /catalog URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/44911/; https://www.exploit-db.com/exploits/44911/
CVE: CVE-2018-12631
Published: 2018-06-21
Description: Redatam7 (formerly Redatam WebServer) allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/text?LFN=../ directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/44905/; https://www.exploit-db.com/exploits/44905/
CVE: CVE-2018-12632
Published: 2018-06-21
Description: Redatam7 (formerly Redatam WebServer) allows remote attackers to discover the installation path via an invalid LFN parameter to the /redbin/rpwebutilities.exe/text URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.exploit-db.com/exploits/44905/; https://www.exploit-db.com/exploits/44905/
CVE: CVE-2018-12633
Published: 2018-06-22
Description: An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bd23a7269834dc7c1f93e83535d16ebc44b75eba; https://bugzilla.kernel.org/show_bug.cgi?id=200131; https://github.com/torvalds/linux/commit/bd23a7269834dc7c1f93e83535d16ebc44b75eba
CVE: CVE-2018-12634
Published: 2018-06-22
Description: CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life; https://www.exploit-db.com/exploits/45384/; https://www.seebug.org/vuldb/ssvid-97353
CVE: CVE-2018-12635
Published: 2018-06-22
Description: CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.seebug.org/vuldb/ssvid-97353; https://www.seebug.org/vuldb/ssvid-97353
CVE: CVE-2018-12641
Published: 2018-06-22
Description: An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg, demangle_args, and demangle_nested_args. This can occur during execution of nm-new.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2019:2075; https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763099; https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85452
CVE: CVE-2018-12642
Published: 2018-06-22
Description: Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://github.com/Froxlor/Froxlor/commit/aa881560cc996c38cbf8c20ee62854e27f72c73c; https://github.com/Froxlor/Froxlor/commit/aa881560cc996c38cbf8c20ee62854e27f72c73c
CVE: CVE-2017-2668
Published: 2018-06-22
Description: 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-476
References: http://www.securityfocus.com/bid/97524; https://access.redhat.com/errata/RHSA-2017:0893; https://access.redhat.com/errata/RHSA-2017:0920
CVE: CVE-2017-7466
Published: 2018-06-22
Description: Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/97595; https://access.redhat.com/errata/RHSA-2017:1244; https://access.redhat.com/errata/RHSA-2017:1334
CVE: CVE-2018-12430
Published: 2018-06-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-12429. Reason: This candidate is a reservation duplicate of CVE-2018-12429. Notes: All CVE users should reference CVE-2018-12429 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-12648
Published: 2018-06-22
Description: The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00070.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00075.html; https://bugs.freedesktop.org/show_bug.cgi?id=106981
CVE: CVE-2018-12649
Published: 2018-06-22
Description: An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/MISP/MISP/commit/6ffacc1e239930e0e8464d0ca16e432e26cf36a9; https://github.com/MISP/MISP/commit/6ffacc1e239930e0e8464d0ca16e432e26cf36a9
CVE: CVE-2018-1655
Published: 2018-06-22
Description: IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory. IBM X-Force ID: 144748.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://aix.software.ibm.com/aix/efixes/security/rmsock_advisory2.asc; http://www.securityfocus.com/bid/104542; http://www.securitytracker.com/id/1041166
CVE: CVE-2017-7568
Published: 2018-06-22
Description: NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authenticated users when the LDAP authentication configuration is tested via the user interface.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104536; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.securityfocus.com/bid/104536
CVE: CVE-2018-12654
Published: 2018-06-22
Description: Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?keywords= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/slims/slims8_akasia/issues/98; https://github.com/slims/slims8_akasia/issues/98
CVE: CVE-2018-12655
Published: 2018-06-22
Description: Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan_rules.php?keywords= URI, a related issue to CVE-2017-7242.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/slims/slims8_akasia/issues/99; https://github.com/slims/slims8_akasia/issues/99
CVE: CVE-2018-12656
Published: 2018-06-22
Description: Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/slims/slims8_akasia/issues/100; https://github.com/slims/slims8_akasia/issues/100
CVE: CVE-2018-12657
Published: 2018-06-22
Description: Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?keywords= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/slims/slims8_akasia/issues/101; https://github.com/slims/slims8_akasia/issues/101
CVE: CVE-2018-12658
Published: 2018-06-22
Description: Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywords= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/slims/slims8_akasia/issues/102; https://github.com/slims/slims8_akasia/issues/102
CVE: CVE-2018-12659
Published: 2018-06-22
Description: SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/slims/slims8_akasia/issues/103; https://github.com/slims/slims8_akasia/issues/103
CVE: CVE-2018-12636
Published: 2018-06-22
Description: The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E; https://wordpress.org/plugins/better-wp-security/#developers; https://www.exploit-db.com/exploits/44943/
CVE: CVE-2[PII_REDACTED]
Published: 2018-06-22
Description: ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f[PII_REDACTED]45a; https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c; https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f[PII_REDACTED]45a
CVE: CVE-2018-12678
Published: 2018-06-22
Description: Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/portainer/portainer/pull/1979; https://github.com/portainer/portainer/releases/tag/1.18.0; https://github.com/portainer/portainer/pull/1979
CVE: CVE-2018-12538
Published: 2018-06-22
Description: In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
CVSS Score: 8.8 (HIGH)
CWE: CWE-6, CWE-384
References: http://www.securitytracker.com/id/1041194; https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018; https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2018-12684
Published: 2018-06-22
Description: Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-200
References: https://github.com/civetweb/civetweb/commit/8fd069f6dedb064339f1091069ac96f3f8bdb552; https://github.com/civetweb/civetweb/issues/633; https://github.com/civetweb/civetweb/commit/8fd069f6dedb064339f1091069ac96f3f8bdb552
CVE: CVE-2018-12687
Published: 2018-06-22
Description: tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/syoyo/tinyexr/issues/84; https://github.com/syoyo/tinyexr/issues/84
CVE: CVE-2018-12688
Published: 2018-06-22
Description: tinyexr 0.9.5 has a segmentation fault in the wav2Decode function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/syoyo/tinyexr/issues/83; https://github.com/syoyo/tinyexr/issues/83
CVE: CVE-2018-12689
Published: 2018-06-22
Description: phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel.
CVSS Score: 9.8 (CRITICAL)
References: https://www.exploit-db.com/exploits/44926/; https://www.exploit-db.com/exploits/44926/
CVE: CVE-2018-7682
Published: 2018-06-22
Description: Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm
CVE: CVE-2018-12692
Published: 2018-06-23
Description: TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the wps_setup_pin parameter to /data/wps.setup.json.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://medium.com/advisability/the-in-security-of-the-tp-link-technologies-tl-wa850re-wi-fi-range-extender-26db87a7a0cc; https://www.exploit-db.com/exploits/44912/; https://medium.com/advisability/the-in-security-of-the-tp-link-technologies-tl-wa850re-wi-fi-range-extender-26db87a7a0cc
CVE: CVE-2018-12693
Published: 2018-06-23
Description: Stack-based buffer overflow in TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to cause a denial of service (outage) via a long type parameter to /data/syslog.filter.json.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://medium.com/advisability/the-in-security-of-the-tp-link-technologies-tl-wa850re-wi-fi-range-extender-26db87a7a0cc; https://medium.com/advisability/the-in-security-of-the-tp-link-technologies-tl-wa850re-wi-fi-range-extender-26db87a7a0cc
CVE: CVE-2018-12694
Published: 2018-06-23
Description: TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (reboot) via data/reboot.json.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://medium.com/advisability/the-in-security-of-the-tp-link-technologies-tl-wa850re-wi-fi-range-extender-26db87a7a0cc; https://medium.com/advisability/the-in-security-of-the-tp-link-technologies-tl-wa850re-wi-fi-range-extender-26db87a7a0cc