deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-17468
Published: 2018-11-14
Description: Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/105666; https://access.redhat.com/errata/RHSA-2018:3004; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
CVE: CVE-2018-17469
Published: 2018-11-14
Description: Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105666; https://access.redhat.com/errata/RHSA-2018:3004; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
CVE: CVE-2018-17471
Published: 2018-11-14
Description: Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/105666; https://access.redhat.com/errata/RHSA-2018:3004; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
CVE: CVE-2018-17472
Published: 2018-11-14
Description: Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sandbox via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105666; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html; https://crbug.com/822518
CVE: CVE-2018-17473
Published: 2018-11-14
Description: Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/105666; https://access.redhat.com/errata/RHSA-2018:3004; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
CVE: CVE-2018-17474
Published: 2018-11-14
Description: Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/105666; https://access.redhat.com/errata/RHSA-2018:3004; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
CVE: CVE-2018-17475
Published: 2018-11-14
Description: Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/105666; https://access.redhat.com/errata/RHSA-2018:3004; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
CVE: CVE-2018-17476
Published: 2018-11-14
Description: Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/105666; https://access.redhat.com/errata/RHSA-2018:3004; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
CVE: CVE-2018-17477
Published: 2018-11-14
Description: Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/105666; https://access.redhat.com/errata/RHSA-2018:3004; https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
CVE: CVE-2018-6057
Published: 2018-11-14
Description: Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass inter-process read only guarantees via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6060
Published: 2018-11-14
Description: Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6061
Published: 2018-11-14
Description: A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6062
Published: 2018-11-14
Description: Heap overflow write in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6063
Published: 2018-11-14
Description: Incorrect use of mojo::WrapSharedMemoryHandle in Mojo in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6064
Published: 2018-11-14
Description: Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6065
Published: 2018-11-14
Description: Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6066
Published: 2018-11-14
Description: Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6067
Published: 2018-11-14
Description: Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6068
Published: 2018-11-14
Description: Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103297; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html; https://crbug.com/798933
CVE: CVE-2018-6069
Published: 2018-11-14
Description: Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6070
Published: 2018-11-14
Description: Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6071
Published: 2018-11-14
Description: An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-190
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6072
Published: 2018-11-14
Description: An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-416, CWE-787
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6073
Published: 2018-11-14
Description: A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6074
Published: 2018-11-14
Description: Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6075
Published: 2018-11-14
Description: Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6076
Published: 2018-11-14
Description: Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6077
Published: 2018-11-14
Description: Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6078
Published: 2018-11-14
Description: Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6079
Published: 2018-11-14
Description: Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6080
Published: 2018-11-14
Description: Lack of access control checks in Instrumentation in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to obtain memory metadata from privileged processes .
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6081
Published: 2018-11-14
Description: XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6082
Published: 2018-11-14
Description: Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-6083
Published: 2018-11-14
Description: Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/103297; https://access.redhat.com/errata/RHSA-2018:0484; https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
CVE: CVE-2018-7357
Published: 2018-11-14
Description: ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523; https://www.exploit-db.com/exploits/45972/; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523
CVE: CVE-2018-7358
Published: 2018-11-14
Description: ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523; http://www.securityfocus.com/bid/105963; https://www.exploit-db.com/exploits/45972/
CVE: CVE-2018-15708
Published: 2018-11-14
Description: Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/153433/Nagios-XI-Magpie_debug.php-Root-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/46221/; https://www.tenable.com/security/research/tra-2018-37
CVE: CVE-2018-15709
Published: 2018-11-14
Description: Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.tenable.com/security/research/tra-2018-37; https://www.tenable.com/security/research/tra-2018-37
CVE: CVE-2018-15710
Published: 2018-11-14
Description: Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153433/Nagios-XI-Magpie_debug.php-Root-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/46221/; https://www.tenable.com/security/research/tra-2018-37
CVE: CVE-2018-15711
Published: 2018-11-14
Description: Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.tenable.com/security/research/tra-2018-37; https://www.tenable.com/security/research/tra-2018-37
CVE: CVE-2018-15712
Published: 2018-11-14
Description: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2018-37; https://www.tenable.com/security/research/tra-2018-37
CVE: CVE-2018-15713
Published: 2018-11-14
Description: Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2018-37; https://www.tenable.com/security/research/tra-2018-37
CVE: CVE-2018-15714
Published: 2018-11-14
Description: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2018-37; https://www.tenable.com/security/research/tra-2018-37
CVE: CVE-2018-9347
Published: 2018-11-14
Description: In function SMF_ParseMetaEvent of file eas_smf.c there is incorrect input validation causing an infinite loop. This could lead to a remote temporary DoS with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-68664359
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105844; https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9457
Published: 2018-11-14
Description: In onCheckedChanged of BluetoothPairingController.java, there is a possible way to retrieve contact information due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-72872376
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: http://www.securityfocus.com/bid/105845; https://source.android.com/security/bulletin/2018-11-01; https://source.android.com/security/bulletin/pixel/2018-08-01
CVE: CVE-2018-9521
Published: 2018-11-14
Description: In parseMPEGCCData of NuPlayer2CCDecoder.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-111874331
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105865; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105865
CVE: CVE-2018-9522
Published: 2018-11-14
Description: In the serialization functions of StatsLogEventWrapper.java, there is a possible out-of-bounds write due to unnecessary functionality which may be abused. This could lead to local escalation of privilege in the system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112550251
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105848; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105848
CVE: CVE-2018-9523
Published: 2018-11-14
Description: In Parcel.writeMapInternal of Parcel.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112859604
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105847; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105847
CVE: CVE-2018-9524
Published: 2018-11-14
Description: In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-34170870
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: http://www.securityfocus.com/bid/105848; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105848
CVE: CVE-2018-9525
Published: 2018-11-14
Description: In the AndroidManifest.xml file defining the SliceBroadcastReceiver handler for com.android.settings.slice.action.WIFI_CHANGED, there is a possible permissions bypass due to a confused deputy. This could lead to local escalation of privilege, allowing a local attacker to change device settings, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-111330641
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/105848; https://source.android.com/security/bulletin/2018-11-01; http://www.securityfocus.com/bid/105848
CVE: CVE-2018-9526
Published: 2018-11-14
Description: In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112159033
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/105847; https://source.android.com/security/bulletin/pixel/2018-11-01; http://www.securityfocus.com/bid/105847