deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-4925
Published: 2018-05-19
Description: Adobe Digital Editions versions 4.5.7 and below have an exploitable Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-200
References: http://www.securityfocus.com/bid/103712; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-13.html; http://www.securityfocus.com/bid/103712
CVE: CVE-2018-4926
Published: 2018-05-19
Description: Adobe Digital Editions versions 4.5.7 and below have an exploitable Stack Overflow vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103712; https://helpx.adobe.com/security/products/Digital-Editions/apsb18-13.html; http://www.securityfocus.com/bid/103712
CVE: CVE-2018-4927
Published: 2018-05-19
Description: Adobe InDesign versions 13.0 and below have an exploitable Untrusted Search Path vulnerability. Successful exploitation could lead to local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/103716; https://helpx.adobe.com/security/products/indesign/apsb18-11.html; http://www.securityfocus.com/bid/103716
CVE: CVE-2018-4928
Published: 2018-05-19
Description: Adobe InDesign versions 13.0 and below have an exploitable Memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103714; https://helpx.adobe.com/security/products/indesign/apsb18-11.html; http://www.securityfocus.com/bid/103714
CVE: CVE-2018-4929
Published: 2018-05-19
Description: Adobe Experience Manager versions 6.2 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103707; https://helpx.adobe.com/security/products/experience-manager/apsb18-10.html; http://www.securityfocus.com/bid/103707
CVE: CVE-2018-4930
Published: 2018-05-19
Description: Adobe Experience Manager versions 6.3 and earlier have an exploitable Cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103706; https://helpx.adobe.com/security/products/experience-manager/apsb18-10.html; http://www.securityfocus.com/bid/103706
CVE: CVE-2018-4931
Published: 2018-05-19
Description: Adobe Experience Manager versions 6.1 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103709; https://helpx.adobe.com/security/products/experience-manager/apsb18-10.html; http://www.securityfocus.com/bid/103709
CVE: CVE-2018-4932
Published: 2018-05-19
Description: Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Use-After-Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103708; http://www.securitytracker.com/id/1040648; https://access.redhat.com/errata/RHSA-2018:1119
CVE: CVE-2018-4933
Published: 2018-05-19
Description: Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/103708; http://www.securitytracker.com/id/1040648; https://access.redhat.com/errata/RHSA-2018:1119
CVE: CVE-2018-4934
Published: 2018-05-19
Description: Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/103708; http://www.securitytracker.com/id/1040648; https://access.redhat.com/errata/RHSA-2018:1119
CVE: CVE-2018-4935
Published: 2018-05-19
Description: Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103708; http://www.securitytracker.com/id/1040648; https://access.redhat.com/errata/RHSA-2018:1119
CVE: CVE-2018-4936
Published: 2018-05-19
Description: Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103708; http://www.securitytracker.com/id/1040648; https://access.redhat.com/errata/RHSA-2018:1119
CVE: CVE-2018-4937
Published: 2018-05-19
Description: Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103708; http://www.securitytracker.com/id/1040648; https://access.redhat.com/errata/RHSA-2018:1119
CVE: CVE-2018-4938
Published: 2018-05-19
Description: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability. Successful exploitation could lead to local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: http://www.securityfocus.com/bid/103718; https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html; http://www.securityfocus.com/bid/103718
CVE: CVE-2018-4939
Published: 2018-05-19
Description: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/103718; https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html; http://www.securityfocus.com/bid/103718
CVE: CVE-2018-4940
Published: 2018-05-19
Description: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103718; https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html; http://www.securityfocus.com/bid/103718
CVE: CVE-2018-4941
Published: 2018-05-19
Description: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103718; https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html; http://www.securityfocus.com/bid/103718
CVE: CVE-2018-4942
Published: 2018-05-19
Description: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/103718; https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html; http://www.securityfocus.com/bid/103718
CVE: CVE-2018-4943
Published: 2018-05-19
Description: Adobe PhoneGap Push Plugin versions 1.8.0 and earlier have an exploitable Same-Origin Method Execution vulnerability. Successful exploitation could lead to JavaScript code execution in the context of the PhoneGap app.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103710; https://helpx.adobe.com/security/products/phonegap/apsb18-15.html; http://www.securityfocus.com/bid/103710
CVE: CVE-2018-4944
Published: 2018-05-19
Description: Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-704
References: http://www.securityfocus.com/bid/104101; http://www.securitytracker.com/id/1040840; https://access.redhat.com/errata/RHSA-2018:1367
CVE: CVE-2018-4991
Published: 2018-05-19
Description: Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper certificate validation vulnerability. Successful exploitation could lead to a security bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: http://www.securityfocus.com/bid/104103; http://www.securitytracker.com/id/1040860; https://helpx.adobe.com/security/products/creative-cloud/apsb18-12.html
CVE: CVE-2018-4992
Published: 2018-05-19
Description: Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper input validation vulnerability. Successful exploitation could lead to local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104103; http://www.securitytracker.com/id/1040860; https://helpx.adobe.com/security/products/creative-cloud/apsb18-12.html
CVE: CVE-2018-4994
Published: 2018-05-19
Description: Adobe Connect versions 9.7.5 and earlier have an exploitable Authentication Bypass vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/104102; http://www.securitytracker.com/id/1040845; http://www.securitytracker.com/id/1041264
CVE: CVE-2018-11239
Published: 2018-05-19
Description: An integer overflow in the _transfer function of a smart contract implementation for Hexagon (HXG), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a _to argument in conjunction with a large _value argument, as exploited in the wild in May 2018, aka the "burnOverflow" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://peckshield.com/2018/05/18/burnOverflow/; https://peckshield.com/2018/05/18/burnOverflow/
CVE: CVE-2018-11315
Published: 2018-05-20
Description: The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat t_heat request that accesses a device purchased in the Spring of 2018, and sets a home's target temperature to 95 degrees Fahrenheit. This vulnerability might be described as an addendum to CVE-2013-4860.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/brannondorsey/radio-thermostat; https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325; https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability
CVE: CVE-2018-11242
Published: 2018-05-20
Description: An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://gist.github.com/NinjaXshell/ba0aeee4b77b4bdea76d0c0c095d53b1; https://www.exploit-db.com/exploits/44690/; https://gist.github.com/NinjaXshell/ba0aeee4b77b4bdea76d0c0c095d53b1
CVE: CVE-2018-11319
Published: 2018-05-20
Description: Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://bugs.debian.org/894736; https://github.com/vim-syntastic/syntastic/commit/6d7c0b394e001233dd09ec473fbea2002c72632f; https://github.com/vim-syntastic/syntastic/issues/2170
CVE: CVE-2018-11311
Published: 2018-05-20
Description: A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server on port 2121, and upload files or list directories, by entering these credentials.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://emreovunc.com/blog/en/mySCADA-myPRO7-Exploit.pdf; https://github.com/EmreOvunc/mySCADA-myPRO-7-Hardcoded-FTP-Username-and-Password; https://www.exploit-db.com/exploits/44656/
CVE: CVE-2018-8142
Published: 2018-05-21
Description: A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1035.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/103962; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8142; http://www.securityfocus.com/bid/103962
CVE: CVE-2018-11092
Published: 2018-05-21
Description: An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://community.mybb.com/mods.php?action=changelog&pid=1106; https://github.com/vintagedaddyo/MyBB_Plugin-adminnotes/commit/3deae701cdd89753cb6688302aee5b93a72bc58b?diff=split; https://www.exploit-db.com/exploits/44624/
CVE: CVE-2018-11096
Published: 2018-05-21
Description: Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/44628/; https://www.exploit-db.com/exploits/44628/
CVE: CVE-2018-11320
Published: 2018-05-21
Description: In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: https://github.com/OctopusDeploy/Issues/issues/4578; https://github.com/OctopusDeploy/Issues/issues/4578
CVE: CVE-2018-7268
Published: 2018-05-21
Description: MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerability in which a local unprivileged user is able to read any root (uid 0) owned file on the system, regardless of the file permissions. Confidential information such as password hashes (/etc/shadow) or other secrets (such as log files or private keys) can be leaked to the attacker. The vulnerability has a confidentiality impact, but has no direct impact on system integrity or availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/147687/MagniComp-SysInfo-Information-Exposure.html; http://www.securityfocus.com/archive/1/542024/100/0/threaded; https://sintonen.fi/advisories/magnicomp-sysinfo-information-exposure.txt
CVE: CVE-2018-1067
Published: 2018-05-21
Description: In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-113, CWE-113
References: https://access.redhat.com/errata/RHSA-2018:1247; https://access.redhat.com/errata/RHSA-2018:1248; https://access.redhat.com/errata/RHSA-2018:1249
CVE: CVE-2018-8010
Published: 2018-05-21
Description: This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. Users are advised to upgrade to either Solr 6.6.4 or Solr 7.3.1 releases both of which address the vulnerability. Once upgrade is complete, no other steps are required. Those releases only allow external entities and Xincludes that refer to local files / zookeeper resources below the Solr instance directory (using Solr's ResourceLoader); usage of absolute URLs is denied. Keep in mind, that external entities and XInclude are explicitly supported to better structure config files in large installations. Before Solr 6 this was no problem, as config files were not accessible through the APIs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/104239; https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E; https://mail-archives.apache.org/mod_mbox/www-announce/201805.mbox/%3C08a801d3f0f9%24df46d300%249dd47900%24%40apache.org%3E
CVE: CVE-2018-8012
Published: 2018-05-21
Description: No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/104253; http://www.securitytracker.com/id/1040948; https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f[PII_REDACTED]b74d1e4272%40%3Cissues.activemq.apache.org%3E
CVE: CVE-2018-7687
Published: 2018-05-21
Description: The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.novell.com/show_bug.cgi?id=1093607; https://www.novell.com/support/kb/doc.php?id=7022983; https://bugzilla.novell.com/show_bug.cgi?id=1093607
CVE: CVE-2018-1108
Published: 2018-05-21
Description: kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-330, CWE-330
References: http://www.securityfocus.com/bid/104055; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1108; https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
CVE: CVE-2018-11330
Published: 2018-05-21
Description: An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e; https://github.com/pluck-cms/pluck/issues/58; https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e
CVE: CVE-2018-11331
Published: 2018-05-21
Description: An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e; https://github.com/pluck-cms/pluck/issues/58; https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e
CVE: CVE-2017-2607
Published: 2018-05-21
Description: jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users, or users with SCM access, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/95963; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2607; http://www.securityfocus.com/bid/95963
CVE: CVE-2018-11339
Published: 2018-05-22
Description: An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://discuss.erpnext.com/t/stored-xss-in-erpnext-demo-website/36587; https://github.com/frappe/frappe/issues/5546; https://www.exploit-db.com/exploits/44691/
CVE: CVE-2018-11340
Published: 2018-05-22
Description: An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://seclists.org/fulldisclosure/2018/May/2; https://github.com/mefulton/asustorexploit; https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation
CVE: CVE-2018-11341
Published: 2018-05-22
Description: Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/May/2; https://github.com/mefulton/asustorexploit; https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation
CVE: CVE-2018-11342
Published: 2018-05-22
Description: A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the dest_folder parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/May/2; https://github.com/mefulton/asustorexploit; https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation
CVE: CVE-2018-11343
Published: 2018-05-22
Description: A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross site scripting payloads via the 'playlist' POST parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2018/May/2; https://github.com/mefulton/asustorexploit; https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation
CVE: CVE-2018-11344
Published: 2018-05-22
Description: A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/May/2; https://github.com/mefulton/asustorexploit; https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation