deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7937
Published: 2018-09-04
Description: In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into installing it. Successful exploit could allow the attacker to obtain the root permission of the device and take full control over the device.
CVSS Score: 7.8 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180827-01-gateway-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180827-01-gateway-en
CVE: CVE-2018-7938
Published: 2018-09-04
Description: P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number, which may cause sensitive information leak.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180827-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180827-01-smartphone-en
CVE: CVE-2018-7990
Published: 2018-09-04
Description: Mate10 Pro Huawei smart phones with the versions before 8.1.0.326(C00) have a FRP bypass vulnerability. During the mobile phone reseting process, an attacker could bypass "Find My Phone" protect after a series of voice and keyboard operations. Successful exploit could allow an attacker to bypass FRP.
CVSS Score: 4.6 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180831-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180831-01-smartphone-en
CVE: CVE-2018-6554
Published: 2018-09-04
Description: Memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-772
References: http://www.securityfocus.com/bid/105302; https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html; https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
CVE: CVE-2018-6555
Published: 2018-09-04
Description: The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.securityfocus.com/bid/105304; https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html; https://usn.ubuntu.com/3775-1/
CVE: CVE-2018-6923
Published: 2018-09-04
Description: In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to excessive system resource consumption. This issue can allow a remote attacker who is able to send an arbitrary ip fragments to cause the machine to consume excessive resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/105336; http://www.securitytracker.com/id/1041505; https://www.freebsd.org/security/advisories/FreeBSD-SA-18:10.ip.asc
CVE: CVE-2[PII_REDACTED]
Published: 2018-09-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was inadvertently assigned by a different CNA at a time when the discoverer was communicating with the specific "Vendors and Projects" CNA for the product in question
CVE: CVE-2[PII_REDACTED]
Published: 2018-09-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-16391, CVE-2018-16392, CVE-2018-16393, CVE-2018-16418, CVE-2018-16419, CVE-2018-16420, CVE-2018-16421, CVE-2018-16422, CVE-2018-16423, CVE-2018-16424, CVE-2018-16425, CVE-2018-16426, CVE-2018-16427. Reason: This candidate is a duplicate of CVE-2018-16391, CVE-2018-16392, CVE-2018-16393, CVE-2018-16418, CVE-2018-16419, CVE-2018-16420, CVE-2018-16421, CVE-2018-16422, CVE-2018-16423, CVE-2018-16424, CVE-2018-16425, CVE-2018-16426, and CVE-2018-16427. Notes: All CVE users should reference CVE-2018-16391, CVE-2018-16392, CVE-2018-16393, CVE-2018-16418, CVE-2018-16419, CVE-2018-16420, CVE-2018-16421, CVE-2018-16422, CVE-2018-16423, CVE-2018-16424, CVE-2018-16425, CVE-2018-16426, and/or CVE-2018-16427 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-16509
Published: 2018-09-05
Description: An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
CVSS Score: 7.8 (HIGH)
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5516c614dc33662a2afdc377159f70218e67bde5; http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=78911a01b67d590b4a91afac2e8417360b934156; http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=79cccf641486a6595c43f1de1cd7ade696020a31
CVE: CVE-2018-16510
Published: 2018-09-05
Description: An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=ea735ba37dc0fd5f5622d031830b9a559dec1cc9; http://openwall.com/lists/oss-security/2018/08/27/4; https://bugs.ghostscript.com/show_bug.cgi?id=699671
CVE: CVE-2018-16511
Published: 2018-09-05
Description: An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=0edd3d6c634a577db261615a9dc2719bca7f6e01; http://seclists.org/oss-sec/2018/q3/182; https://access.redhat.com/errata/RHSA-2018:3650
CVE: CVE-2018-0502
Published: 2018-09-05
Description: An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://bugs.debian.org/908000; https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html; https://security.gentoo.org/glsa/201903-02
CVE: CVE-2018-13259
Published: 2018-09-05
Description: An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2019:2017; https://bugs.debian.org/908000; https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
CVE: CVE-2018-1353
Published: 2018-09-05
Description: An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settings of vdoms unrelated to the assigned adom.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.com/advisory/FG-IR-18-016; https://fortiguard.com/advisory/FG-IR-18-016
CVE: CVE-2018-16513
Published: 2018-09-05
Description: In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=b326a71659b7837d3acde954b18bda1a6f5e9498; https://bugs.ghostscript.com/show_bug.cgi?id=699655; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101
CVE: CVE-2018-9192
Published: 2018-09-05
Description: A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://fortiguard.com/advisory/FG-IR-17-302; https://robotattack.org/; https://www.kb.cert.org/vuls/id/144389
CVE: CVE-2018-9194
Published: 2018-09-05
Description: A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://fortiguard.com/advisory/FG-IR-17-302; https://robotattack.org/; https://www.kb.cert.org/vuls/id/144389
CVE: CVE-2018-16516
Published: 2018-09-05
Description: helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/flask-admin/flask-admin/pull/1699; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJIYCWIH3BRLI2QNC53CQXLKVP27X7EH/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZU2VKULURVXEU4YFTLMBQGYMPSXQ4MBN/
CVE: CVE-2018-16518
Published: 2018-09-05
Description: A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limited Edition through 6.1 build 2208 allows creation of arbitrary files on a user's workstation using crafted ZED! containers because the watermark loading function can place an executable file into a Startup folder.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/ponypot/cve/blob/master/zed_watermarkExtension.pdf; https://github.com/ponypot/cve/blob/master/zed_watermarkExtension.pdf
CVE: CVE-2018-16521
Published: 2018-09-05
Description: An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/openmrs/openmrs-module-htmlformentry/pull/137; https://github.com/openmrs/openmrs-module-htmlformentry/pull/138; https://github.com/openmrs/openmrs-module-htmlformentry/pull/137
CVE: CVE-2[PII_REDACTED]
Published: 2018-09-05
Description: Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2[PII_REDACTED]; https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe; https://pidgin.im/news/security/?id=91
CVE: CVE-2[PII_REDACTED]
Published: 2018-09-05
Description: NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2016:2101; https://access.redhat.com/errata/RHSA-2017:2912; https://access.redhat.com/security/cve/cve-2[PII_REDACTED]
CVE: CVE-2018-16539
Published: 2018-09-05
Description: In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=a054156d425b4dbdaaa9fda4b5f1182b27598c2b; https://access.redhat.com/errata/RHSA-2018:3650; https://bugs.ghostscript.com/show_bug.cgi?id=699658
CVE: CVE-2018-16540
Published: 2018-09-05
Description: In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=c432131c3fdb2143e148e8ba88555f7f7a63b25e; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2019:0229
CVE: CVE-2018-16541
Published: 2018-09-05
Description: In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=241d91112771a6104de10b3948c3f350d6690c1d; https://access.redhat.com/errata/RHSA-2018:3834; https://bugs.ghostscript.com/show_bug.cgi?id=699664
CVE: CVE-2018-16542
Published: 2018-09-05
Description: In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the interpreter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=b575e1ec42cc86f6a58c603f2a88fcc2af699cc8; http://seclists.org/oss-sec/2018/q3/182; http://www.securityfocus.com/bid/105337
CVE: CVE-2018-16543
Published: 2018-09-05
Description: In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.
CVSS Score: 7.8 (HIGH)
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=5b5536fa88a9e885032bc0df3852c3439399a5c0; https://bugs.ghostscript.com/show_bug.cgi?id=699670; https://lists.debian.org/debian-lts-announce/2018/09/msg00038.html
CVE: CVE-2018-14618
Published: 2018-09-05
Description: curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-131, CWE-190
References: http://www.securitytracker.com/id/1041605; https://access.redhat.com/errata/RHSA-2018:3558; https://access.redhat.com/errata/RHSA-2019:1880
CVE: CVE-2018-16545
Published: 2018-09-05
Description: Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve arbitrary code execution via file impersonation. For example, a malicious dynamic-link library (dll) assumed the identity of a temporary (tmp) file (isxdl.dll) and an executable file assumed the identity of a temporary file (996E.temp).
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/GitHubAssessments/CVE_Assessment_03_2018/blob/master/Kaizen_Report.pdf; https://github.com/GitHubAssessments/CVE_Assessment_03_2018/blob/master/Kaizen_Report.pdf
CVE: CVE-2015-9266
Published: 2018-09-05
Description: The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://community.ubnt.com/t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNT/td-p/1562940; https://community.ubnt.com/t5/airMAX-Updates-Blog/Important-Security-Notice-and-airOS-5-6-5-Release/ba-p/1565949; https://community.ubnt.com/t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOUGHSwitch-and-airGateway-Released/ba-p/1300494
CVE: CVE-2018-16436
Published: 2018-09-05
Description: Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://bbs.gxlcms.com/forum.php?mod=viewthread&tid=787&extra=page%3D1; http://www.ttk7.cn/post-77.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/149624
CVE: CVE-2018-16437
Published: 2018-09-05
Description: Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://bbs.gxlcms.com/forum.php?mod=viewthread&tid=787&extra=page%3D1; http://www.ttk7.cn/post-78.html; http://bbs.gxlcms.com/forum.php?mod=viewthread&tid=787&extra=page%3D1
CVE: CVE-2018-16546
Published: 2018-09-05
Description: Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation, as demonstrated by Amcrest_IPC-HX1X3X-LEXUS_Eng_N_AMCREST_V2.420.AC01.3.R.20180206.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://seclists.org/bugtraq/2018/Sep/6; https://seclists.org/bugtraq/2018/Sep/6
CVE: CVE-2018-14769
Published: 2018-09-05
Description: VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-004-v1.pdf; https://www.vivotek.com/website/support/cybersecurity; http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-004-v1.pdf
CVE: CVE-2018-14770
Published: 2018-09-05
Description: VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service).
CVSS Score: 8.8 (HIGH)
References: http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf; https://www.vivotek.com/website/support/cybersecurity/; http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf
CVE: CVE-2018-14771
Published: 2018-09-05
Description: VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi.
CVSS Score: 8.8 (HIGH)
References: http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf; https://www.vivotek.com/website/support/cybersecurity/; http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf
CVE: CVE-2018-15676
Published: 2018-09-05
Description: An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE: CVE-2018-15677
Published: 2018-09-05
Description: The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://github.com/btiteam/xbtit/pull/58; https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://github.com/btiteam/xbtit/pull/58
CVE: CVE-2018-15678
Published: 2018-09-05
Description: An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/btiteam/xbtit/pull/58; https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://github.com/btiteam/xbtit/pull/58
CVE: CVE-2018-15679
Published: 2018-09-05
Description: An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/btiteam/xbtit/pull/58; https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://github.com/btiteam/xbtit/pull/58
CVE: CVE-2018-15680
Published: 2018-09-05
Description: An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-916
References: https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE: CVE-2018-15681
Published: 2018-09-05
Description: An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie can efficiently brute-force it to retrieve the user's cleartext password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732, CWE-916
References: https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE: CVE-2018-15682
Published: 2018-09-05
Description: An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE: CVE-2018-15683
Published: 2018-09-05
Description: An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user is already logged in when accessing the page, they will be instantly redirected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE: CVE-2018-15684
Published: 2018-09-05
Description: An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (/include/logs) using predictable file names, which can lead to full path disclosure and leakage of sensitive data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://rastating.github.io/xbtit-multiple-vulnerabilities/; https://rastating.github.io/xbtit-multiple-vulnerabilities/
CVE: CVE-2018-15917
Published: 2018-09-05
Description: Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/bbalet/jorani/issues/254; https://hackpuntes.com/cve-2018-15917-jorani-leave-management-system-0-6-5-cross-site-scripting-persistente/; https://www.exploit-db.com/exploits/45338/