deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-3093
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3094
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3095
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3096
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3097
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3098
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3099
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2018-3100
Published: 2018-07-18
Description: Vulnerability in the Oracle Business Process Management Suite component of Oracle Fusion Middleware (subcomponent: Process Analysis & Discovery). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS Score: 9.1 (CRITICAL)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104813; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3101
Published: 2018-07-18
Description: Vulnerability in the Oracle WebCenter Portal component of Oracle Fusion Middleware (subcomponent: Portlet Services). Supported versions that are affected are 11.1.1.9.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104820; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3102
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2018-3103
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2018-3104
Published: 2018-07-18
Description: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104762; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2018-3105
Published: 2018-07-18
Description: Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Health Care FastPath). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle SOA Suite accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104821; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2017-18103
Published: 2018-07-18
Description: The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Browser through uploaded files that have a content-type of application/mathml+xml.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: https://jira.atlassian.com/browse/HTTP-3; https://jira.atlassian.com/browse/HTTP-3
CVE: CVE-2018-5232
Published: 2018-07-18
Description: The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuetype parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-67410; https://jira.atlassian.com/browse/JRASERVER-67410
CVE: CVE-2018-8011
Published: 2018-07-18
Description: By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securitytracker.com/id/1041401; https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011; https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
CVE: CVE-2018-10616
Published: 2018-07-18
Description: ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://search-ext.abb.com/library/Download.aspx?DocumentID=3BSE092089&Action=Launch; http://www.securityfocus.com/bid/104882; https://ics-cert.us-cert.gov/advisories/ICSA-18-198-01
CVE: CVE-2018-10877
Published: 2018-07-18
Description: Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.
CVSS Score: 7.3 (HIGH)
CWE: CWE-125, CWE-125
References: http://www.securityfocus.com/bid/104878; http://www.securityfocus.com/bid/106503; https://access.redhat.com/errata/RHSA-2018:2948
CVE: CVE-2018-14380
Published: 2018-07-18
Description: In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Graylog2/graylog2-server/pull/4904; https://www.graylog.org/post/announcing-the-release-of-graylog-2-4-6; https://github.com/Graylog2/graylog2-server/pull/4904
CVE: CVE-2018-14381
Published: 2018-07-18
Description: Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/pagekit/pagekit/issues/905; https://github.com/pagekit/pagekit/releases/tag/1.0.14; https://github.com/pagekit/pagekit/issues/905
CVE: CVE-2018-14382
Published: 2018-07-18
Description: InstantCMS 2.10.1 has /redirect?url= XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/instantsoft/icms2/issues/892; https://github.com/instantsoft/icms2/issues/892
CVE: CVE-2018-8042
Published: 2018-07-18
Description: Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie.
CVSS Score: 8.1 (HIGH)
CWE: CWE-209
References: http://www.securityfocus.com/bid/104869; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-CVE-2018-8042; http://www.securityfocus.com/bid/104869
CVE: CVE-2018-12429
Published: 2018-07-18
Description: JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.03sec.com/3218.shtml; http://www.03sec.com/3218.shtml
CVE: CVE-2018-14082
Published: 2018-07-18
Description: PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gkaim.com/cve-2018-14082-vikas-chaudhary/; https://www.exploit-db.com/exploits/45141/; https://gkaim.com/cve-2018-14082-vikas-chaudhary/
CVE: CVE-2018-7546
Published: 2018-07-18
Description: wpsmain.dll in Kingsoft WPS Office 2016 and Jinshan PDF 10.1.0.6621 allows remote attackers to cause a denial of service via a crafted pdf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.cnvd.org.cn/flaw/show/CNVD-2018-04657; http://www.cnvd.org.cn/flaw/show/CNVD-2018-04657
CVE: CVE-2018-14364
Published: 2018-07-18
Description: GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab projects import component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/49133; https://hackerone.com/reports/378148
CVE: CVE-2018-14387
Published: 2018-07-18
Description: An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The attacker then causes the victim to authenticate against the server using the same session identifier. The attacker can access the user's account through the active session. The Session Fixation attack fixes a session on the victim's browser, so the attack starts before the user logs in.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://github.com/robiso/wondercms/issues/64; https://www.wondercms.com/whatsnew; https://github.com/robiso/wondercms/issues/64
CVE: CVE-2018-14388
Published: 2018-07-18
Description: joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/joyplus/joyplus-cms/issues/429; https://github.com/joyplus/joyplus-cms/issues/429
CVE: CVE-2018-14389
Published: 2018-07-18
Description: joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/joyplus/joyplus-cms/issues/430; https://github.com/joyplus/joyplus-cms/issues/430