deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0540
Published: 2018-03-22
Description: Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN56764650/index.html; https://jvn.jp/en/jp/JVN56764650/index.html
CVE: CVE-2018-0541
Published: 2018-03-22
Description: Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://jvn.jp/en/jp/JVN92259864/index.html; https://jvn.jp/en/jp/JVN92259864/index.html
CVE: CVE-2018-0542
Published: 2018-03-22
Description: Directory traversal vulnerability in WebProxy version 1.7.8 allows an attacker to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN87226910/index.html; https://jvn.jp/en/jp/JVN87226910/index.html
CVE: CVE-2018-0552
Published: 2018-03-22
Description: Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver. 5.1.26 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN39896275/index.html; https://www.securebrain.co.jp/about/news/2018/03/180314.html; https://jvn.jp/en/jp/JVN39896275/index.html
CVE: CVE-2018-5225
Published: 2018-03-22
Description: In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-59
References: http://www.securityfocus.com/bid/103488; https://confluence.atlassian.com/x/3WNsO; https://jira.atlassian.com/browse/BSERV-10684
CVE: CVE-2017-0932
Published: 2018-03-22
Description: Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation on the input of the Feature functionality. An attacker with access to an operator (read-only) account and ssh connection to the devices could escalate privileges to admin (root) access in the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-security-release-v1-9-7-hotfix-3/ba-p/2054117; https://hackerone.com/reports/239719; https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-security-release-v1-9-7-hotfix-3/ba-p/2054117
CVE: CVE-2017-0933
Published: 2018-03-22
Description: Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-only) account could lure an admin (root) user to access the attacker-controlled page, allowing the attacker to gain admin privileges in the system.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352, CWE-352
References: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-9-1-1/ba-p/1910524; https://hackerone.com/reports/240098; https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-9-1-1/ba-p/1910524
CVE: CVE-2017-0934
Published: 2018-03-22
Description: Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-9-1-1/ba-p/1910524; https://hackerone.com/reports/241044; https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-9-1-1/ba-p/1910524
CVE: CVE-2017-0935
Published: 2018-03-22
Description: Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-security-release-v1-9-7-hotfix-3/ba-p/2054117; https://hackerone.com/reports/242407; https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-security-release-v1-9-7-hotfix-3/ba-p/2054117
CVE: CVE-2017-16771
Published: 2018-03-22
Description: Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/en-global/support/security/Synology_SA_18_02; https://www.synology.com/en-global/support/security/Synology_SA_18_02
CVE: CVE-2017-16772
Published: 2018-03-22
Description: Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to execute arbitrary codes via the prog_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-20
References: https://www.synology.com/en-global/support/security/Synology_SA_18_02; https://www.synology.com/en-global/support/security/Synology_SA_18_02
CVE: CVE-2018-8930
Published: 2018-03-22
Description: The AMD EPYC Server, Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient enforcement of Hardware Validated Boot, aka MASTERKEY-1, MASTERKEY-2, and MASTERKEY-3.
CVSS Score: 9.0 (CRITICAL)
References: https://amdflaws.com/; https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/; https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
CVE: CVE-2018-8931
Published: 2018-03-22
Description: The AMD Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-1.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-732
References: https://amdflaws.com/; https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/; https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
CVE: CVE-2018-8932
Published: 2018-03-22
Description: The AMD Ryzen and Ryzen Pro processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-2, RYZENFALL-3, and RYZENFALL-4.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-732
References: https://amdflaws.com/; https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/; https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
CVE: CVE-2018-8933
Published: 2018-03-22
Description: The AMD EPYC Server processor chips have insufficient access control for protected memory regions, aka FALLOUT-1, FALLOUT-2, and FALLOUT-3.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-732
References: https://amdflaws.com/; https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/; https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
CVE: CVE-2018-8934
Published: 2018-03-22
Description: The Promontory chipset, as used in AMD Ryzen and Ryzen Pro platforms, has a backdoor in firmware, aka CHIMERA-FW.
CVSS Score: 9.0 (CRITICAL)
References: https://amdflaws.com/; https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/; https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
CVE: CVE-2018-8935
Published: 2018-03-22
Description: The Promontory chipset, as used in AMD Ryzen and Ryzen Pro platforms, has a backdoor in the ASIC, aka CHIMERA-HW.
CVSS Score: 9.0 (CRITICAL)
References: https://amdflaws.com/; https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/; https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
CVE: CVE-2018-8936
Published: 2018-03-22
Description: The AMD EPYC Server, Ryzen, Ryzen Pro, and Ryzen Mobile processor chips allow Platform Security Processor (PSP) privilege escalation.
CVSS Score: 9.0 (CRITICAL)
References: https://amdflaws.com/; https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/; https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
CVE: CVE-2017-0920
Published: 2018-03-22
Description: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-863
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/301336; https://www.debian.org/security/2018/dsa-4206
CVE: CVE-2017-16242
Published: 2018-03-22
Description: An issue was discovered on MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 devices. The fingerprint authentication requirement for data access can be bypassed. An attacker with physical access can send a static packet to a serial port exposed on the PCB to unlock the key and get access to the data without possessing the required fingerprint.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://gist.github.com/audebert/ef6e206a27ededd1386cff48604e9335; https://www.blackhat.com/docs/us-17/thursday/us-17-Picod-Attacking-Encrypted-USB-Keys-The-Hard%28ware%29-Way.pdf; https://www.blackhat.com/us-17/briefings/schedule/index.html#attacking-encrypted-usb-keys-the-hardware-way-7443
CVE: CVE-2018-5349
Published: 2018-03-22
Description: A vulnerability has been found in Heimdal PRO v2.2.190, but it is most likely also present in Heimdal FREE and Heimdal CORP. Faulty permissions on the directory "C:\ProgramData\Heimdal Security\Heimdal Agent" allow BUILTIN\Users to write new files to the directory. On startup, the process Heimdal.MonitorServices.exe running as SYSTEM will attempt to load version.dll from this directory. Placing a malicious version.dll in this directory will result in privilege escalation. NOTE: any affected Heimdal products are completely unrelated to the Heimdal vendor of a Kerberos 5 product on the h5l.org web site.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://improsec.com/blog/heimdal-advisory-1; https://improsec.com/blog/heimdal-advisory-1
CVE: CVE-2018-5731
Published: 2018-03-22
Description: An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is possible for an attacker to create the file first, let md.hs overwrite it, and then rewrite the file in the window between md.hs closing the file and executing it. This can be exploited via opportunistic locks and a high priority thread. The vulnerability is triggered when a scan starts. NOTE: any affected Heimdal products are completely unrelated to the Heimdal vendor of a Kerberos 5 product on the h5l.org web site.
CVSS Score: 7.0 (HIGH)
CWE: CWE-20
References: https://improsec.com/blog/heimdal-advisory-2; https://improsec.com/blog/heimdal-advisory-2
CVE: CVE-2018-1208
Published: 2018-03-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-1209
Published: 2018-03-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-1210
Published: 2018-03-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-5502
Published: 2018-03-22
Description: On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by default in Client SSL profile. There is no control plane exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.securitytracker.com/id/1040561; https://support.f5.com/csp/article/K43121447; http://www.securitytracker.com/id/1040561
CVE: CVE-2018-5503
Published: 2018-03-22
Description: On F5 BIG-IP versions 13.0.0 - 13.1.0.3 or 12.0.0 - 12.1.3.1, TMM may restart when processing a specifically crafted page through a virtual server with an associated PEM policy that has content insertion as an action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1040560; https://support.f5.com/csp/article/K54562183; http://www.securitytracker.com/id/1040560
CVE: CVE-2018-5504
Published: 2018-03-22
Description: In some circumstances, the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses, which allows remote attackers to cause a denial-of-service (DoS) or possible remote code execution on the F5 BIG-IP system running versions 13.0.0 - 13.1.0.3 or 12.1.0 - 12.1.3.1.
CVSS Score: 8.1 (HIGH)
References: http://www.securitytracker.com/id/1040558; https://support.f5.com/csp/article/K11718033; http://www.securitytracker.com/id/1040558
CVE: CVE-2018-5505
Published: 2018-03-22
Description: On F5 BIG-IP versions 13.1.0 - 13.1.0.3, when ASM and AVR are both provisioned, TMM may restart while processing DNS requests when the virtual server is configured with a DNS profile and the Protocol setting is set to TCP.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/103505; http://www.securitytracker.com/id/1040559; https://support.f5.com/csp/article/K23520761
CVE: CVE-2018-5509
Published: 2018-03-22
Description: On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, TMM will crash and take the configured failover action, potentially causing a denial of service. The configuration which exposes this issue is not common and in general does not work when enabled in previous versions of BIG-IP. Starting in 12.1.0, BIG-IP will crash if the configuration which exposes this issue is enabled and the virtual server receives non TCP traffic. With the fix of this issue, additional configuration validation logic has been added to prevent this configuration from being applied to a virtual server. There is only data plane exposure to this issue with a non-standard configuration. There is no control plane exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103504; http://www.securitytracker.com/id/1040562; https://support.f5.com/csp/article/K49440608
CVE: CVE-2018-7512
Published: 2018-03-22
Description: A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow remote code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103474; https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01; http://www.securityfocus.com/bid/103474
CVE: CVE-2018-7516
Published: 2018-03-22
Description: A server-side request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which could lead to proxied network scans.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918, CWE-918
References: http://www.securityfocus.com/bid/103474; https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01; http://www.securityfocus.com/bid/103474
CVE: CVE-2018-7520
Published: 2018-03-22
Description: An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which could allow a full configuration download, including passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/103474; https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01; http://www.securityfocus.com/bid/103474
CVE: CVE-2018-7524
Published: 2018-03-22
Description: A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow an unauthorized user to be added to the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/103474; https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01; http://www.securityfocus.com/bid/103474
CVE: CVE-2018-7528
Published: 2018-03-22
Description: An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow an attacker to alter stored data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/103474; https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01; http://www.securityfocus.com/bid/103474
CVE: CVE-2018-7532
Published: 2018-03-22
Description: Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/103474; https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01; https://randorisec.fr/0day-anonymous-rce-on-geutebruck-ip-cameras-again/
CVE: CVE-2017-18242
Published: 2018-03-22
Description: The apply_dependent_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.libav.org/show_bug.cgi?id=1093; https://bugzilla.libav.org/show_bug.cgi?id=1093
CVE: CVE-2017-18243
Published: 2018-03-22
Description: The unpack_parse_unit function in libavcodec/dirac_parser.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.libav.org/show_bug.cgi?id=1088; https://bugzilla.libav.org/show_bug.cgi?id=1088
CVE: CVE-2017-18244
Published: 2018-03-22
Description: The stereo_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file, related to ff_ps_apply.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.libav.org/show_bug.cgi?id=1105; https://bugzilla.libav.org/show_bug.cgi?id=1105
CVE: CVE-2018-8903
Published: 2018-03-22
Description: Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html; https://www.exploit-db.com/exploits/44354/; https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html
CVE: CVE-2018-8942
Published: 2018-03-22
Description: Xiuno BBS 4.0.0 has XSS in the adminpage sitename parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.seebug.org/vuldb/ssvid-97103; https://www.seebug.org/vuldb/ssvid-97103
CVE: CVE-2018-8943
Published: 2018-03-22
Description: There is a SQL injection in the PHPSHE 1.6 userbank parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.seebug.org/vuldb/ssvid-97123; https://www.seebug.org/vuldb/ssvid-97123
CVE: CVE-2018-8944
Published: 2018-03-22
Description: PHPOK 4.8.338 has an arbitrary file upload vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.seebug.org/vuldb/ssvid-97155; https://www.seebug.org/vuldb/ssvid-97155
CVE: CVE-2018-8945
Published: 2018-03-22
Description: The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; https://access.redhat.com/errata/RHBA-2019:0327
CVE: CVE-2018-1207
Published: 2018-03-23
Description: Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20485410; http://www.securityfocus.com/bid/103694; https://twitter.com/nicowaisman/status/[PII_REDACTED]92466432
CVE: CVE-2018-1211
Published: 2018-03-23
Description: Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be used to obtain specific sensitive data without authentication. A remote unauthenticated attacker may be able to read configuration settings from the iDRAC by querying specific URI strings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20485410; http://en.community.dell.com/techcenter/extras/m/white_papers/20485410
CVE: CVE-2017-17736
Published: 2018-03-23
Description: Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425
References: https://blog.hivint.com/advisory-access-control-bypass-in-kentico-cms-cve-2017-17736-49e1e43ae55b; https://blog.hivint.com/advisory-access-control-bypass-in-kentico-cms-cve-2017-17736-49e1e43ae55b
CVE: CVE-2017-15325
Published: 2018-03-23
Description: The Bdat driver of Prague smart phones with software versions earlier than Prague-AL00AC00B211, versions earlier than Prague-AL00BC00B211, versions earlier than Prague-AL00CC00B211, versions earlier than Prague-TL00AC01B211, versions earlier than Prague-TL10AC01B211 has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and execute it as a specific privilege; the APP can then send a specific parameter to the driver of the smart phone, causing arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180321-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180321-01-smartphone-en