deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-1444
Published: 2018-03-14
Description: IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139906.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1040475; https://exchange.xforce.ibmcloud.com/vulnerabilities/139906; https://www.ibm.com/support/docview.wss?uid=swg22014392
CVE: CVE-2018-8096
Published: 2018-03-14
Description: Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":false' in an api/settings/setting-isauthenticationenabled PUT request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/datalust/seq-tickets/issues/675; https://medium.com/stolabs/bypass-admin-authentication-on-seq-17f0f9e02732; https://www.exploit-db.com/exploits/45136/
CVE: CVE-2018-8098
Published: 2018-03-14
Description: Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900c1; https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bcac0; https://libgit2.github.com/security/
CVE: CVE-2018-8099
Published: 2018-03-14
Description: Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/libgit2/libgit2/commit/58a6fe94cb851f71214dbefac3f9bffee437d6fe; https://libgit2.github.com/security/; https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html
CVE: CVE-2017-18229
Published: 2018-03-14
Description: An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/752c0b41fa32; https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
CVE: CVE-2017-18230
Published: 2018-03-14
Description: An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadCINEONImage in coders/cineon.c, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/53a4d841e90f; https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
CVE: CVE-2017-18231
Published: 2018-03-14
Description: An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadEnhMetaFile in coders/emf.c, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/ea074081678b; https://lists.debian.org/debian-lts-announce/2018/03/msg00025.html; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
CVE: CVE-2018-8100
Published: 2018-03-14
Description: The JPXStream::readTilePart function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a specific pdf file, as demonstrated by pdftohtml.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=652; https://forum.xpdfreader.com/viewtopic.php?f=3&t=652
CVE: CVE-2018-8101
Published: 2018-03-14
Description: The JPXStream::inverseTransformLevel function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=652; https://forum.xpdfreader.com/viewtopic.php?f=3&t=652
CVE: CVE-2018-8102
Published: 2018-03-14
Description: The JBIG2MMRDecoder::getBlackCode function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=652; https://forum.xpdfreader.com/viewtopic.php?f=3&t=652
CVE: CVE-2018-8103
Published: 2018-03-14
Description: The JBIG2Stream::readGenericBitmap function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=652; https://forum.xpdfreader.com/viewtopic.php?f=3&t=652
CVE: CVE-2018-8104
Published: 2018-03-14
Description: The BufStream::lookChar function in Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=652; https://forum.xpdfreader.com/viewtopic.php?f=3&t=652
CVE: CVE-2018-8105
Published: 2018-03-14
Description: The JPXStream::fillReadBuf function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=652; https://forum.xpdfreader.com/viewtopic.php?f=3&t=652
CVE: CVE-2018-8106
Published: 2018-03-14
Description: The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=652; https://forum.xpdfreader.com/viewtopic.php?f=3&t=652
CVE: CVE-2018-8107
Published: 2018-03-14
Description: The JPXStream::close function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=652; https://forum.xpdfreader.com/viewtopic.php?f=3&t=652
CVE: CVE-2018-8097
Published: 2018-03-14
Description: io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/pyeve/eve/commit/f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98; https://github.com/pyeve/eve/issues/1101; https://github.com/pyeve/eve/commit/f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98
CVE: CVE-2018-8108
Published: 2018-03-14
Description: The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zlgxzswjy/BUI-select-xss; https://github.com/zlgxzswjy/BUI-select-xss
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-14
Description: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2018:2669; https://access.redhat.com/errata/RHSA-2018:3817; https://github.com/rhuss/jolokia/commit/5895d5c137c335e6b473e9dcb9baf748851bbc5f#diff-f19898247eddb55de6400489bff748ad
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-14
Description: A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://access.redhat.com/errata/RHSA-2018:2669; https://jolokia.org/#Security_fixes_with_1.5.0; https://access.redhat.com/errata/RHSA-2018:2669
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-14
Description: Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/00theway/exp/blob/master/wordpress/wpsupportplus.md; https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers; https://wpvulndb.com/vulnerabilities/9041
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-14
Description: Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732
References: https://access.redhat.com/errata/RHSA-2019:2276; https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html; https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
CVE: CVE-2018-6875
Published: 2018-03-14
Description: Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger information display (of information that should not be accessible), related to text containing characters that the device's font lacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: https://www.keepkey.com/2018/03/09/security-updates-responsible-disclosure/; https://www.keepkey.com/2018/03/09/security-updates-responsible-disclosure/
CVE: CVE-2018-7279
Published: 2018-03-14
Description: A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1.
CVSS Score: 9.8 (CRITICAL)
References: https://www.alienvault.com/forums/discussion/17155/alienvault-v5-5-1-hotfix-important-update; https://www.alienvault.com/forums/discussion/17204/security-advisory-alienvault-v5-5-1-resolves-critical-vulnerability; https://www.alienvault.com/forums/discussion/17155/alienvault-v5-5-1-hotfix-important-update
CVE: CVE-2018-7474
Published: 2018-03-14
Description: An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2018/Mar/34; https://www.exploit-db.com/exploits/44277/; http://seclists.org/fulldisclosure/2018/Mar/34
CVE: CVE-2018-7677
Published: 2018-03-14
Description: A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: http://www.securityfocus.com/bid/103420; https://www.netiq.com/support/kb/doc.php?id=7022725; http://www.securityfocus.com/bid/103420
CVE: CVE-2018-7678
Published: 2018-03-14
Description: A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103421; https://www.netiq.com/support/kb/doc.php?id=7022724; http://www.securityfocus.com/bid/103421
CVE: CVE-2018-5779
Published: 2018-03-14
Description: A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to copy a malicious script into a newly generated PHP file and then execute the generated file using specially crafted requests. Successful exploit could allow an attacker to execute arbitrary code within the context of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004
CVE: CVE-2018-5780
Published: 2018-03-14
Description: A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using specially crafted requests to the vnewmeeting.php page. Successful exploit could allow an attacker to execute arbitrary PHP code within the context of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004
CVE: CVE-2018-5781
Published: 2018-03-14
Description: A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using specially crafted requests to the vendrecording.php page. Successful exploit could allow an attacker to execute arbitrary PHP code within the context of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004
CVE: CVE-2018-5782
Published: 2018-03-14
Description: A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using specially crafted requests to the vsethost.php page. Successful exploit could allow an attacker to execute arbitrary PHP code within the context of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/twosevenzero/shoretel-mitel-rce; https://www.exploit-db.com/exploits/46174/; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004
CVE: CVE-2018-0787
Published: 2018-03-14
Description: ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".
CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: http://www.securityfocus.com/bid/103282; http://www.securitytracker.com/id/1040525; https://github.com/aspnet/Announcements/issues/295
CVE: CVE-2018-0808
Published: 2018-03-14
Description: ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0784.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103226; http://www.securitytracker.com/id/1040504; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0808
CVE: CVE-2018-0811
Published: 2018-03-14
Description: The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way objects are initialized in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0813, CVE-2018-0814, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, CVE-2018-0901 and CVE-2018-0926.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: http://www.securityfocus.com/bid/103232; http://www.securitytracker.com/id/1040517; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0811
CVE: CVE-2018-0813
Published: 2018-03-14
Description: The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way objects are initialized in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0811, CVE-2018-0814, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, and CVE-2018-0901 and CVE-2018-0926.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: http://www.securityfocus.com/bid/103250; http://www.securitytracker.com/id/1040517; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0813
CVE: CVE-2018-0814
Published: 2018-03-14
Description: The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way objects are initialized in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0811, CVE-2018-0813, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, and CVE-2018-0901 and CVE-2018-0926.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: http://www.securityfocus.com/bid/103251; http://www.securitytracker.com/id/1040517; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0814
CVE: CVE-2018-0815
Published: 2018-03-14
Description: The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows GDI Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0816, and CVE-2018-0817.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/103234; http://www.securitytracker.com/id/1040515; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0815
CVE: CVE-2018-0816
Published: 2018-03-14
Description: The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows GDI Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0815 and CVE-2018-0817.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/103248; http://www.securitytracker.com/id/1040515; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0816
CVE: CVE-2018-0817
Published: 2018-03-14
Description: The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows GDI Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0815 and CVE-2018-0816.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/103249; http://www.securitytracker.com/id/1040515; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0817
CVE: CVE-2018-0868
Published: 2018-03-14
Description: Windows Installer in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how input is sanitized, aka "Windows Installer Elevation of Privilege Vulnerability".
CVSS Score: 7.0 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103236; http://www.securitytracker.com/id/1040520; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0868
CVE: CVE-2018-0872
Published: 2018-03-14
Description: ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103267; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0872
CVE: CVE-2018-0873
Published: 2018-03-14
Description: ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103268; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0873
CVE: CVE-2018-0874
Published: 2018-03-14
Description: ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103269; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0874
CVE: CVE-2018-0875
Published: 2018-03-14
Description: .NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service Vulnerability".
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/103225; http://www.securitytracker.com/id/1040505; https://access.redhat.com/errata/RHSA-2018:0522
CVE: CVE-2018-0876
Published: 2018-03-14
Description: Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0889, CVE-2018-0893, CVE-2018-0925, and CVE-2018-0935.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/103289; http://www.securitytracker.com/id/1040507; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0876