deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5827
Published: 2018-05-17
Description: In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, a buffer overflow vulnerability exists in WLAN while processing an extscan hotlist event.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2018-04-01; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=53e6d889ac29336ba212a0d4a987455a85736fa8; https://source.android.com/security/bulletin/pixel/2018-04-01
CVE: CVE-2018-11232
Published: 2018-05-18
Description: The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f[PII_REDACTED]9584bc4784dfcd85ada67c6f33e0f; https://github.com/torvalds/linux/commit/f[PII_REDACTED]9584bc4784dfcd85ada67c6f33e0f; https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.2
CVE: CVE-2017-9635
Published: 2018-05-18
Description: Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
CVSS Score: 3.9 (LOW)
CWE: CWE-326, CWE-326
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/; http://www.securityfocus.com/bid/99469; https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
CVE: CVE-2017-9637
Published: 2018-05-18
Description: Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-319, CWE-522
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/; http://www.securityfocus.com/bid/99469; https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
CVE: CVE-2018-10306
Published: 2018-05-18
Description: Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow XSS via an invalid date.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ILIAS-eLearning/ILIAS/commit/95870b2db3e71154102b2cd2f05334fc741c6e39; https://github.com/ILIAS-eLearning/ILIAS/commit/eb0272c8023818b1eb10a93e115c9e7960b62a62; https://www.ilias.de/docu/goto_docu_pg_116799_35.html
CVE: CVE-2018-10307
Published: 2018-05-18
Description: error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ILIAS-eLearning/ILIAS/commit/ca982e59d0b76c0374c9a7fd1acf2685ca57cf41; https://www.ilias.de/docu/goto_docu_pg_116799_35.html; https://github.com/ILIAS-eLearning/ILIAS/commit/ca982e59d0b76c0374c9a7fd1acf2685ca57cf41
CVE: CVE-2018-8849
Published: 2018-05-18
Description: Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-311, CWE-311
References: http://www.medtronic.com/content/dam/medtronic-com/us-en/corporate/documents/Medtronic-NVision-8840_Security-Bulletin_FINAL.pdf; http://www.securityfocus.com/bid/104213; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-137-01
CVE: CVE-2018-10967
Published: 2018-05-18
Description: On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject operating system commands that can be executed on the device with higher privileges, aka remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/zeroday/FG-VD-18-060; https://fortiguard.com/zeroday/FG-VD-18-060
CVE: CVE-2018-10968
Published: 2018-05-18
Description: On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to get unauthorized access to vulnerable devices, aka a backdoor access vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://fortiguard.com/zeroday/FG-VD-18-061; https://fortiguard.com/zeroday/FG-VD-18-061
CVE: CVE-2018-9250
Published: 2018-05-18
Description: interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/openemr/openemr/commit/2a5dd0601e1f616251006d7471997ecd7aaf9651; https://github.com/openemr/openemr/pull/1578; https://github.com/openemr/openemr/commit/2a5dd0601e1f616251006d7471997ecd7aaf9651
CVE: CVE-2018-5256
Published: 2018-05-18
Description: CoreOS Tectonic 1.7.x before 1.7.9-tectonic.4 and 1.8.x before 1.8.4-tectonic.3 mounts a direct proxy to the kubernetes cluster at /api/kubernetes/ which is accessible without authentication to Tectonic and allows an attacker to directly connect to the kubernetes API server. Unauthenticated users are able to list all Namespaces through the Console, resulting in an information disclosure. Tectonic's exposure of an unauthenticated API endpoint containing information regarding the internal state of the cluster can provide an attacker with information that may assist in other attacks against the cluster. For example, an attacker may not have the permissions required to list all namespaces in the cluster but can instead leverage this vulnerability to enumerate the namespaces and then begin to check each namespace for weak authorization policies that may allow further escalation of privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://coreos.com/blog/tectonic-namespace-information-disclosure-vulnerability-patched; https://coreos.com/tectonic/releases/#1.8.4-tectonic.3; https://coreos.com/blog/tectonic-namespace-information-disclosure-vulnerability-patched
CVE: CVE-2017-18269
Published: 2018-05-18
Description: An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in corrupt data being produced by the copy operation. This may disclose information to context-dependent attackers, or result in a denial of service, or, possibly, code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/fingolfin/memmove-bug; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-18270
Published: 2018-05-18
Description: In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of service.
CVSS Score: 7.1 (HIGH)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=237bbd29f7a049d310d907f4b2716a7feef9abf3; http://www.securityfocus.com/bid/104254; https://bugzilla.redhat.com/show_bug.cgi?id=1580979
CVE: CVE-2018-11236
Published: 2018-05-18
Description: stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: http://www.securityfocus.com/bid/104255; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3092
CVE: CVE-2018-11237
Published: 2018-05-18
Description: An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104256; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3092
CVE: CVE-2018-11243
Published: 2018-05-18
Description: PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00007.html
CVE: CVE-2018-11244
Published: 2018-05-18
Description: The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor.
CVSS Score: 5.3 (MEDIUM)
References: https://wpvulndb.com/vulnerabilities/9087; https://www.dopewp.com/version-history/; https://wpvulndb.com/vulnerabilities/9087
CVE: CVE-2018-8015
Published: 2018-05-18
Description: In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software that uses the ORC file parser. With the C++ parser, the stack overflow might possibly corrupt the stack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://www.securityfocus.com/bid/104215; https://orc.apache.org/security/CVE-2018-8015/; http://www.securityfocus.com/bid/104215
CVE: CVE-2[PII_REDACTED]
Published: 2018-05-18
Description: Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/104262; https://github.com/kubernetes-incubator/cri-o/pull/1558/files; http://www.securityfocus.com/bid/104262
CVE: CVE-2018-11245
Published: 2018-05-18
Description: app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/5efc07b12f82301a6086fd3433fedd69fe7119d3; https://zigrin.com/advisories/misp-xss-with-cortex-type-attributes/; https://github.com/MISP/MISP/commit/5efc07b12f82301a6086fd3433fedd69fe7119d3
CVE: CVE-2018-11248
Published: 2018-05-18
Description: util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored in an unintended directory because of Directory Traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/lingochamp/FileDownloader/issues/1028; https://github.com/lingochamp/FileDownloader/issues/1028
CVE: CVE-2017-18271
Published: 2018-05-18
Description: In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/ImageMagick/ImageMagick/issues/911; https://lists.debian.org/debian-lts-announce/2018/05/msg00012.html; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-18272
Published: 2018-05-18
Description: In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is mishandled in an MngInfoDiscardObject call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/ImageMagick/ImageMagick/issues/918; https://github.com/ImageMagick/ImageMagick/issues/918
CVE: CVE-2017-18273
Published: 2018-05-18
Description: In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/ImageMagick/ImageMagick/issues/910; https://lists.debian.org/debian-lts-announce/2018/05/msg00012.html; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2018-11251
Published: 2018-05-18
Description: In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/956; https://lists.debian.org/debian-lts-announce/2018/05/msg00012.html; https://lists.debian.org/debian-lts-announce/2018/06/msg00004.html
CVE: CVE-2018-11254
Published: 2018-05-18
Description: An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file, a related issue to CVE-2017-8054.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://bugzilla.redhat.com/show_bug.cgi?id=1576174; https://bugzilla.redhat.com/show_bug.cgi?id=1576174
CVE: CVE-2018-11255
Published: 2018-05-18
Description: An issue was discovered in PoDoFo 0.9.5. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1575502; https://bugzilla.redhat.com/show_bug.cgi?id=1575502
CVE: CVE-2018-11256
Published: 2018-05-18
Description: An issue was discovered in PoDoFo 0.9.5. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1575851; https://bugzilla.redhat.com/show_bug.cgi?id=1575851
CVE: CVE-2018-6562
Published: 2018-05-18
Description: totemomail Encryption Gateway before 6.0_b567 allows remote attackers to obtain sensitive information about user sessions and encryption key material via a JSONP hijacking attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: http://packetstormsecurity.com/files/147637/Totemomail-Encryption-Gateway-6.0.0_Build_371-JSONP-Hijacking.html; http://www.securityfocus.com/archive/1/542016/100/0/threaded; https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-002_totemo_json_hijacking.txt
CVE: CVE-2018-8867
Published: 2018-05-18
Description: In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/104241; https://ics-cert.us-cert.gov/advisories/ICSA-18-137-01; http://www.securityfocus.com/bid/104241
CVE: CVE-2018-1147
Published: 2018-05-18
Description: In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file, which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session. In other scenarios, XSS could also occur by altering variables from the Advanced Settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1040918; https://www.tenable.com/security/tns-2018-05; http://www.securitytracker.com/id/1040918
CVE: CVE-2018-1148
Published: 2018-05-18
Description: In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-384
References: http://www.securitytracker.com/id/1040918; https://www.tenable.com/security/tns-2018-05; http://www.securitytracker.com/id/1040918
CVE: CVE-2017-11240
Published: 2018-05-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]5 and earlier, 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb17-36.html; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2017-11250
Published: 2018-05-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]5 and earlier, 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb17-36.html; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2017-11253
Published: 2018-05-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]5 and earlier, 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb17-36.html; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2017-11306
Published: 2018-05-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]5 and earlier, 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb17-36.html; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2017-11307
Published: 2018-05-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]5 and earlier, 11.0.22 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb17-36.html; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2017-11308
Published: 2018-05-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]6 and earlier, 2[PII_REDACTED]5 and earlier, 11.0.22 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb17-36.html; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2018-4873
Published: 2018-05-19
Description: Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Unquoted Search Path vulnerability. Successful exploitation could lead to local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://www.securityfocus.com/bid/104103; http://www.securitytracker.com/id/1040860; https://helpx.adobe.com/security/products/creative-cloud/apsb18-12.html
CVE: CVE-2018-4917
Published: 2018-05-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]4 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102992; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4918
Published: 2018-05-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]4 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102994; http://www.securitytracker.com/id/1040364; https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
CVE: CVE-2018-4919
Published: 2018-05-19
Description: Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103385; http://www.securitytracker.com/id/1040509; https://access.redhat.com/errata/RHSA-2018:0520
CVE: CVE-2018-4920
Published: 2018-05-19
Description: Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://www.securityfocus.com/bid/103383; http://www.securitytracker.com/id/1040509; https://access.redhat.com/errata/RHSA-2018:0520
CVE: CVE-2018-4921
Published: 2018-05-19
Description: Adobe Connect versions 9.7 and earlier have an exploitable unrestricted SWF file upload vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-434
References: http://www.securityfocus.com/bid/103393; http://www.securitytracker.com/id/1040523; https://helpx.adobe.com/security/products/connect/apsb18-06.html
CVE: CVE-2018-4923
Published: 2018-05-19
Description: Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: http://www.securityfocus.com/bid/103391; http://www.securitytracker.com/id/1040523; https://helpx.adobe.com/security/products/connect/apsb18-06.html
CVE: CVE-2018-4924
Published: 2018-05-19
Description: Adobe Dreamweaver CC versions 18.0 and earlier have an OS Command Injection vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.securityfocus.com/bid/103395; http://www.securitytracker.com/id/1040516; https://helpx.adobe.com/security/products/dreamweaver/apsb18-07.html