deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5270
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e010. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e010; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e010
CVE: CVE-2018-5271
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e008. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102471; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e008; http://www.securityfocus.com/bid/102471
CVE: CVE-2018-5272
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e004. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e004; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e004
CVE: CVE-2018-5273
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e014. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e014; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e014
CVE: CVE-2018-5274
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40E024. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9C40E024; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9C40E024
CVE: CVE-2018-5275
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40E020. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9C40E020; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9C40E020
CVE: CVE-2018-5276
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e018. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e018; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e018
CVE: CVE-2018-5277
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e000. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e000; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e000
CVE: CVE-2018-5278
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e00c. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e00c; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e00c
CVE: CVE-2018-5279
Published: 2018-01-08
Description: In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e02c. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/102453; https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e02c; http://www.securityfocus.com/bid/102453
CVE: CVE-2018-5284
Published: 2018-01-08
Description: The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/ImageInject.md; https://wordpress.org/support/topic/stored-xss-csrf-bug-at-the-latest-version-of-imageinject/; https://wpvulndb.com/vulnerabilities/8994
CVE: CVE-2018-5285
Published: 2018-01-08
Description: The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/ImageInject.md; https://wordpress.org/support/topic/stored-xss-csrf-bug-at-the-latest-version-of-imageinject/; https://wpvulndb.com/vulnerabilities/8994
CVE: CVE-2018-5286
Published: 2018-01-08
Description: The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/gd-rating-system.md; https://wordpress.org/support/topic/xss-lfi-bugs-at-the-latest-version-of-gd-rating-system/; https://wpvulndb.com/vulnerabilities/8995
CVE: CVE-2018-5287
Published: 2018-01-08
Description: The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/gd-rating-system.md; https://wordpress.org/support/topic/xss-lfi-bugs-at-the-latest-version-of-gd-rating-system/; https://wpvulndb.com/vulnerabilities/8995
CVE: CVE-2018-5288
Published: 2018-01-08
Description: The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/gd-rating-system.md; https://wordpress.org/support/topic/xss-lfi-bugs-at-the-latest-version-of-gd-rating-system/; https://wpvulndb.com/vulnerabilities/8995
CVE: CVE-2018-5289
Published: 2018-01-08
Description: The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/gd-rating-system.md; https://wordpress.org/support/topic/xss-lfi-bugs-at-the-latest-version-of-gd-rating-system/; https://wpvulndb.com/vulnerabilities/8995
CVE: CVE-2018-5290
Published: 2018-01-08
Description: The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/gd-rating-system.md; https://wordpress.org/support/topic/xss-lfi-bugs-at-the-latest-version-of-gd-rating-system/; https://wpvulndb.com/vulnerabilities/8995
CVE: CVE-2018-5291
Published: 2018-01-08
Description: The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/gd-rating-system.md; https://wordpress.org/support/topic/xss-lfi-bugs-at-the-latest-version-of-gd-rating-system/; https://wpvulndb.com/vulnerabilities/8995
CVE: CVE-2018-5292
Published: 2018-01-08
Description: The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/gd-rating-system.md; https://wordpress.org/support/topic/xss-lfi-bugs-at-the-latest-version-of-gd-rating-system/; https://wpvulndb.com/vulnerabilities/8995
CVE: CVE-2018-5293
Published: 2018-01-08
Description: The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/gd-rating-system.md; https://wordpress.org/support/topic/xss-lfi-bugs-at-the-latest-version-of-gd-rating-system/; https://wpvulndb.com/vulnerabilities/8995
CVE: CVE-2018-5294
Published: 2018-01-08
Description: In libming 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the readUInt32 function (util/read.c). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/libming/libming/issues/98; https://lists.debian.org/debian-lts-announce/2018/03/msg00008.html; https://security.gentoo.org/glsa/201904-24
CVE: CVE-2018-5295
Published: 2018-01-08
Description: In PoDoFo 0.9.5, there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1531897; https://bugzilla.redhat.com/show_bug.cgi?id=1531897
CVE: CVE-2018-5296
Published: 2018-01-08
Description: In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://bugzilla.redhat.com/show_bug.cgi?id=1531956; https://bugzilla.redhat.com/show_bug.cgi?id=1531956
CVE: CVE-2018-5298
Published: 2018-01-08
Description: In the Procter & Gamble "Oral-B App" (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with static parameters is used to secure the locally stored shared preferences. An attacker can gain access to locally stored user data more easily by leveraging access to the preferences XML file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://1337sec.blogspot.de/2018/01/auditing-oral-b-app-v500.html; https://1337sec.blogspot.de/2018/01/auditing-oral-b-app-v500.html
CVE: CVE-2018-5259
Published: 2018-01-08
Description: Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended attachment-deletion restrictions via a modified aid parameter.
CVSS Score: 8.8 (HIGH)
References: http://www.whsgwl.net/text.php?textid=3; https://gitee.com/ComsenzDiscuz/DiscuzX/issues/IH8SA; http://www.whsgwl.net/text.php?textid=3
CVE: CVE-2018-5280
Published: 2018-01-08
Description: SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102438; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0001; https://www.vulnerability-lab.com/get_content.php?id=1725
CVE: CVE-2018-5281
Published: 2018-01-08
Description: SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102443; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0002; https://www.vulnerability-lab.com/get_content.php?id=1729
CVE: CVE-2018-5282
Published: 2018-01-08
Description: Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. NOTE: the vendor disputes this issue because neither a buffer overflow nor a crash can be reproduced; also, reading XML documents is implemented exclusively with managed code within the Microsoft .NET Framework
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.exploit-db.com/exploits/43547/; https://www.vulnerability-lab.com/get_content.php?id=1943; https://www.exploit-db.com/exploits/43547/
CVE: CVE-2018-5283
Published: 2018-01-08
Description: The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.vulnerability-lab.com/get_content.php?id=1600; https://www.vulnerability-lab.com/get_content.php?id=1600
CVE: CVE-2013-4364
Published: 2018-01-08
Description: (1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to have unspecified impact via a symlink attack on an unspecified file in /tmp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://bugzilla.redhat.com/show_bug.cgi?id=1009734; https://bugzilla.redhat.com/show_bug.cgi?id=1009734
CVE: CVE-2014-1858
Published: 2018-01-08
Description: __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html; http://www.openwall.com/lists/oss-security/2014/02/08/3
CVE: CVE-2014-1859
Published: 2018-01-08
Description: (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html; http://www.openwall.com/lists/oss-security/2014/02/08/3
CVE: CVE-2014-2071
Published: 2018-01-08
Description: Aruba Networks ClearPass Policy Manager 6.1.x, 6.2.x before 6.2.5.61640 and 6.3.x before 6.3.0.61712, when configured to use tunneled and non-tunneled EAP methods in a single policy construct, allows remote authenticated users to gain privileges by advertising independent inner and outer identities within a tunneled EAP method.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://www.arubanetworks.com/assets/alert/aid-050214.asc; http://www.arubanetworks.com/assets/alert/aid-050214.asc
CVE: CVE-2014-3607
Published: 2018-01-08
Description: DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://shibboleth.net/community/advisories/secadv_20140919.txt; https://bugzilla.redhat.com/show_bug.cgi?id=1140438; https://code.google.com/archive/p/vt-middleware/issues/226
CVE: CVE-2014-4972
Published: 2018-01-08
Description: Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://g0blin.co.uk/cve-2014-4972/; https://wpvulndb.com/vulnerabilities/8232; https://g0blin.co.uk/cve-2014-4972/
CVE: CVE-2014-5069
Published: 2018-01-08
Description: Cross-site scripting (XSS) vulnerability in Symmetricom s350i 2.70.15 allows remote attackers to inject arbitrary web script or HTML via vectors involving system logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5069/; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5069/
CVE: CVE-2014-5071
Published: 2018-01-08
Description: SQL injection vulnerability in the checkPassword function in Symmetricom s350i 2.70.15 allows remote attackers to execute arbitrary SQL commands via vectors involving a username.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5071/; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5071/
CVE: CVE-2014-5334
Published: 2018-01-08
Description: FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2014/08/19/2; http://www.securityfocus.com/bid/69249; https://bugs.freenas.org/issues/5844
CVE: CVE-2014-5394
Published: 2018-01-08
Description: Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.huawei.com/us/psirt/security-advisories/2014/hw-362701; http://www.securityfocus.com/bid/69302; https://exchange.xforce.ibmcloud.com/vulnerabilities/97763
CVE: CVE-2014-5509
Published: 2018-01-08
Description: clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2014/08/30/2; http://www.securityfocus.com/bid/69473; https://bugzilla.redhat.com/show_bug.cgi?id=1135624
CVE: CVE-2014-7221
Published: 2018-01-08
Description: TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) by connecting to a channel with a different client instance, and placing crafted data in the Chat/Server tab containing [img]//http:// substrings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://r4p3.net/forum/reverse-engineering/38/teamspeak-3-exploit-bb-code-freeze-crash-not-responding/905; http://r4p3.net/public/ts3bbcodefreeze.txt; http://www.securityfocus.com/bid/70219
CVE: CVE-2014-7222
Published: 2018-01-08
Description: Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by connecting to a channel with a different client instance, and placing crafted data in the Chat/Server tab with two \\ (backslash) characters, a digit, a \ (backslash) character, and "z" in a series of nested img BBCODE tags.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/128571/TeamSpeak-Client-3.0.14-Buffer-Overflow.html; http://r4p3.net/forum/reverse-engineering/38/teamspeak-3-exploit-bb-code-freeze-crash-not-responding/905/; http://r4p3.net/public/ts3bbcodefreeze.txt
CVE: CVE-2015-2318
Published: 2018-01-08
Description: The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/; http://www.openwall.com/lists/oss-security/2015/03/17/9; http://www.securityfocus.com/bid/73253
CVE: CVE-2015-2319
Published: 2018-01-08
Description: The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/; http://www.openwall.com/lists/oss-security/2015/03/17/9; http://www.securityfocus.com/bid/73250
CVE: CVE-2015-2320
Published: 2018-01-08
Description: The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/; http://www.openwall.com/lists/oss-security/2015/03/17/9; http://www.securityfocus.com/bid/73256
CVE: CVE-2017-15883
Published: 2018-01-08
Description: Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vectors related to weak cryptography.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://knowledgebase.progress.com/articles/Article/Sitefinity-Security-Advisory-for-cryptographic-vulnerability-CVE-2017-15883; https://www.mnemonic.no/news/2017/vulnerability-finding-sitefinity-cms/; https://knowledgebase.progress.com/articles/Article/Sitefinity-Security-Advisory-for-cryptographic-vulnerability-CVE-2017-15883
CVE: CVE-2017-7997
Published: 2018-01-08
Description: Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2018/Jan/14; https://sysdream.com/news/lab/2018-01-02-cve-2017-7997-gespage-sql-injection-vulnerability/; https://www.exploit-db.com/exploits/43447/