deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11419
Published: 2018-05-24
Description: An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex function via a RegExp("[\\u0") payload, related to re_parse_char_class in parser/regexp/re-parser.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/jerryscript-project/jerryscript/issues/2230; https://github.com/jerryscript-project/jerryscript/issues/2230
CVE: CVE-2018-7518
Published: 2018-05-24
Description: In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v[PII_REDACTED].23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-522
References: https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01; https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01
CVE: CVE-2018-7526
Published: 2018-05-24
Description: In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v[PII_REDACTED].23, by accessing a specific uniform resource locator (URL) on the webserver, a malicious user may be able to access information in the application without authenticating.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01; https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01
CVE: CVE-2013-3018
Published: 2018-05-24
Description: The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21672403; https://exchange.xforce.ibmcloud.com/vulnerabilities/84354; http://www-01.ibm.com/support/docview.wss?uid=swg21672403
CVE: CVE-2013-3023
Published: 2018-05-24
Description: IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21672388; https://exchange.xforce.ibmcloud.com/vulnerabilities/84361; http://www-01.ibm.com/support/docview.wss?uid=swg21672388
CVE: CVE-2013-3024
Published: 2018-05-24
Description: IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-Force ID: 84362.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?&uid=swg21639553; https://exchange.xforce.ibmcloud.com/vulnerabilities/84362; http://www-01.ibm.com/support/docview.wss?&uid=swg21639553
CVE: CVE-2018-5674
Published: 2018-05-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. Crafted data in the PDF file can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process, a different vulnerability than CVE-2018-5676 and CVE-2018-5678.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0010/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-5675
Published: 2018-05-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. Crafted data in the PDF file can trigger an out-of-bounds write on a buffer. An attacker can leverage this vulnerability to execute code under the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0013/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-5676
Published: 2018-05-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. Crafted data in the PDF file can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process, a different vulnerability than CVE-2018-5674 and CVE-2018-5678.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0011/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-5677
Published: 2018-05-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process, a different vulnerability than CVE-2018-5679 and CVE-2018-5680.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0014/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-5678
Published: 2018-05-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. Crafted data in the PDF file can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process, a different vulnerability than CVE-2018-5674 and CVE-2018-5676.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0012/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-5679
Published: 2018-05-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process, a different vulnerability than CVE-2018-5677 and CVE-2018-5680.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0015/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-5680
Published: 2018-05-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of specially crafted pdf files with embedded u3d images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process, a different vulnerability than CVE-2018-5677 and CVE-2018-5679.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0016/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-7406
Published: 2018-05-24
Description: An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the u3d images inside of a pdf. The issue results from the lack of proper validation of user-supplied data, which can result in an array indexing issue. An attacker can leverage this to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-129
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0017/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-7407
Published: 2018-05-24
Description: An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists when rendering U3D images inside of pdf files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: http://www.securityfocus.com/bid/104300; https://srcincite.io/advisories/src-2018-0018/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-11440
Published: 2018-05-25
Description: Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html; http://www.securityfocus.com/bid/104321; https://github.com/liblouis/liblouis/issues/575
CVE: CVE-2018-1133
Published: 2018-05-25
Description: An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/104307; https://moodle.org/mod/forum/discuss.php?d=371199; https://www.exploit-db.com/exploits/46551/
CVE: CVE-2018-1134
Published: 2018-05-25
Description: An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/104307; https://moodle.org/mod/forum/discuss.php?d=371200; http://www.securityfocus.com/bid/104307
CVE: CVE-2018-1135
Published: 2018-05-25
Description: An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104307; https://moodle.org/mod/forum/discuss.php?d=371201; http://www.securityfocus.com/bid/104307
CVE: CVE-2018-1136
Published: 2018-05-25
Description: An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104307; https://moodle.org/mod/forum/discuss.php?d=371202; http://www.securityfocus.com/bid/104307
CVE: CVE-2018-1137
Published: 2018-05-25
Description: An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104307; https://moodle.org/mod/forum/discuss.php?d=371204; http://www.securityfocus.com/bid/104307
CVE: CVE-2018-11442
Published: 2018-05-25
Description: A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated by adding a new quotation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/NinjaXshell/a5fae5e2d1031ca59160fbe29d94279c; https://www.exploit-db.com/exploits/44763/; https://gist.github.com/NinjaXshell/a5fae5e2d1031ca59160fbe29d94279c
CVE: CVE-2018-11443
Published: 2018-05-25
Description: The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/NinjaXshell/be613dab99601f6abce884f6bc3d83a8; https://www.exploit-db.com/exploits/44764/; https://gist.github.com/NinjaXshell/be613dab99601f6abce884f6bc3d83a8
CVE: CVE-2018-11444
Published: 2018-05-25
Description: A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/NinjaXshell/4c0509096cb4ec6543b3f[PII_REDACTED]c; https://www.exploit-db.com/exploits/44765/; https://gist.github.com/NinjaXshell/4c0509096cb4ec6543b3f[PII_REDACTED]c
CVE: CVE-2018-11445
Published: 2018-05-25
Description: A CSRF issue was discovered on the User Add/System Settings Page (system-settings-user-new2.php) in EasyService Billing 1.0. A User can be added with the Admin role.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/NinjaXshell/a5fae5e2d1031ca59160fbe29d94279c; https://www.exploit-db.com/exploits/44763/; https://gist.github.com/NinjaXshell/a5fae5e2d1031ca59160fbe29d94279c
CVE: CVE-2017-3961
Published: 2018-05-25
Description: Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2018-11468
Published: 2018-05-25
Description: The __mkd_trim_line function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Orc/discount/issues/189; https://lists.debian.org/debian-lts-announce/2018/09/msg00009.html; https://www.debian.org/security/2018/dsa-4293
CVE: CVE-2018-6664
Published: 2018-05-25
Description: Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-347
References: http://www.securityfocus.com/bid/104299; http://www.securitytracker.com/id/1040895; https://kc.mcafee.com/corporate/index?page=content&id=SB10237
CVE: CVE-2018-6674
Published: 2018-05-25
Description: Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264, CWE-269, CWE-274, CWE-311
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10237; https://kc.mcafee.com/corporate/index?page=content&id=SB10237
CVE: CVE-2017-1752
Published: 2018-05-25
Description: IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg2C1000376; http://www.securityfocus.com/bid/104289; https://exchange.xforce.ibmcloud.com/vulnerabilities/135547
CVE: CVE-2018-11469
Published: 2018-05-25
Description: Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104347; https://access.redhat.com/errata/RHSA-2019:1436; https://git.haproxy.org/?p=haproxy-1.8.git%3Ba=commit%3Bh=17514045e5d934dede62116216c1b016fe23dd06
CVE: CVE-2018-11470
Published: 2018-05-25
Description: iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/hi-KK/CVE-Hunter/blob/master/3.md; https://github.com/hi-KK/CVE-Hunter/blob/master/3.md
CVE: CVE-2018-1449
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140044.
CVSS Score: 5.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22016181; http://www.securitytracker.com/id/1041004; https://exchange.xforce.ibmcloud.com/vulnerabilities/140044
CVE: CVE-2018-1450
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140045.
CVSS Score: 5.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22016181; http://www.securitytracker.com/id/1041004; https://exchange.xforce.ibmcloud.com/vulnerabilities/140045
CVE: CVE-2018-1451
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140046.
CVSS Score: 5.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22016181; http://www.securitytracker.com/id/1041004; https://exchange.xforce.ibmcloud.com/vulnerabilities/140046
CVE: CVE-2018-1452
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140047.
CVSS Score: 5.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22016181; http://www.securitytracker.com/id/1041004; https://exchange.xforce.ibmcloud.com/vulnerabilities/140047
CVE: CVE-2018-1459
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to stack based buffer overflow, caused by improper bounds checking which could lead an attacker to execute arbitrary code. IBM X-Force ID: 140210.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.ibm.com/support/docview.wss?uid=swg22016142; http://www.securitytracker.com/id/1041005; https://exchange.xforce.ibmcloud.com/vulnerabilities/140210
CVE: CVE-2018-1467
Published: 2018-05-25
Description: The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users. IBM X-Force ID: 140398.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1012293; http://www.securityfocus.com/bid/104290; https://exchange.xforce.ibmcloud.com/vulnerabilities/140398
CVE: CVE-2018-1488
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 140973.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=swg22016141; http://www.securitytracker.com/id/1040968; https://exchange.xforce.ibmcloud.com/vulnerabilities/140973
CVE: CVE-2018-1515
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1, under specific or unusual conditions, could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 141624.
CVSS Score: 7.4 (HIGH)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=swg22016140; http://www.securitytracker.com/id/1040969; https://exchange.xforce.ibmcloud.com/vulnerabilities/141624
CVE: CVE-2018-1544
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 142648.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=swg22016143; http://www.securitytracker.com/id/1040967; https://exchange.xforce.ibmcloud.com/vulnerabilities/142648
CVE: CVE-2018-1565
Published: 2018-05-25
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 143022.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=swg22016143; http://www.securitytracker.com/id/1040967; https://exchange.xforce.ibmcloud.com/vulnerabilities/143022
CVE: CVE-2017-9641
Published: 2018-05-25
Description: PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. OSIsoft recommends that users upgrade to PI Vision 2017 or greater to mitigate this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/99540; https://ics-cert.us-cert.gov/advisories/ICSA-17-192-04; https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00320