deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-17319
Published: 2018-03-20
Description: Huawei P9 smartphones with the versions before EVA-AL10C00B399SP02 have an information disclosure vulnerability. The software does not properly protect certain resource which can be accessed by multithreading. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in kernel information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180314-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180314-01-smartphone-en
CVE: CVE-2017-17320
Published: 2018-03-20
Description: Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in malicious code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180314-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180314-02-smartphone-en
CVE: CVE-2017-8176
Published: 2018-03-20
Description: Huawei IPTV STB with earlier than IPTV STB V100R003C01LMYTa6SPC001 versions has an authentication bypass vulnerability. An attacker could exploit this vulnerability to access the serial interface and modify the configuration. Successful exploit could lead to the authentication bypass and view channels by free.
CVSS Score: 7.5 (HIGH)
References: http://security.my/post/[PII_REDACTED]7/cve-2017-8176; http://support.huawei.com/carrier/navi?coltype=software?lang=en#col=software&detailId=PBI1-22570793&path=PBI1-21262245/PBI1-22317450/PBI1-22317491/PBI1-19974608/PBI1-14715&lang=en%3B; http://security.my/post/[PII_REDACTED]7/cve-2017-8176
CVE: CVE-2017-8187
Published: 2018-03-20
Description: Huawei FusionSphere OpenStack V100R006C00SPC102(NFV) has a privilege escalation vulnerability. Due to improper privilege restrictions, an attacker with high privilege may obtain the other users' certificates. Successful exploit may cause privilege escalation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-fusionsphere-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-fusionsphere-en
CVE: CVE-2018-5770
Published: 2018-03-20
Description: An issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a request to /goform/telnet, creating a telnetd service on the device. This service is password protected; however, several default accounts exist on the device that are root accounts, which can be used to log in.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://www.fidusinfosec.com/tenda-ac15-unauthenticated-telnetd-start-cve-2018-5770/; https://www.fidusinfosec.com/tenda-ac15-unauthenticated-telnetd-start-cve-2018-5770/
CVE: CVE-2017-14002
Published: 2018-03-20
Description: GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-798
References: http://www.securityfocus.com/bid/103405; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02; http://www.securityfocus.com/bid/103405
CVE: CVE-2017-14004
Published: 2018-03-20
Description: GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-798
References: https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2017-14006
Published: 2018-03-20
Description: GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-798
References: https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2017-14008
Published: 2018-03-20
Description: GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-798
References: http://www.securityfocus.com/bid/103400; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02; http://www.securityfocus.com/bid/103400
CVE: CVE-2018-7511
Published: 2018-03-20
Description: In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in turn, may allow remote execution of arbitrary code.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20, CWE-119
References: http://www.eaton.com/ecm/idcplg?IdcService=GET_FILE&allowInterrupt=1&RevisionSelectionMethod=LatestReleased&noSaveAs=0&Rendition=Primary&dDocName=PCT_3313148; http://www.securityfocus.com/bid/103301; https://ics-cert.us-cert.gov/advisories/ICSA-18-065-03
CVE: CVE-2018-8088
Published: 2018-03-20
Description: org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/103737; http://www.securitytracker.com/id/1040627; https://access.redhat.com/errata/RHSA-2018:0582
CVE: CVE-2018-1294
Published: 2018-03-20
Description: If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://seclists.org/oss-sec/2018/q1/107; http://seclists.org/oss-sec/2018/q1/107
CVE: CVE-2018-1321
Published: 2018-03-20
Description: An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements; http://www.securityfocus.com/bid/103508; https://www.exploit-db.com/exploits/45400/
CVE: CVE-2018-1322
Published: 2018-03-20
Description: An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting; http://www.securityfocus.com/bid/103507; https://www.exploit-db.com/exploits/45400/
CVE: CVE-2018-5438
Published: 2018-03-20
Description: Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613
References: http://www.securityfocus.com/bid/102847; https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01; https://www.usa.philips.com/healthcare/about/customer-support/product-security
CVE: CVE-2018-8822
Published: 2018-03-20
Description: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2022/12/27/3; http://www.securityfocus.com/bid/103476; https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html
CVE: CVE-2011-3178
Published: 2018-03-20
Description: In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78, CWE-94
References: https://bugzilla.suse.com/show_bug.cgi?id=723788; https://github.com/openSUSE/open-build-service/commit/cbfe2ed36dd77c[PII_REDACTED]dea7f914bb599201; https://bugzilla.suse.com/show_bug.cgi?id=723788
CVE: CVE-2018-1141
Published: 2018-03-20
Description: When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the installation location.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732
References: http://www.securitytracker.com/id/1040557; https://www.tenable.com/security/tns-2018-01; http://www.securitytracker.com/id/1040557
CVE: CVE-2018-5768
Published: 2018-03-20
Description: A remote, unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter for the COOKIE header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.fidusinfosec.com/tenda-ac15-hard-coded-accounts-cve-2018-5768/; https://www.fidusinfosec.com/tenda-ac15-hard-coded-accounts-cve-2018-5768/
CVE: CVE-2017-5736
Published: 2018-03-20
Description: An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code as administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/103482; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00117&languageid=en-fr; http://www.securityfocus.com/bid/103482
CVE: CVE-2018-3626
Published: 2018-03-20
Description: Edger8r tool in the Intel SGX SDK before version 2.1.2 (Linux) and 1.9.6 (Windows) may generate code that is susceptible to a side channel potentially allowing a local user to access unauthorized information.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103479; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00117&languageid=en-fr; http://www.securityfocus.com/bid/103479
CVE: CVE-2018-8828
Published: 2018-03-20
Description: A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193, CWE-787
References: https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow; https://github.com/kamailio/kamailio/commit/e1d8008a09d9390ebaf698abe8909e10dfec4097; https://usn.ubuntu.com/4240-1/
CVE: CVE-2014-1215
Published: 2018-03-20
Description: Multiple buffer overflows in Core FTP Server before 1.2 build 508 allow local users to gain privileges via vectors related to reading data from config.dat and Windows Registry.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/531144/100/0/threaded; https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1215/; http://www.securityfocus.com/archive/1/531144/100/0/threaded
CVE: CVE-2014-1457
Published: 2018-03-20
Description: Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanism by leveraging knowledge of an OWA user name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwebanalytics.com/?p=384; http://www.securityfocus.com/bid/65573; https://exchange.xforce.ibmcloud.com/vulnerabilities/91125
CVE: CVE-2014-1665
Published: 2018-03-20
Description: Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://blog.noobroot.com/2014/02/owncloud-600a-when-xss-vulnerability.html; http://www.securityfocus.com/bid/65457; https://exchange.xforce.ibmcloud.com/vulnerabilities/91012
CVE: CVE-2014-2031
Published: 2018-03-20
Description: Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to a logic error.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://samiam.org/blog/2014-02-12.html; http://www.openwall.com/lists/oss-security/2014/02/19/15; http://www.securitytracker.com/id/1029771
CVE: CVE-2014-2032
Published: 2018-03-20
Description: Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to missing input validation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-125
References: http://samiam.org/blog/2014-02-12.html; http://www.openwall.com/lists/oss-security/2014/02/19/15; http://www.securityfocus.com/bid/65595
CVE: CVE-2014-3990
Published: 2018-03-20
Description: The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-918
References: http://karmainsecurity.com/KIS-2014-08; http://packetstormsecurity.com/files/127460/OpenCart-1.5.6.4-PHP-Object-Injection.html; http://seclists.org/fulldisclosure/2014/Jul/67
CVE: CVE-2014-4928
Published: 2018-03-20
Description: SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://dringen.blogspot.com.au/2014/07/invision-power-board-blind-sql.html; http://dringen.blogspot.com.au/2014/07/invision-power-board-blind-sql.html
CVE: CVE-2015-7449
Published: 2018-03-20
Description: IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Quality Manager (RQM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Team Concert (RTC) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Requirements Composer (RRC) 4.0.x before 4.0.7 iFix10; Rational DOORS Next Generation (RDNG) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Engineering Lifecycle Manager (RELM) 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7 before iFix1, 5.0.x before 5.0.2 iFix1, and 6.0.x before 6.0.2; Rational Rhapsody Design Manager (Rhapsody DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Software Architect Design Manager (RSA DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2 allow local users to obtain sensitive information by leveraging weak encryption. IBM X-Force ID: 108221.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-326
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985143; https://exchange.xforce.ibmcloud.com/vulnerabilities/108221; http://www-01.ibm.com/support/docview.wss?uid=swg21985143
CVE: CVE-2015-7458
Published: 2018-03-20
Description: Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108354.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980518; https://exchange.xforce.ibmcloud.com/vulnerabilities/108354; http://www-01.ibm.com/support/docview.wss?uid=swg21980518
CVE: CVE-2015-7459
Published: 2018-03-20
Description: Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108355.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980518; https://exchange.xforce.ibmcloud.com/vulnerabilities/108355; http://www-01.ibm.com/support/docview.wss?uid=swg21980518
CVE: CVE-2015-7460
Published: 2018-03-20
Description: Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108356.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980518; https://exchange.xforce.ibmcloud.com/vulnerabilities/108356; http://www-01.ibm.com/support/docview.wss?uid=swg21980518
CVE: CVE-2015-7461
Published: 2018-03-20
Description: XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denial of service (memory consumption) via crafted XML data. IBM X-Force ID: 108357.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399, CWE-611
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980518; https://exchange.xforce.ibmcloud.com/vulnerabilities/108357; http://www-01.ibm.com/support/docview.wss?uid=swg21980518
CVE: CVE-2018-8832
Published: 2018-03-20
Description: enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/enhavo/enhavo/issues/459; https://github.com/enhavo/enhavo/issues/459
CVE: CVE-2018-8873
Published: 2018-03-20
Description: In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222040.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222040; https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222040
CVE: CVE-2018-8874
Published: 2018-03-20
Description: In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222054.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222054; https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222054
CVE: CVE-2018-8875
Published: 2018-03-20
Description: In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x0022209c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x0022209c; https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x0022209c
CVE: CVE-2018-8876
Published: 2018-03-20
Description: In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222098.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222098; https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222098
CVE: CVE-2018-8881
Published: 2018-03-20
Description: Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated string.
CVSS Score: 7.3 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html; https://bugzilla.nasm.us/show_bug.cgi?id=3392446
CVE: CVE-2018-8882
Published: 2018-03-20
Description: Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html; https://bugzilla.nasm.us/show_bug.cgi?id=3392445
CVE: CVE-2018-8883
Published: 2018-03-20
Description: Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled access to nasm_reg_flags.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html; https://bugzilla.nasm.us/show_bug.cgi?id=3392447
CVE: CVE-2018-1344
Published: 2018-03-21
Description: Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1
CVSS Score: 3.1 (LOW)
References: https://www.netiq.com/documentation/imanager-31/imanager31_releasenotes/data/imanager31_releasenotes.html; https://www.netiq.com/documentation/imanager-31/imanager31_releasenotes/data/imanager31_releasenotes.html
CVE: CVE-2018-1345
Published: 2018-03-21
Description: NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack.
CVSS Score: 5.9 (MEDIUM)
References: https://www.netiq.com/documentation/imanager-31/imanager31_releasenotes/data/imanager31_releasenotes.html; https://www.netiq.com/documentation/imanager-31/imanager31_releasenotes/data/imanager31_releasenotes.html
CVE: CVE-2018-1346
Published: 2018-03-21
Description: Addresses denial of service attack to eDirectory versions prior to 9.1.
CVSS Score: 3.1 (LOW)
References: http://www.securityfocus.com/bid/103493; https://www.netiq.com/documentation/edirectory-91/edirectory91_releasenotes/data/edirectory91_releasenotes.html; http://www.securityfocus.com/bid/103493