deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-1347
Published: 2018-03-21
Description: The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103492; https://www.netiq.com/documentation/imanager-31/imanager31_releasenotes/data/imanager31_releasenotes.html; http://www.securityfocus.com/bid/103492
CVE: CVE-2017-18241
Published: 2018-03-21
Description: fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d4fdf8ba0e5808ba9ad6b44337783bd9935e0982; https://github.com/torvalds/linux/commit/d4fdf8ba0e5808ba9ad6b44337783bd9935e0982; https://usn.ubuntu.com/3910-1/
CVE: CVE-2018-7269
Published: 2018-03-21
Description: The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/; http://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/
CVE: CVE-2018-8073
Published: 2018-03-21
Description: Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/; http://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/
CVE: CVE-2018-8074
Published: 2018-03-21
Description: Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: http://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/; http://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/
CVE: CVE-2017-0914
Published: 2018-03-21
Description: Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a GitLab instance's database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/298176; https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE: CVE-2017-0915
Published: 2018-03-21
Description: Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-20
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/298873; https://www.debian.org/security/2018/dsa-4145
CVE: CVE-2017-0916
Published: 2018-03-21
Description: Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-20
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/299473; https://www.debian.org/security/2018/dsa-4145
CVE: CVE-2017-0917
Published: 2018-03-21
Description: Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-20, CWE-79
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/299525; https://www.debian.org/security/2018/dsa-4145
CVE: CVE-2017-0918
Published: 2018-03-21
Description: Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/301432; https://www.debian.org/security/2018/dsa-4145
CVE: CVE-2017-0922
Published: 2018-03-21
Description: Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-863
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/301123; https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE: CVE-2017-0923
Published: 2018-03-21
Description: Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/293740; https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE: CVE-2017-0924
Published: 2018-03-21
Description: Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://hackerone.com/reports/294099; https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE: CVE-2017-0925
Published: 2018-03-21
Description: Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.
CVSS Score: 7.2 (HIGH)
CWE: CWE-522, CWE-319
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/3847; https://www.debian.org/security/2018/dsa-4145
CVE: CVE-2017-0926
Published: 2018-03-21
Description: Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285, CWE-863
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/32198; https://www.debian.org/security/2018/dsa-4145
CVE: CVE-2017-0927
Published: 2018-03-21
Description: Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/37594; https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE: CVE-2018-1229
Published: 2018-03-21
Description: Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/103462; https://pivotal.io/security/cve-2018-1229; http://www.securityfocus.com/bid/103462
CVE: CVE-2018-1230
Published: 2018-03-21
Description: Pivotal Spring Batch Admin, all versions, does not contain cross site request forgery protection. A remote unauthenticated user could craft a malicious site that executes requests to Spring Batch Admin. This issue has not been patched because Spring Batch Admin has reached end of life.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/103463; https://pivotal.io/security/cve-2018-1230; http://www.securityfocus.com/bid/103463
CVE: CVE-2018-3710
Published: 2018-03-21
Description: Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-377, CWE-22
References: https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/; https://gitlab.com/gitlab-com/infrastructure/issues/3510; https://gitlab.com/gitlab-org/gitlab-ce/issues/41757
CVE: CVE-2018-7513
Published: 2018-03-21
Description: In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a stack-based buffer overflow.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/103394; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-01; http://www.securityfocus.com/bid/103394
CVE: CVE-2018-7515
Published: 2018-03-21
Description: In Omron CX-Supervisor Versions 3.30 and prior, access of uninitialized pointer vulnerabilities can be exploited when CX Supervisor indirectly calls an initialized pointer when parsing malformed packets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-256, CWE-824
References: http://www.securityfocus.com/bid/103394; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-01; http://www.securityfocus.com/bid/103394
CVE: CVE-2018-7517
Published: 2018-03-21
Description: In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause an out of bounds vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/103394; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-01; http://www.securityfocus.com/bid/103394
CVE: CVE-2018-7519
Published: 2018-03-21
Description: In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a heap-based buffer overflow.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-122, CWE-787
References: http://www.securityfocus.com/bid/103394; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-01; http://www.securityfocus.com/bid/103394
CVE: CVE-2018-7521
Published: 2018-03-21
Description: In Omron CX-Supervisor Versions 3.30 and prior, use after free vulnerabilities can be exploited when CX Supervisor parses a specially crafted project file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: http://www.securityfocus.com/bid/103394; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-01; http://www.securityfocus.com/bid/103394
CVE: CVE-2018-7523
Published: 2018-03-21
Description: In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a double free vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-415, CWE-415
References: http://www.securityfocus.com/bid/103394; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-01; http://www.securityfocus.com/bid/103394
CVE: CVE-2018-7525
Published: 2018-03-21
Description: In Omron CX-Supervisor Versions 3.30 and prior, processing a malformed packet by a certain executable may cause an untrusted pointer dereference vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-822, CWE-476
References: http://www.securityfocus.com/bid/103394; https://ics-cert.us-cert.gov/advisories/ICSA-18-072-01; http://www.securityfocus.com/bid/103394
CVE: CVE-2016-10717
Published: 2018-03-21
Description: A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-254
References: http://www.securitytube.net/video/16690; https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/; https://github.com/mspaling/mbam-exclusions-poc-
CVE: CVE-2014-4912
Published: 2018-03-22
Description: An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/33983/; https://www.exploit-db.com/exploits/33983/
CVE: CVE-2018-8894
Published: 2018-03-22
Description: In 2345 Security Guard 3.6, the driver file (2345BdPcSafe.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222108.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222108; https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222108
CVE: CVE-2018-8895
Published: 2018-03-22
Description: In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222040.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/2345DumpBlock.sys-0x00222040; https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/2345DumpBlock.sys-0x00222040
CVE: CVE-2018-8896
Published: 2018-03-22
Description: In 2345 Security Guard 3.6, the driver file (2345DumpBlock.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222044.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/2345DumpBlock.sys-0x00222044; https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/2345DumpBlock.sys-0x00222044
CVE: CVE-2018-8904
Published: 2018-03-22
Description: In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002000.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002000; https://github.com/D0neMkj/POC_BSOD/tree/master/Windows%20Optimization%20master/0xf1002000
CVE: CVE-2018-8905
Published: 2018-03-22
Description: In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2780; https://access.redhat.com/errata/RHSA-2019:2053; https://github.com/halfbitteam/POCs/tree/master/libtiff-4.08_tiff2ps_heap_overflow
CVE: CVE-2018-8906
Published: 2018-03-22
Description: dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/address_id/2.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xuheunbaicai/cangku/blob/master/cve/dsmall_v20180320_bug.md; https://github.com/xuheunbaicai/cangku/blob/master/cve/dsmall_v20180320_bug.md
CVE: CVE-2017-17743
Published: 2018-03-22
Description: Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.19, and 5.1.x before 5.1.11 allows authenticated remote attackers to escape the shell and escalate their privileges by uploading a .bashrc file containing the /bin/sh string. In some situations, authentication can be achieved via the bhu85tgb default password for the admin account.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-287
References: https://securite.intrinsec.com/2018/03/19/cve-2017-17743-ucopia-shell-escape/; https://securite.intrinsec.com/2018/03/19/cve-2017-17743-ucopia-shell-escape/
CVE: CVE-2018-8899
Published: 2018-03-22
Description: IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895; https://github.com/IdentityServer/IdentityServer4/issues/2164; https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3
CVE: CVE-2018-8909
Published: 2018-03-22
Description: The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to AssetService.scala.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.x41-dsec.de/reports/X41-Kudelski-Wire-Security-Review-Android.pdf; https://www.x41-dsec.de/reports/X41-Kudelski-Wire-Security-Review-Android.pdf
CVE: CVE-2016-9711
Published: 2018-03-22
Description: IBM Predictive Solutions Foundation (IBM Cognos Analytics 11.0) reveals sensitive information in detailed error messages that could aid an attacker in further attacks against the system. IBM X-Force ID: 119619.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22014337; http://www.securityfocus.com/bid/103495; https://exchange.xforce.ibmcloud.com/vulnerabilities/119619
CVE: CVE-2017-1571
Published: 2018-03-22
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 131853.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-327
References: http://www.ibm.com/support/docview.wss?uid=swg22012948; http://www.securityfocus.com/bid/103494; https://exchange.xforce.ibmcloud.com/vulnerabilities/131853
CVE: CVE-2017-1677
Published: 2018-03-22
Description: IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999.
CVSS Score: 7.4 (HIGH)
CWE: CWE-502
References: http://www.ibm.com/support/docview.wss?uid=swg22012896; http://www.securityfocus.com/bid/103422; http://www.securitytracker.com/id/1041227
CVE: CVE-2017-1788
Published: 2018-03-22
Description: IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: 137031.
CVSS Score: 5.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22012341; http://www.securityfocus.com/bid/103497; https://exchange.xforce.ibmcloud.com/vulnerabilities/137031
CVE: CVE-2017-1789
Published: 2018-03-22
Description: IBM Tivoli Monitoring V6 6.2.3 and 6.3.0 could allow an unauthenticated user to remotely execute code through unspecified methods. IBM X-Force ID: 137034.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.ibm.com/support/docview.wss?uid=swg22014096; https://exchange.xforce.ibmcloud.com/vulnerabilities/137034; http://www.ibm.com/support/docview.wss?uid=swg22014096
CVE: CVE-2018-1426
Published: 2018-03-22
Description: IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.
CVSS Score: 7.4 (HIGH)
CWE: CWE-335
References: http://www.ibm.com/support/docview.wss?uid=swg22013756; http://www.securityfocus.com/bid/105580; http://www.securitytracker.com/id/1041012
CVE: CVE-2018-1427
Published: 2018-03-22
Description: IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 139072.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=swg22013756; http://www.securityfocus.com/bid/103536; http://www.securitytracker.com/id/1041012
CVE: CVE-2018-1428
Published: 2018-03-22
Description: IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 139073.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-327
References: http://www.ibm.com/support/docview.wss?uid=swg22013756; http://www.securityfocus.com/bid/103574; http://www.securitytracker.com/id/1041012
CVE: CVE-2018-1448
Published: 2018-03-22
Description: IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140043.
CVSS Score: 7.7 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22014388; http://www.securityfocus.com/bid/103535; https://exchange.xforce.ibmcloud.com/vulnerabilities/140043
CVE: CVE-2017-18094
Published: 2018-03-22
Description: Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CRUC-8177; https://jira.atlassian.com/browse/FE-7010; https://jira.atlassian.com/browse/CRUC-8177
CVE: CVE-2018-0534
Published: 2018-03-22
Description: Cross-site scripting vulnerability in ArsenoL Version 0.5 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN30864198/index.html; https://jvn.jp/en/jp/JVN30864198/index.html
CVE: CVE-2018-0535
Published: 2018-03-22
Description: Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN48774168/index.html; https://jvn.jp/en/jp/JVN48774168/index.html
CVE: CVE-2018-0536
Published: 2018-03-22
Description: Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN64990648/index.html; https://jvn.jp/en/jp/JVN64990648/index.html
CVE: CVE-2018-0537
Published: 2018-03-22
Description: Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz_op.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN96655441/index.html; https://jvn.jp/en/jp/JVN96655441/index.html
CVE: CVE-2018-0538
Published: 2018-03-22
Description: Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN46471407/index.html; https://jvn.jp/en/jp/JVN46471407/index.html
CVE: CVE-2018-0539
Published: 2018-03-22
Description: QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN22536871/index.html; https://jvn.jp/en/jp/JVN22536871/index.html